Nghị định 69/2024/NĐ-CP quy định về định danh và xác thực điện tử

DECREE

ELECTRONIC AUTHENTICATION AND IDENTIFICATION 

Pursuant to the Law on Government Organization dated June 19, 2015; the Law on amendments to some Articles of Law on Government Organization and Law on Local Government Organization dated November 22, 2019;

Pursuant to the Law on Cyberinformation Security dated November 19, 2015;

Pursuant to the Cybersecurity Law dated June 12, 2018;

Pursuant to the Law on Electronic Transactions dated June 22, 2023;

Pursuant to the Law on Identification dated November 27, 2023;

Pursuant to the Law on Investment dated June 17, 2020 amended by the Law No. 72/2020/QH14, the Law No. 03/2022/QH15, the Law No. 05/2022/QH15, the Law No. 08/2022/QH15, the Law No. 09/2022/QH15, the Law No. 20/2023/QH15l; the Law No. 26/2023/QH15;

At the request of the Minister of Public Security;

The Government promulgates Decree on electronic identification and authentication.

Chapter I 

GENERAL PROVISIONS

Article 1. Scope 

This Decree elaborates electronic identities; issuance, management and use of e-identification accounts; update and storage of information in the electronic identification and authentication system; conditions and procedures for connection with the electronic identification and authentication system; electronic authentication services; procedures for issuing, locking and unlocking e-identification and responsibilities of relevant agencies, organizations and individuals for electronic identification and authentication and e-identification.

Article 2. Regulated entities

This Decree applies to Vietnamese agencies, organizations and citizens; foreign organizations and individuals operating and/or residing within the territory of the Socialist Republic of Vietnam that directly participate in or are associated with electronic identification and authentication.

Article 3. Definition of terms

In this Decree, the terms below are construed as follows:

1. “Electronic identity” (hereinafter referred to as “eID”) refers to information about an agency or an organization or an individual existing in an electronic identification and authentication system that makes it possible to uniquely identify that individual or agency or organization in cyberspace.

2. “Electronic identity holder (hereinafter referred to as “eID holder”) refers to an agency, an organization or an individual that is identified as the one to whom an eID is attached.

3. “Electronic identification” refers to an act of registering, verifying, creating and binding an eID to an eID holder (hereinafter referred to as “e-identification”).

4. “Electronic identification and authentication regulator” refers to Police Department for Administrative Management of Social Order affiliated to the Ministry of Public Security.

5. “eID account" refers to a collection of username, password or other authentication methods, is created by the electronic identification and authentication regulator, and is used to access features, services and applications of an electronic identification and authentication system and an information system connected and shared according to regulations of law.

6. “Electronic authentication” refers to an act of authenticating, confirming, asserting, certifying or providing eIDs, eID accounts or other information existing in the national population database, the identification database, the entry/exit database via an electronic identification and authentication system, an electronic identification and authentication platform.

7. “Authentication factor” refers to a means of authentication used to confirm or assert an eID holder in an exact manner before access to or extraction of information from an electronic identification and authentication system.

8. “Means of authentication” refer to some methods allowing users to use them for e-authentication, including: password; secret key; barcode; terminal; one-time password device or software; cryptographic device or software; ID card; citizen ID card; passport; portrait photo; fingerprint; voice; irides or other tools and methods used for electronic authentication purposes.

9. “Electronic authentication service provider” refers to a public service provider or an enterprise of People's Public Security forces satisfying requirements for trade in and provision of electronic authentication services set out herein.

10. “E-identification webpage” refers to an utility created and developed by the Ministry of Public Security from the electronic identification and authentication system to enable access to e-identification and e-authentication services during the process of handling of administrative procedures, public administrative services and other transactions in cyberspace; help promote features, services and applications necessary for agencies, organizations and individuals.

11. “Electronic identification and authentication platform” refers to an information system which serves information exchange between the electronic identification and authentication system and information systems of state agencies, political organizations, socio-political organizations, electronic authentication service provider, and other organizations and individuals.

Article 4. Electronic identification and authentication principles

1. Abide by the Constitution and law; protect legitimate rights and interests of agencies, organizations and individuals.

2. Ensure accuracy, openness and transparency in management and convenience for agencies, organizations and individuals.

3. Secure devices and protect data security and privacy when carrying out electronic identification and authentication.

4. Agencies, organizations and individuals granted access to eIDs must secure eID accounts and comply with regulations of the law on protection of personal data.

