Free Data for Startups, a 24-Hour Clock for Requests: Việt Nam Opens the National Data Center to Innovators

Việt Nam has spent two years building the pipes of its data economy: the Luật Dữ liệu (Data Law, 60/2024/QH15), the National Data Center run by the Ministry of Public Security, a national data exchange and a fine regime for data violations. What was missing was a reason for anyone outside government to actually use that data. Nghị định 386/2026/NĐ-CP, published by the Government Office on 14 October, is that reason. It reads less like a regulation and more like an investment prospectus: subsidies, deadlines that bind the state, a sandbox, a lab, an incubator and a pay scale designed to poach data talent.

The document

Number: Nghị định 386/2026/NĐ-CP, Quy định cơ chế đột phá phát triển cho hoạt động sáng tạo, khai thác dữ liệu quốc gia; hoạt động sáng tạo, khai thác dữ liệu tại Trung tâm Sáng tạo, khai thác dữ liệu thuộc Trung tâm dữ liệu quốc gia
Issued by: the Government, on the proposal of the Minister of Public Security; signed by Deputy Prime Minister Hồ Quốc Dũng
Signed: 12 October 2026
Effective: 1 December 2026 (Điều 53)
Size: 5 chapters, 54 articles
Legal bases include the Data Law, the Luật Bảo vệ dữ liệu cá nhân (97/2025/QH15), the Luật Trí tuệ nhân tạo (134/2025/QH15), the Luật An ninh mạng (116/2025/QH15) and the Luật Khoa học, công nghệ và đổi mới sáng tạo (93/2025/QH15).

It applies to the Data Creation and Exploitation Center (Trung tâm Sáng tạo, khai thác dữ liệu) inside the National Data Center, and to any Vietnamese or foreign organisation or individual doing data innovation in Việt Nam.

What changes

1. The state pays for your data access

Before this decree, the Data Law said state data could be exploited, but nobody was told who pays. Điều 8 now sets a menu of subsidies by type of applicant:

Individuals or teams with a breakthrough idea or data-product prototype: 100% of data-exploitation costs for 24 months; up to 70% of prototype costs (standardisation, metadata, anonymisation, API integration, security and performance testing), capped at 500 million đồng per project per year for two years; secure processing environments free up to 200 million đồng a year; a personal identified account for remote data access.
Innovative startups and S&T enterprises: 100% of data fees for 36 months; up to 70% of product, integration and compliance-assessment costs (data law, personal data protection, cybersecurity), capped at 1 billion đồng per project per year for three years; half of cloud and compute rental up to 20 million đồng a month; up to 300 million đồng a year for IP and standards consulting; priority entry to the sandbox and to public procurement.
Companies with a live data product that want to scale: 50% of data fees for 24 months (70% if a state body, S&T organisation or university has confirmed initial test results); up to 50% of integration, cleaning and safety-testing costs, capped at 2 billion đồng per project per year.
Universities and research institutes: 100% of data fees for state-funded tasks; up to 3 billion đồng a year for building research datasets; up to 1 billion đồng a year of state-funded compute.

Điều 14 adds parallel support for R&D, digital transformation and data-product projects run by businesses (50% of fees for 24 months, up to 2 billion đồng a year) and 100% for public-interest work such as disaster prevention, health and education. One rule caps the generosity: an applicant that qualifies under several headings gets the single highest level, never a sum (Điều 4, Điều 8 k8, Điều 14 k5).

2. One request, hard deadlines

Điều 13 imposes a “one declaration, one appraisal, one point of contact” rule. Requests are filed entirely online and must state identity, purpose, scope, legal basis and, for sensitive data, a protection plan. The receiving body has 3 working days to ask for more information; after that the request is deemed valid. Then the clock is:

24 hours for standard data packages already published for automated access;
3 working days for shared data needing ordinary checks;
7 working days where data must be anonymised, de-identified or placed in a secure processing environment;
10 working days for especially complex cases, extendable once with written reasons.

Agencies may not demand paper copies of valid electronic documents or re-submission of data the state already holds. If data is already at the National Data Center, applicants do not have to repeat the procedure at a ministry or province (Điều 11), and the Center must publish a catalogue of data open for innovation use. Refusals must be in writing with reasons (Điều 10).

3. A sandbox, a lab and an incubator

Controlled testing (Điều 27): for data products, services, technologies and business models that existing law does not cover or covers incompletely. Tests may run in physical, network or geographic space for up to 3 years, extendable once. Certificates of participation must be issued within 10 working days and certificates of completion within 7. Where a sector already has its own sandbox (banking, for example), the participant can choose which regime to use.
National Data Lab (Điều 26): an isolated environment where startups, students and researchers test forecasting models and data products on real data before scaling.
National Data Incubator (Điều 22) for data startups no older than five years, plus data innovation spaces (Điều 23) offering up to 10 m² of desk space or 15 million đồng a month for 24 months.
Data exchange (Điều 37): the Center can list, sell and verify data on a data marketplace, but only with a full legal basis or the lawful consent of whoever holds rights in the data, and with published prices and benefit-sharing terms.
Civil data centres (Điều 43): the Center can build or co-invest in commercial data centres, classed as telecom works, which may not hold state secrets without permission.

4. Money for talent

Điều 5 defines “young talent” as Vietnamese citizens aged 16 to 35 and lets organisations negotiate pay, IP rights and profit-sharing tied to output. Experts and young talent get “the best” personal income tax incentives available, including exemptions modelled on those for the International Financial Centre in Việt Nam. Staff of the Center can receive a monthly top-up of 50–100% of salary based on annual performance, and contract staff bonuses up to 12 months’ salary (Điều 46). Điều 52 extends the science-law liability shield to failed experiments carried out within accepted risk.

The strings attached

Every subsidy comes with duties in Điều 17: keep full logs of all processing, return or destroy data when the permitted purpose or period ends, report incidents immediately, accept audits, and surrender any gains from violations. The state should prefer to release data in anonymised, de-identified or aggregated form, or only inside a secure processing environment. Breaching access conditions means suspension or withdrawal of access rights.

Who should care

AI and data startups that need training or validation data from population, land, business or health databases now have a priced, time-bound route instead of a negotiation.
Universities and labs get near-free access for funded projects and state compute.
Foreign firms can join the sandbox and incubator, but only through a cooperation agreement with the Center, which sits inside the Ministry of Public Security.
Ministries and provinces lose the ability to stall: the decree binds them to its deadlines and bans re-collecting data they already hold.

Open questions

What does data cost before the subsidy? The decree sets percentages of “data-exploitation fees” but no fee schedule, so the real cost to users depends on fee rules issued separately.
Who qualifies? The Minister of Public Security will set the criteria for “experts”, “young talent” and incubator entry. Until then, the Article 5 incentives exist on paper only.
How does this sandbox relate to the one under the Data Law? Điều 27 points back to “data law” for the application procedure, so the two regimes will have to be read together.
Will there be money? Support is drawn from the National Data Development Fund, science funds and the Center’s own revenue; the decree does not set a budget.

Sources

This post is general information, not legal advice.