When the Police Borrow Your Code: Nghị định 304/2026/NĐ-CP Rewrites How Bộ Công an Mobilises Private Tech

From 1 October 2026, Bộ Công an (the Ministry of Public Security) has a new rulebook for borrowing technology, data and people from outside the police. Nghị định 304/2026/NĐ-CP, on “huy động tiềm lực khoa học và công nghệ, kỹ thuật phục vụ hoạt động của Công an nhân dân” (mobilising scientific, technological and technical capacity to serve the People’s Police), was signed on 3 August 2026 by Deputy Prime Minister Phạm Gia Túc on behalf of the Government, on the proposal of the Minister of Public Security. It has 5 chapters and 16 articles. It details khoản 2 Điều 33 of Luật Công an nhân dân 37/2018/QH14 (as amended, most recently by Luật 86/2025/QH15), and also cites Luật Khoa học, Công nghệ và Đổi mới sáng tạo 93/2025/QH15.

It repeals Nghị định 169/2007/NĐ-CP of 19 November 2007, which had governed the same subject for almost nineteen years. That decree was written before cloud computing, before Vietnamese personal data protection law, and before “cybersecurity staff” was a job title. The new one is shorter, and its definitions are written for a software economy.

What can be mobilised

Điều 3 defines “tiềm lực khoa học và công nghệ, kỹ thuật” as technology, research and development results, physical and technical facilities, scientific and technical information, databases and records, and S&T personnel. Điều 6 then sorts what can be mobilised into four groups:

Technology and IP: advanced, high, strategic, core, new and clean technologies, and the right to use R&D results, computer programs, databases, trade secrets and other protected intellectual property.
Facilities: R&D infrastructure, laboratories, test stations, monitoring stations and specialised equipment, together with the staff who run them, for police training and research institutions.
Information: information systems and databases on science and technology, together with the people who operate them, and explicitly IT, cybersecurity and digital transformation personnel.
People: the national Chief Engineers (Tổng công trình sư) and Chief Architects for science, technology, innovation and digital transformation, domestic and overseas experts and talent, teachers in these fields, and S&T managers.

The 2007 decree listed only machinery and “information and communication systems”, S&T organisations, S&T individuals, and research achievements. Software, databases, trade secrets and cybersecurity staff appear by name for the first time.

What changed from the 2007 regime

No more “mandatory” mobilisation in this decree. Điều 5 of the 2007 text listed three methods, and the first was bắt buộc (compulsory) mobilisation in urgent cases or when national security was threatened. Its Điều 21 then allowed the Prime Minister to requisition systems, equipment and experts, with immediate effect and enforcement against anyone who did not comply. The new Điều 5 lists voluntary, agreement with Bộ Công an, and a Prime Minister’s decision. That third method applies only to public assets held by state bodies, and only when the voluntary and agreement routes have failed. Emergencies, counter-terrorism, requisition, purchase-by-requisition and compulsory IP licensing are all excluded by Điều 1 k2. They stay with their own specialised laws, so they have not disappeared from the legal system as a whole.

One annual plan, approved by the Prime Minister. Bộ Công an drafts a yearly plan with ministries and provinces, listing objectives, the items to be mobilised, time, place, budget and responsibilities (Điều 7). The Prime Minister approves it (Điều 8). The 2007 decree had five-year and annual plans and allowed ad hoc additions. Individual tasks are then approved by the Minister of Public Security and must be notified to those concerned within 03 working days (Điều 10). The old decree required a mobilisation decision to reach the people affected at least 30 days before it was carried out. The new text has no equivalent lead-time rule.

Data can be requested online. Under Điều 9 k2a, organisations and individuals provide or share data or reports on their S&T capacity “through an online platform or directly”, in line with the approved plan and a notice from Bộ Công an. In return, Bộ Công an must keep those reports confidential, including business secrets, technical and technological know-how, and personal data (Điều 9 k1c).

Foreign-linked items are screened first. Anything mobilised that has a “yếu tố nước ngoài” (foreign element) must pass a security and safety risk assessment by Bộ Công an before it is accepted (Điều 11 k1a). Physical facilities and systems are handed over and returned under a minute (biên bản) that records their value and condition. Personnel and operating staff are engaged under contract.

Compensation has a clock. Điều 14 sets out how losses are paid. Lost equipment is paid at the value recorded in the handover minute. Damaged equipment is paid at market repair cost, including the cost of renting a replacement during repairs. “Other damage” is paid at market cost to restore data, recover systems and remediate incidents, a category clearly aimed at IT assets. Lost income from the start of mobilisation to its end is also compensable. Bộ Công an must settle a claim within 06 months of receiving it, and the State guarantees the budget. For technology and IP, the ministry pays a usage fee by agreement. Leaked know-how or infringed IP is compensated under civil law and Luật Trách nhiệm bồi thường của Nhà nước.

Pay for people. A mobilised civil servant keeps their full salary and bonuses and also receives contract-based support of up to 100% of the salary they currently receive (Điều 13 k1). People not paid from the state budget receive fees by contract that must be commensurate with the task and with market salary levels. Overtime follows the Labour Code. Injury or death is covered by social insurance and occupational safety rules, and may lead to recognition as a war invalid or martyr.

Who this affects

The decree applies to Vietnamese agencies, organisations and citizens, and to foreigners, foreign organisations and international organisations residing or operating in Việt Nam (Điều 2). In practice, the groups most exposed are:

Software, AI and data companies, whose programs, databases and models now fall squarely within what can be requested under an agreement.
Universities, labs and testing centres, especially public ones, since their facilities are public assets and can be mobilised by a Prime Minister’s decision if negotiation fails.
Cybersecurity firms and their engineers, named explicitly as personnel who can be mobilised.
Foreign-invested firms, which face the pre-acceptance risk assessment for anything with a foreign element.

Practical implications

For private businesses, the most important point is that the coercive path in this decree covers only public assets. Toward a private company, Bộ Công an’s options under Nghị định 304 are a voluntary contribution or a negotiated agreement. That makes the contract the main protection. Firms approached should pin down scope, duration, the usage fee for software or IP, ownership and commercialisation rights in any results (Điều 12 k1đ refers to the KH,CN&ĐMST law), confidentiality obligations, and the return or deletion of data at the end. Firms should also keep an asset-value record ready, because handover minutes fix the compensation baseline.

The obligations in Điều 12 k2 are still real: assist Bộ Công an in carrying out plans and tasks, comply with any Prime Minister’s decision, and follow state-secret rules throughout. Điều 4 k4 also reminds mobilised parties that personal data protection law applies to them. A company that shares a database with the police remains a data controller with its own duties.

Open questions

Implementing rules are pending. The Minister of Public Security must set the budgeting rules (Điều 7 k2), the handover and return procedures (Điều 11 k4) and the compensation-claim procedure (Điều 14 k6). Until those circulars appear, the online reporting platform and the forms remain undefined.
No prohibited-acts list. The 2007 decree’s Điều 11 banned abuse of mobilisation, concealment of assets and disclosure of secrets. The new text has no such article, and nothing in it sets penalties for non-cooperation.
The 03-working-day notice replaces a 30-day lead time. It is not clear how much warning a provider will get before a task begins.
Scope of “foreign element” is undefined. The term could cover foreign-owned companies, imported equipment, foreign-licensed software, or all three.
Interaction with data law. How a voluntary or agreed handover of a database squares with consent and purpose limits under the personal data protection regime is not addressed beyond the general reminder in Điều 4.

Sources

This post is general information, not legal advice.