5. Once being detected, any violation against law on electronic identification and authentication shall be promptly sanctioned under law.

6. Ensure conformity with international treaties to which Vietnam is a signatory.

7. Be prohibited from using eID accounts to perform illegal activities or transactions; infringe upon national security, defense, national interest, public interest, legitimate rights and interests of organizations and individuals.

8. Any unauthorized interference in the electronic identification and authentication system shall be prohibited.

Chapter II

ELECTRONIC IDENTITY, E-IDENTIFICATION, E-IDENTIFICATION ACCOUNT, E- AUTHENTICATION

Article 5. Foreigner’s eID

1. Foreigner’s eID contains the followings:

a) ID number;

b) Last, middle and first name

c) Date (day, month, year) of birth;

d) Gender;

dd) Nationality;

e) Number, sign, date (day, month, year), and place of issue of passport or other international travel document;

g) Portrait photo;

h) Fingerprint;

2. Foreigner’s ID number refers to a unique numerical string generated by the electronic identification and authentication system to manage an eID of a foreign individual.

Article 6. E-identity of an agency or organization 

1. E-identity of an agency or organization is composed of:

a) Its ID number;

b) Its name, including Vietnamese name, abbreviated name (if any) and international name (if any);

c) Date of establishment (day, month, year);

d) Head office address;

dd) Tax identification number (if any);

e) Enterprise identification number (if any);

g) Its eID code (if any);

h) Last, middle and first name, personal ID number (or ID number of the foreigner) of the legal representative or the head of the agency or organization following procedures for issuance of an eID account to the agency or organization.

2. ID number of an agency or organization refers to a unique numerical string generated by the electronic identification and authentication system to manage an eID of the agency or organization.

Article 7. Classification of eID accounts and individuals and organizations eligible to be granted eID accounts

Each Vietnamese agency, organization or individual and each foreign organization or individual operating or residing within the territory of the Socialist Republic of Vietnam is granted an eID account. To be specific:

1. A Vietnamese citizen who is 14 years of age or older and has been issued with a citizen ID card or an ID card that is still valid is eligible to be granted a level -1 eID account, level -2 eID account.

A Vietnamese citizen who is from 6 years of age to under 14 years of age and has been issued with an ID card is eligible to be granted a level -1 eID account, level -2 eID account where necessary. A Vietnamese citizen who is under 6 years of age and has been issued with an ID card is eligible to be granted a level -1 identification account when necessary.

2. A foreigner who is 6 years of age or older and has been issued with a permanent/temporary resident card in Vietnam is eligible to be granted a level -1 eID account, level -2 eID account where necessary. A foreigner who is under 6 years of age and has been issued with a permanent/temporary resident card in Vietnam is eligible to be granted a level -1 eID account where necessary.

3. Any agency or organization that is established or successfully registers their operation in Vietnam is eligible to be granted an eID account regardless of level of authentication.

Article 8. Updating information to electronic identification and authentication system 

1. If pieces of information related to eIDs of individuals available in the national population database, the electronic civil registration database, the ID database, the national entry/exit database or other national or specialized databases or those integrated into eID accounts are changed, the electronic identification and authentication system shall be updated automatically.

2. Pieces of information related to eIDs of agencies or organizations available in the national business registration database, other national or specialized databases shall be updated automatically to the electronic identification and authentication system in order to formulate their ID numbers and eID accounts which serve electronic identification and authentication.

Article 9. Using eID accounts or other e-transaction accounts created by agencies, organizations and individuals

1. Level-1 eID account of a Vietnamese citizen or foreigner is used to access, extract and use information on eID and some features, services and applications of the electronic identification and authentication system, the information system connected and shared according to regulations of law.

2. Level-2 eID account of a Vietnamese citizen is used to access and use e-identification or information other than that integrated into the e-identification shared, integrated and updated from national or specialized databases and all features, services and applications of the electronic identification and authentication system, the information system connected and shared according to regulations of law.

3. Level-2 eID account of a foreigner or eID account of an agency or organization is used to access, extract and use eID information and other information shared, integrated and updated from national or specialized databases and all features, services and applications of the electronic identification and authentication system, the information system connected and shared according to regulations of law.

