MFA, Bulk-Download Alarms and Twelve-Month Logs: The New Rulebook for Việt Nam’s Home Affairs Databases

Việt Nam’s Ministry of Home Affairs (Bộ Nội vụ) holds some of the most sensitive records in the state: who works in the civil service, their positions and career histories, how the administrative map is drawn, and, since the 2025 restructuring folded the former labour ministry into it, a large share of labour and employment data too. On 16 October 2026 a new circular takes over the rules for how those databases are filled, connected, monitored and used. Thông tư 19/2026/TT-BNV is short at 18 articles, but it includes technical controls that were not spelled out before: multi-factor login, automatic alarms when someone downloads too much, digitally signed approval of records, and minimum retention periods for backups and logs.

The document

Number: Thông tư 19/2026/TT-BNV
Title: Quy định về quản lý, cập nhật, kết nối, chia sẻ, khai thác và sử dụng cơ sở dữ liệu ngành Nội vụ (on the management, updating, connection, sharing, exploitation and use of the Home Affairs sector database)
Issued by: Ministry of Home Affairs, signed for the Minister by Deputy Minister Trương Hải Long, on 20 August 2026, on the proposal of the ministry’s IT Centre (Trung tâm Công nghệ thông tin)
Effective: 16 October 2026
Repeals: Thông tư 14/2024/TT-BNV of 31 December 2024, the previous rules on updating, using and managing the sector database. Databases, accounts and infrastructure built under the 2024 circular keep running, so the switch-over should cause no outage (Article 18).

The legal bases listed in the preamble show where the circular fits. They are the implementing decrees of the Luật Dữ liệu (Nghị định 165/2025/NĐ-CP), the Luật Giao dịch điện tử (Nghị định 194/2025/NĐ-CP), the Luật Bảo vệ dữ liệu cá nhân (Nghị định 356/2025/NĐ-CP), Nghị định 278/2025/NĐ-CP on mandatory data sharing between bodies in the political system, the National Data Architecture Framework (Quyết định 2439/QĐ-TTg), and the National Data Strategy to 2030 (Quyết định 1308/QĐ-TTg of 18 July 2026). In short, it takes the national data laws of 2025 and applies them to one ministry’s data.

The circular does not apply to databases containing state secrets or to databases restricted from electronic transactions (Article 1).

What changes

Access control gets specific

Article 8 contains the most concrete security requirements in the text:

The management system must use multi-factor authentication at login.
Accounts with administrator rights must be tightly controlled.
The system must automatically raise an alert or lock the account when it detects data queries or downloads “vượt mức bình thường”, i.e. well above normal volume.
Accounts must be revoked or locked immediately when an agency is dissolved or loses the relevant function, or when an individual breaks the law, is disciplined in connection with the database, retires, resigns, is transferred or is rotated to another unit. Accounts must be reviewed periodically, and the history of permission grants kept for as long as system logs are kept.

The automatic bulk-download alarm targets a real risk. Leaks of personal data from government systems often come from a valid account being used to pull far more records than the person’s job needs, not from outside hackers.

Records are signed, backed up and traceable

Every update must be traceable: who changed what, and when (Article 7(6)). Data that is wrong, incomplete, duplicated or entered without authority is frozen from use until it is checked and corrected or cancelled, and every step goes into the system log (Article 7(7)).
New data must be approved as soon as it is entered, by the authorised person, using a chữ ký số chuyên dùng công vụ (the government’s own digital signature) or an electronic authentication method (Article 9(1)). Data synced from an already-confirmed source of truth does not need re-approval.
Data is stored centrally in the ministry’s data centre or the National Data Centre, with periodic backups kept for at least 12 months (Article 9(3)).
Data quality is assessed periodically on five criteria: completeness, accuracy, consistency, timeliness and reusability. Data that no longer has legal value must be destroyed so that it is completely erased and cannot be recovered (Article 10).

Data must move through the national pipes, in real time where possible

Article 11 sets out the data-sharing routes. Inside the sector, data moves through the ministry’s own integration and coordination platform (LGSP/LDOP). Outside the sector, it goes through the National Data Integration and Sharing Platform (NDXP) and the National Data Centre’s coordination platform (NDOP). Sharing can use APIs, direct connections or periodic syncs. Real-time automated sharing is preferred for organisational structure, staffing quotas and personnel data, because those change often. For master data (dữ liệu chủ) owned by the ministry, every change must be synced in real time into the national aggregate database through NDOP, as part of the business or administrative-procedure workflow itself.

For developers there is a practical point in Article 11(3). The managing body must publish complete technical connection guides and a standardised set of system error codes. Anyone who has integrated with a Vietnamese government API will see why that matters.

Monitoring and incident response are written down

Article 12 requires sharing activity to be monitored centrally and continuously, with traceability: logins, authentication, connection logs, timing and issues raised. Connection and sharing logs must be kept for at least 12 months and stored so that they cannot be altered. Article 14 sets out a five-step incident procedure: suspend or restrict the affected systems or accounts, isolate the affected component, investigate and preserve logs, restore from backup, and apply any other legal measures. Serious incidents, including suspected leaks or unauthorised access, must be reported to the ministry. After recovery, data integrity must be checked before normal operation resumes.

Open data is part of the remit

Article 13(4) says the ministry’s open data is published on the National Open Data Portal to support the digital economy and digital society. Article 13(3) says sector data should be reused to cut documents out of administrative procedures, so people should not be asked for papers the state already holds.

Who it affects

Ministry units, provincial Departments of Home Affairs and other bodies that update the databases. Under Article 7(8) they are legally responsible for the accuracy and timeliness of the data they enter, and they must now work within signed approvals and stricter account rules.
IT vendors that build or run these systems. Multi-factor login, anomaly-based lockout, tamper-proof logs, 12-month backup and log retention, NDXP/NDOP integration and published API documentation are now regulatory requirements, not optional features. Bids and contracts for Home Affairs systems will likely start listing them.
Civil servants and other people whose records are held. They benefit indirectly from tighter access controls and fewer repeated paper requests. Article 13(2)(b) also requires that personal and sensitive data be accessed only under strict permissions, with access history recorded.
Businesses and researchers that want the data. Article 13(2)(d) says anyone wanting data outside their granted permissions must file a request stating the purpose, scope, content and duration. Open data is available through the national portal.

Open questions

No numbers on “abnormal”. The circular requires automatic alerts on unusually large downloads but does not define a threshold. Each system operator will set its own, so protection will vary.
The database list sits elsewhere. Article 3 defines the sector database by reference to a “Danh mục cơ sở dữ liệu ngành Nội vụ”, but the circular does not include that list. It is not clear from the text which databases, including the labour and social-affairs systems inherited in 2025, fall under the new rules on day one.
No deadline for upgrades. Legacy systems built under the 2024 circular “continue to be maintained”, but there is no date by which they must reach the new MFA, logging and retention standards.
Response times are vague. Incidents must be reported “kịp thời” (promptly), with no hour-based deadline like those in the personal data protection rules.

Sources

This post is general information, not legal advice.