Vietnam's government has tabled a Law on Electronic Identification and Authentication before the National Assembly. According to IDTechWire's report of 26 October 2026, Public Security Minister Lương Tam Quang presented it at the second plenary session of the 16th National Assembly. The draft has eight chapters and 46 articles. It would put the VNeID system on a statutory footing, and it would also widen what counts as an identifiable entity well beyond people. That widening is the part lawmakers should examine most closely.
The case for a statute
The strongest argument for the bill is legal certainty. Electronic identification currently runs on Decree 69/2024/ND-CP, dated 25 June 2024. It names the Ministry of Public Security's administrative-order police department as the managing agency. A decree can be rewritten by the executive. A law passed by the legislature is harder to change and easier for courts, banks and foreign counterparts to rely on.
The system is also already large. VnEconomy reported that, as of the end of April 2026, about 92 million subscribers had been synchronised with the national population database. The same report cites about 235 million electronic-identification authentications. Infrastructure used at that scale arguably needs a clear legal basis, and the Ministry of Justice draft itself describes Decree 69 as a practical foundation for the law.
The draft also tackles real harms. It prohibits using fake biometric data or technology-generated images to impersonate an identity, and it targets anonymous SIMs and fake accounts. Deepfake-assisted account fraud is a genuine problem, and a narrow, clearly worded prohibition on forged identity credentials is the kind of targeted rule we would support.
Where scope outruns evidence
The draft goes well beyond fraud control. According to IDTechWire, it covers five groups of entities, including products, goods and physical assets, and databases, digital files and software. It names centralised, intermediary and independent authentication models. Biometric Update's August reporting describes plans for identification codes covering assets and transactions, with land parcels getting unique digital IDs in a Thanh Hoa pilot.
Identifying a land parcel or a software package is not inherently a civil-liberties problem. Registries for property and supply chains are old and useful. The concern is what happens when those identifiers are tied to a personal identity system run by the public security ministry. A transaction record linked to a person, an asset and a timestamp is a map of economic life. The material available to us does not say who may query that linkage, what warrants are needed, or how long records are kept.
The National Assembly's own Committee on National Defence, Security and External Affairs raised related points, per IDTechWire. It flagged personal data protection, whether identifying a wider range of entities is feasible, and the technical and financial resources required. Some members said the scope was too broad. The Ministry of Justice also noted that the draft does not clearly define which subjects need electronic identification. We would weigh these as substantive objections rather than drafting nits. A law that applies identity requirements to unspecified subjects hands discretion to whoever writes the implementing rules.
Anonymity is a speech question
Targeting anonymous SIMs and fake accounts is presented as an anti-fraud measure. It is also, necessarily, an anonymity measure. Requiring verified identity behind every account and SIM can reduce scams. It also removes the option of speaking without being identifiable to the state, which matters for whistleblowers, journalists' sources and ordinary dissent. Vietnam's authorities have already floated tying VNeID to livestream sellers' accounts, and the bill's design would make such linkages routine. Legislators should ask for evidence that mandatory identity binding cuts fraud more than narrower tools would, such as targeted know-your-customer duties for high-risk financial services.
Cross-border recognition is the promising piece
The bill provides a legal basis for recognising foreign electronic identities. This links to Decision 1830/QD-TTg, signed on 22 September 2026, which plans to connect VNeID with Singapore's Singpass and Laos' LAeID. Pilots are planned at Hanoi's Noi Bai and Ho Chi Minh City's Tan Son Nhat airports, with testing and integration due by 15 November 2026. Planned metrics include successful authentication rates, processing times and errors. The decision says authorities will assess information security, cybersecurity and personal data protection requirements.
Interoperability that lets travellers and businesses skip repeated paperwork is a clear gain for the open, growth-oriented digital economy. It works best when each side limits what is exchanged to what the transaction needs. The pilot's published metrics measure speed and error rates. They do not measure data minimisation. We would add that.
What the Assembly should require
Three changes would keep the benefits and reduce the risks:
- Define the covered entities. Name which categories must hold an identity, and which are voluntary, in the statute rather than in later decrees.
- Write data limits into the law. Specify purposes, access rules, retention periods and independent oversight for the identity database, especially where personal and asset records are linked.
- Phase the rollout. Pilot asset and software identification, publish evaluation results, and widen scope only if the feasibility concerns lawmakers raised are answered.
Vietnam has built a widely used identity system faster than most of its neighbours. Codifying it is sensible. Doing so with an open-ended scope and thin privacy detail would lock in the broadest version of the system before anyone has tested it.