4. EID holders shall be entitled to log in their eID accounts to access, conduct authentication and use features and services on the national identification application, dinhdanhdientu.gov.vn or vneid.gov.vn or other services on applications and software of other agencies, organizations and individuals that have been connected to the electronic identification and authentication system.

5. Access to eID accounts can be granted to carry out administrative procedures or public administration services in cyberspace and other activities to meet the demands of eID holders.

6. Information on eIDs and that integrated into e-identification and eID accounts have the same confirmatory value as those provided or included in physical documents used and presented upon carrying out administrative procedures, public services, and other transactions and activities.

7. Agencies, organizations and individuals shall be entitled to create e-transaction accounts for use in their activities according to regulations of the law on e-transactions; must ensure authenticity and accuracy of the accounts that they create on their own; can decide the level and value of each of these accounts. Information required for creation of e-transaction accounts shall be provided by account holders and used by agencies, organizations or individuals for its original purposes with authorization from account holders.

Article 10. Procedures for issuing eID accounts to Vietnamese citizens 

1. Issuance of a level-1 eID account

a) Each Vietnamese citizen uses a digital device to download and install the national identification application;

b) The citizen uses the national identification application to enter his/her personal ID number, lawfully registered mobile subscriber identification number (MSIN) or email address (if any); provides information according to instructions available on the national identification application; takes a portrait photo by the digital device and sends the request for issuance of an eID account to the electronic identification and authentication regulator;

c) The electronic identification and authentication regulator inspects and authenticates information provided by the citizen and sends a notification of whether the registration request is accepted or refused via the national identification application, MSIN or email;

d) The representative or the guardian uses their lawfully registered mobile subscriber identification number and level-2 eID account to make declaration and apply for issuance of the level-1 eID account to the person who is under 14 years of age, the ward or the represented person via the national identification application.

2. Issuance of a level-2 eID account

a) The citizen contacts the police authority of the commune, ward or town or the identification-managing agency regardless of their place of residence to present their citizen ID card or ID card that is still valid and follow procedures for issuance of a level-2 eID account.

b) The citizen writes full and accurate information in a written request for issuance of eID account according to Form No. TK01 enclosed with this Decree, including their lawfully registered mobile subscriber identification number (MSIN) or email address (if any) and other information proposed to be integrated into the e-identification (if required) and sends the written request to the recipient;

c) The recipient enters information provided by the citizen into the electronic identification and authentication system for authentication; takes the citizen’s portrait photo and fingerprint to have them checked against those available in the identification database;

d) The electronic identification and authentication regulator inspects and authenticates information provided by the citizen and sends a notification of whether the registration request is accepted or refused via the national identification application, MSIN or email;

dd) The person who is under 14 years of age, the ward or the represented person and their representative or the guardian contact the police authority of the commune, ward or town or the place where procedures for issuing ID cards are followed in order to follow procedures for issuance the level-2 eID account;

The representative or the guardian uses their lawfully registered mobile subscriber identification number to make declaration and apply for issuance of the level-2 eID account to the person who is under 14 years of age, the ward or the represented person.

3. If the citizen has not yet been issued with a citizen ID card or ID card, he/she shall apply for issuance of the eID account and the ID card at the same time according to procedures specified in Clause 1, Clause 2 of this Article.

Article 11. Procedures for issuing eID accounts to foreigners 

1. Issuance of a level-1 eID account

a) Each foreigner uses a digital device to download and install the national identification application;

b) The citizen uses the national identification application to enter information about the number of his/her passport or international travel document or email address or registered mobile subscriber identification number (MSIN) (if any); provides information according to instructions available on the national identification application; takes a portrait photo by the digital device and sends the request for issuance of an eID account to the electronic identification and authentication regulator via the national identification application;

c) The electronic identification and authentication regulator sends a notification of whether the registration request is accepted or refused via the national identification application, MSIN or email;

d) The representative or the guardian uses their lawfully registered mobile subscriber identification number and level-2 eID account to make declaration and apply for issuance of the level-1 eID account to the foreigner who is under 14 years of age, the ward or the represented person via the national identification application.”

