Read a Passage, Look Into the Light: Việt Nam Sets Technical Rules for Voice and Iris Biometrics in the Citizen ID Database

Việt Nam’s Luật Căn cước has listed iris images and voice among the biometric data in the citizen identity database since 2024. Until now there has been no binding technical rulebook for how that data is captured or protected. On 1 October 2026 the Minister of Public Security, Đại tướng Lương Tam Quang, signed two circulars that fill the gap. Thông tư 169/2026/TT-BCA issues QCVN 16:2026/BCA, the national technical regulation on voice biometrics. Thông tư 170/2026/TT-BCA issues QCVN 17:2026/BCA, the regulation on iris biometrics. Both were posted on the Government’s legal-documents portal on 5 October and both take effect on 15 April 2027.

The documents

Issuer: Bộ Công an (Ministry of Public Security), on the proposal of the Cục Công nghiệp an ninh (Security Industry Department). The Ministry of Science and Technology gave comments.
Signed: 1 October 2026. Effective: 15 April 2027, a six-and-a-half-month lead time.
Legal bases: Luật Tiêu chuẩn và Quy chuẩn kỹ thuật (as amended in 2025), Luật Căn cước 26/2023/QH15 (as amended by Luật 118/2025/QH15), Luật Bảo vệ dữ liệu cá nhân 91/2025/QH15 and Luật An ninh mạng 116/2025/QH15.
Scope: Both regulations cover biometric data collected “to serve the Cơ sở dữ liệu căn cước”, the national identity database. They apply to police units. They also apply to any organisation or individual that collects, manages or uses this data, or that buys, imports, trades, tests, certifies, manufactures or builds the capture equipment.

That last group is why this matters outside the police. A QCVN is mandatory. Anyone who supplies microphones, iris scanners or capture software for the identity system will have to meet these specifications.

Voice: QCVN 16:2026/BCA

The voice regulation is the more detailed of the two and reads like a data-governance standard as much as an audio spec.

The sample. The voice must be natural and captured live, not played back from an electronic device. People who can read recite one of 20 standard passages printed in the appendix. Those who cannot read speak freely on a topic the officer suggests. The person must be in good health and speaking normally at the time.

The file. Samples are stored as mono, uncompressed PCM WAV at at least 16,000 Hz and 16 bits. A sample is destroyed or rejected outright if it has any clipping, is not a WAV file, falls below 16 kHz, or fails its SHA-256 checksum. These rules have no exceptions. For exchange between systems, the data goes into an XML package based on ISO/IEC 19794-13:2018 and the ANSI/NIST-ITL Type-11 voice record. The audio is encrypted and Base64-encoded, and the whole package is digitally signed by the sending system.

Two layers of metadata. A technical layer stays with the audio file. It holds the capture time, record ID, device ID, recording parameters, quality scores, software name and version, a dialect-region code (North, Central or South) and a checksum. An identity layer is stored separately and encrypted. It holds the internal subject ID, a reference to the consent record and the ID of the officer who did the capture. The internal subject ID in both layers must not contain direct personal identifiers.

Software. Capture software must automatically measure and record signal-to-noise ratio, noise floor, peak level, fundamental frequency (F0), formants F1–F4, jitter and shimmer. It must also publicly document its analysis algorithm: name, version, configuration parameters that affect results, and known limitations. Results must be independently reproducible. Before deployment, the software is tested against a reference dataset issued by the competent authority. Its supplier must carry out conformity assessment and declare and register conformity (công bố hợp quy) before the software can be used.

Hardware and room. Microphones need a 20 Hz–16 kHz response, sensitivity of at least −40 dBV/Pa, and a unidirectional (cardioid) pattern. Sound cards need at least 80 dB(A) dynamic range and USB Audio Class 2.0 support. First-time enrolment requires a soundproofed room or cabin with background noise of no more than 40 dB(A) and reverberation (RT60) of no more than 0.5 seconds. Any other capture has to measure and log both values before each session.

Security and deletion. Data is encrypted on the device before it is written to storage. Transport uses mutually authenticated encryption, and keys at the central database are held in a hardware security module. Access is role-based so that no single person can reach enough data to identify a subject alone. Every action goes into an immutable audit log that even system administrators cannot edit or delete. Original recordings can never be modified. Metadata corrections go into a separate correction record. Deletion applies when the retention period ends, at the data subject’s request, or on a decision of a competent authority. It must cover every copy, including backups, at least to the NIST SP 800-88 Rev.2 “Purge” level. Each transfer needs a chain-of-custody record, and data that arrives without one is refused.

Iris: QCVN 17:2026/BCA

The iris regulation is mostly a hardware and image-format standard.

Scanners must use near-infrared light at 700–900 nm and meet IEC 62471 and IEC 60825-1 eye-safety standards. They need a camera resolution of at least 18 pixels/mm, a minimum 640 × 480 image, image quality per ISO/IEC 29794-6, simultaneous capture of both eyes, portability, IP64 dust and water protection, and AES-256 encryption. They must run on Windows 10+, Ubuntu 20.04+ or Android 10+ and operate from 0 °C to 50 °C.
Capture rules: at least 70% of the iris must be visible. The head must be level to within ±10°. Pupil diameter must be 20–70% of the iris diameter, and glasses, including contact lenses, must be removed.
Storage: images are PNG or JPEG2000 in the ISO/IEC 19794-6 formats. For the chip, the regulation picks a cropped and masked JPEG2000 image of 2–6 kB, suited to 1:1 matching. For the central system, it picks the same format at 20–50 kB for one-to-many searches.
Keys: iris data must be encrypted, with full key-lifecycle management aligned with ISO/IEC 27001:2022 and the Luật An ninh mạng.

Who is affected

Citizens. Nothing changes at the counter today. The regulations say how voice and iris data must be collected, not who must give it or when. The draft voice regulation published in October 2025 proposed first collection at age 6 and updates at later age bands. The final QCVN text sets no ages.
Biometric hardware and software vendors have about six months to align products with the specifications and, for voice software, to complete conformity declaration. Devices also face a security check by the competent authority before use.
System integrators and data processors working on identity projects inherit the audit-log, separation-of-duties, chain-of-custody and deletion obligations.

Open questions

Collection procedure. Under Nghị quyết 22/2026/NQ-CP, Quyết định 2709/QĐ-BCA of 15 May 2026 abolished the ministry- and provincial-level procedures for collecting and updating DNA and voice biometrics. The Ministry said this does not end biometric collection where the law requires it. Handling moves to commune-level police. How and where voice will actually be recorded under the new QCVN, especially given its soundproof-cabin requirement, is not yet spelled out.
Reach beyond the identity database. Both texts are scoped to the Cơ sở dữ liệu căn cước. Banks and fintechs that use voice or iris for their own eKYC are not directly bound, but these specifications are likely to become the reference point.
Test datasets. The reference dataset for certifying voice software is to be issued by “the competent authority”. It has not been published yet.

Sources

This post is general information, not legal advice.