2. Issuance of a level-2 eID account

a) The foreigner contacts the immigration department of the Ministry of Public Security or the provincial police authority to present his/her passport or international travel document and follow procedures for issuing a level-2 eID account;

b) The foreigner writes full and accurate information in a written request for issuance of the eID account according to Form No. TK01 enclosed with this Decree, including their lawfully registered mobile subscriber identification number (MSIN) or email address (if any) and other information proposed to be integrated into the national identification application and sends the written request to the recipient;

c) The recipient enters information provided by the foreigner into the electronic identification and authentication system; takes the foreigner’s portrait photo and fingerprint to have them checked against those available in the national entry/exit database;

d) The immigration department sends the request for issuance of the eID account to the electronic identification and authentication regulator;

dd) The electronic identification and authentication regulator sends a notification of whether the registration request is accepted or refused via the national identification application, MSIN or email;

e) The foreigner who is under 14 years of age, the ward or the represented person and their representative or the guardian contact the immigration department of the Ministry of Public Security or the provincial police authority in order to follow procedures for issuance the level-2 eID account;

The representative or the guardian uses their lawfully registered mobile subscriber identification number to make declaration and apply for issuance of the level-2 eID account to the foreigner who is under 14 years of age, the ward or the represented person.

Article 12. Procedures for issuing eID accounts to agencies or organizations 

1. The legal representative, head of an agency or organization, or the legally represented person, the person authorized by the head (the authorized person) uses their level-2 eID account to log in for the national identification application, provides information according to instructions and sends an eID account registration request after obtaining approval from other legal representatives of the organization (if any).

In case the eID account registration request is submitted in a direct manner, the legal representative, head of an agency or organization or the authorized person shall make declarations on a written request for issuance of the eID account to the agency or organization according to From No. TK02 enclosed with this Decree, and submit an application at the electronic identification and authentication regulator or the identification-managing agency that is convenient.

2. The electronic identification and authentication regulator inspects and authenticates information on the agency or organization available in the national business registration database, the national database and other specialized databases.

If information about the agency or organization is not available in the national business registration database, the national database and other specialized database yet, it must verify information of the agency or organization.

3. The electronic identification and authentication regulator sends a notification of whether the request for registration of eID account issued to the legal representative or the head of agency or organization is accepted or refused via the national identification application, MSIN or email.

If it is not eligible to issue the eID account, the electronic identification and authentication regulator shall send notification in writing, via SMS or the eID account of the registrar.

Article 13. Duration of processing of registration requests for eID accounts

Upon receipt of all valid applications prescribed herein, the electronic identification and authentication regulator shall process the registration request for an eID account within the following duration:

1. For any Vietnamese citizen who is holding a citizen ID card or ID card that is still valid:

a) The maximum duration of completion of processing of the registration request for a level-1 eID account shall be 01 working day;

b) The maximum duration of completion of processing of the registration request for a level-2 eID account shall be 03 working days;

2. For any Vietnamese citizen who does not hold an ID card or holds an expired citizen ID card, the maximum duration of completion of processing of the registration request for an eID account shall be 07 working days.

3. For a foreigner:

a) The maximum duration of completion of processing of the registration request for a level-1 eID account shall be 01 working day;

b) The maximum duration of completion of processing of the registration request for a level-2 eID account shall be 03 working days if the foreigner’s portrait photo and fingerprint is available in the national entry/exit database;

c) The maximum duration of completion of processing of the registration request for a level-2 eID account shall be 07 working days if the foreigner’s portrait photo and fingerprint is not available in the national entry/exit database;

4. For an organization:

a) The maximum duration of completion of processing of the registration request for an eID account shall be 03 working days if verifiable information about the organization already exists in the national database or specialized databases;

b) The maximum duration of completion of processing of the registration request for an eID account shall be 15 working days if verifiable information about the organization is not available in the national database or specialized databases;

Article 14. Activation and use of eID accounts

1. EID holders can activate eID accounts of individuals, agencies and organizations on the national identification application within 07 days from the date of receipt of notifications of approval for eID account registration requests. Within 07 days after receipt of the notification, if any eID account is not activated, the eID holder must contact the electronic identification and authentication regulator via the receiver switchboard and address issues related to electronic identification and authentication requirements to activate the eID account pending activation.

2. The person who is under 14 years of age or the ward or the represented person shall obtain confirmation and approval from the representative or the guardian for use of their eID account via the national identification application. The representative or the guardian may use the eID account of the person who is under 14 years of age, the ward or the represented person to carry out transactions and other activities which serve their rights and interests.

3. Each eID account and electronic authentication service have legal value to confirm and prove that the eID holder has conducted and approved transactions.

4. The electronic identification and authentication regulator shall connect, share and authenticate data in order for eID holders to use their eID accounts in other countries according to international treaties to which Vietnam is a signatory.

Article 15. Procedures for locking and unlocking eID accounts

1. Locking and unlocking a Vietnamese citizen's eID account.

The electronic identification and authentication system automatically locks or unlocks the citizen's eID account when their e-identification is locked or unlocked or their citizen ID card or ID card is expired.

2. Locking an eID account of a foreigner or an organization.

a) The electronic identification and authentication system automatically remembers, inspects, authenticates and locks an eID account if the foreigner makes the request for locking his/her eID account; the foreigner violates agreements on use of the national identification application; the foreigner's passport or international travel document is expired; the foreigner’s residence permit expires; the foreigner dies. The system can remember through the foreigner’s declaration made on the national identification application or input of updated information according to regulations in Article 8 of this Decree;

b) The electronic identification and authentication system automatically remembers, inspects, authenticates and locks an eID account if the organization makes the request for locking its eID account or the organization violates agreements on use of the national identification application or the organization is dissolved, goes bankrupt, has its operations suspended or terminated according to regulations of law. The system can remember through the organization’s declaration made on the national identification application or input of updated information according to regulations in Article 8 of this Decree;

c) A procedure-conducting agency or another competent authority shall send a written request for locking or unlocking the eID account or e-identification according to Form No. TK03 enclosed with this Decree to the police authority of the commune, ward or town or the nearest identification-managing agency of the police authority of the province or district for receipt and processing;

d) Within 01 working day from the date of receipt of the written request, the police authority of the commune, ward or town or the identification-managing agency of the police authority of the province or district where the written request is received shall consider transferring the request for locking the eID account to the head of the identification-managing agency of the Ministry of Public Security for consideration and approval via the electronic identification and authentication system;

dd) Within 02 working days from the date of receipt of the request from the police authority of the commune, ward or town or the identification-managing agency of the police authority of the province or district, the head of the identification-managing agency of the Ministry of Public Security shall consider approving the locking request in the case specified in Clause 2 of this Article and notify this to the agency making the eID account locking request and the holder of the locked account. In case of rejection, a written reply with clear reasons for such rejection shall be sent.

3. Unlocking an eID account.

a) The electronic identification and authentication system automatically unlocks the eID account when grounds for automatically locking that eID account no longer exist;

b) The procedure-conducting agency or another competent authority shall send a written request for locking or unlocking the eID account or e-identification to the police authority of the commune, ward or town or the nearest identification-managing agency of the police authority of the province or district for receipt and processing;

c) Within 01 working day from the date of receipt of the written request, the police authority of the commune, ward or town or the identification-managing agency of the police authority of the province or district where the written request is received shall consider transferring the request for unlocking the eID account to the head of the identification-managing agency of the Ministry of Public Security for consideration and approval via the electronic identification and authentication system;

d) Within 02 working days from the date of receipt of the proposal from the police authority of the commune, ward or town or the identification-managing agency of the police authority of the province or district, the head of the identification-managing agency of the Ministry of Public Security shall consider approving the unlocking request in the case specified in Clause 2 of this Article and notify this to the agency making the eID account unlocking request and the holder of the unlocked account. In case of rejection, a written reply with clear reasons for such rejection shall be sent.

Article 16. Authority to issue, lock and unlock eID accounts of Vietnamese citizens, foreigners, agencies and organizations 

Director of the Police Department on Administrative Management of Social Order under the Ministry of Public Security has authority to issue, lock and unlock eID accounts of Vietnamese citizens, foreigners, agencies and organizations.

Article 17. Storage of information in the electronic identification and authentication system 

1. All information on eIDs and other information integrated into eID accounts shall be stored permanently in the electronic identification and authentication system.

2. All information on history of access to eID accounts shall be stored in the electronic identification and authentication system for at least 05 years after account access. Account holders are entitled to extract information about history of access to their eID accounts; the electronic identification and authentication regulator is entitled to extract information history of access to eID accounts to serve state management; in other cases, regulations of law shall be applied.

Article 18. Conditions and procedures for connection to the electronic identification and authentication system 

1. A state agency, political organization, socio-political organization or public service provider that has an information system under its management connected to the electronic identification and authentication system shall ensure that the information system meets level-3 or higher-level safety requirements applicable to information systems according to regulations of law on security of information system by classification.

2. According to regulations in Clause 1 of this Article, the information shall be connected and shared on the basis of a written agreement between the electronic identification and authentication regulator and the governing body of database and information system to be connected. The written agreement shall specify scope and purposes of connection.

3. Within 30 days from the date on which the written agreement specified in Clause 3 of this Article is concluded, the electronic identification and authentication regulator shall carry out on-site inspection and assessment of the database and information system of the agency or organization requesting connection; if the database and information system have been connected to the national population database, the time limit for consideration and approval of the connection shall not exceed 07 working days.

 In case of approval for the connection, the electronic identification and authentication regulator shall notify in writing for the agency or organization and make connection under the written agreement. In case of rejection, a written reply with clear reasons for such rejection shall be sent.

4. An agency or organization not regulated in Clause 1 of this Article shall make connection to the electronic identification and authentication system through an electronic authentication service provider.

5. The electronic authentication service provider that is allowed to make connection to the electronic identification and authentication system for provision of electronic authentication services is not required to follow procedures specified in this Article.

Article 19. Electronic authentication 

1. EIDs and eID accounts shall be electronically authenticated via the electronic identification and authentication system and the electronic identification and authentication platform according to regulations of this Decree.

2. State agencies, political organizations, socio-political organizations and public service providers are entitled to request electronic authentication by connecting and sharing information with the electronic identification and authentication system or the national database, specialized databases containing the information to be electronically authenticated.

3. Agencies and organizations other than those specified in Clause 2 of this Article are entitled to request electronic authentication through services provided by electronic authentication service providers; the electronic authentication of eIDs and eID accounts at the request of agencies and organizations specified in this Clause must be subject to approval from eID holders by certification made in the national identification application, SMS via MSIN or other certification forms according to regulations.

4. Organizations and individuals must not provide and share electronic authentication results with other organizations and individuals, unless otherwise provided by the law on protection of personal data; electronic authentication results are not valid as authentication factors in other transactions.

Article 20. Levels of eID account authentication 

1. The electronic identification and authentication system provides levels of eID account authentication as follows:

a) Level 1: Authenticate an eID account by a single factor of authentication defined in Clause 7 of Article 3, and by a corresponding means of authentication defined in Clause 8 of Article 3 herein, except for biometric data.

b) Level 2: Authenticate an eID account by two different factors of authentication defined in Clause 7 of Article 3, and by a corresponding means of authentication defined in Clause 8 of Article 3 herein, except for biometric data.

c) Level 3: Authenticate an eID account by two or more different factors of authentication defined in Clause 7 of Article 3, and by a corresponding means of authentication defined in Clause 8 of Article 3 herein, including a biometric datum.

d) Level 4: Authenticate an eID account by different factors of authentication, including at least a biometric datum (portrait photo, fingerprint, voice or irides), at least a factor owned by an eID holder (ID card, digital device, software) and a factor that the eID holder knows (password; secret key; two-dimensional barcode).

2. Other electronic transaction accounts created by agencies, organizations and individuals shall be referred according to regulations in Clause 1 of this Article for classification and identification in corresponding to each professional operation and procedure of such agencies, organizations and individuals or according to regulations of specialized laws and guidelines provided by competent state management agencies in each sector.

Article 21. E-authentication methods for use in transactions conducted via the electronic identification and authentication system

1. With respect to online transactions, the e-authentication process shall be carried out through means of authentication whose levels of authentication are required by providers of these online transactions.

2. Authentication of account information administered at the places where services are rendered shall be carried out by employing authentication solutions available in the national identification application.

Chapter III

E-AUTHENTICATION SERVICES

Article 22. E-authentication services 

1. The e-authentication service is classified as a conditional business line.

2. E-authentication service providers shall meet the conditions set out in Article 23 herein and must seek to obtain the certificate of conformance to e-authentication service business regulations.

3. E-authentication service providers shall be responsible for listing their e-authentication services and products in the e-identification webpage.

Article 23. Conditions for eligibility to provide e-authentication services

1. Organization and enterprise conditions

In order to be eligible to provide e-authentication services, e-authentication service providers must be public service providers; enterprises under the control of People’s Public Security forces.

2. Personnel conditions

a) As an e-authentication service provider, the head of an organization or the legal representative of an enterprise must be a Vietnamese citizen permanently residing in Vietnam;

b) As an e-authentication service provider, the organization or enterprise must employ personnel holding at least undergraduate degrees in information security or information technology or telecommunication electronics majors to be in charge of providing services; running and administering their system; maintaining security for the entire system.

3. Conditions related to facilities, technical equipment and processes for management of provision of services and security or emergency response plans

In order to apply for a certificate of eligibility to provide e-authentication services, the organization or enterprise must have a service scheme, including action plan and process for provision of e-authentication services, including explanations about the information technology system; interpretation of the technical plan in the technological solution aspect; plan for storage, assurance of data integrity, security and safety of the service-providing system; plan for protection of data of individual and organization; security plan; plan for fire safety, response to emergencies, maintenance of stable and smooth working condition of e-authentication services; technical equipment shall be located in Vietnam and inspected for information safety and security according to regulations of law.

4. The e-authentication service provider is entitled to authorize another organization to provide some services, including provision of advice, introduction and response to problems about e-authentication services; find partners, negotiate and agree on contents related to operations and utilities of provision of authentication services; provide support and care for service users and do other trade promotion activities according to regulations of law. The authorization shall comply with regulations of law;

Article 24. Applications and procedures for application for certificates of conformance to e-authentication service business regulations

1. An application includes:

a) Application form for a certificate of conformance to e-authentication service business regulations according to Form No. XT01 in the Appendix enclosed with this Decree;

b) Full texts of the service scheme and documents proving satisfaction of conditions specified in Clause 2, Clause 3 Article 23 of this Decree.

2. Time limit and procedures for processing:

a) The applicant submits 01 application specified in Clause 1 of this Article in person; by post to the Ministry of Public Security; online through the national public service portal or the public service portal of the Ministry of Public Security;

b) If the application is inadequate or invalid, within 03 working days from the date of receipt of the application, the Ministry of Public Security shall send a written notification of any necessary modification to the applicant;

c) Within 03 working days from the date on which the valid application is received, the Ministry of Public Security shall proceed to conduct a survey on opinions of relevant ministries or quasi-ministries;

d) Within 10 working days from the date of receipt of the written request for opinions from the Ministry of Public Security, these ministries or quasi-ministries must conduct inspection and appraisal and send their responses;

dd) Within 30 days of receipt of all required valid documents, the Ministry of Public Security shall conduct the site inspection at the applicant’s office and issue the applicant with the certificate of conformance to e-authentication service business regulations by completing Form XT03 given in Appendix hereto to the accredited applicant; in case of rejection, a written notification, clearly stating reasons for such rejection, must be sent.

Article 25. Reissuance of or revision to certificates of conformance to e-authentication service business regulations

1. Revision to the certificate of conformance to e-authentication service business regulations can be permitted if there is any change in one of the particulars of legal representative, office address, transaction name, plan and process approved by the Ministry of Public Security in accordance with Clause 3 of Article 27 herein.

2. In order to do so, the applicant must submit an application for revision to the certificate of conformance to e-authentication service business regulations to the Ministry of Public Security in accordance with point a of Clause 2 of Article 24 herein. The application includes:

a) Application form for replacement of, revision to the certificate of conformance to e-authentication service business regulations according to Form No. XT02 in the Appendix enclosed with this Decree;

b) Legal documents proving information changes according to regulations in Clause 1 of this Article.

3. If the applicant wishes to change one of the data about their legal representative, office address or transaction name, within 10 days from the date of receipt of the valid application, the Ministry of Public Security shall carry out appraisal; issue the certificate of conformance to e-authentication service business regulations to the accredited applicant; in case of rejection, a written notification, clearly stating reasons for such rejection, must be sent.

4. If the applicant wishes to change one of the data about the plan and process for provision of e-authentication service specified in Clause 3 Article 23 of this Decree, within 30 days of receipt of the valid application, the Ministry of Public Security shall conduct the review and the survey on opinions from relevant ministries or quasi-ministries; carry out the site inspection and issue the certificate of conformance to e-authentication service business regulations to the accredited applicant; in case of rejection, a written notification, clearly stating reasons for such rejection, must be sent.

5. Another certificate of conformance to e-authentication service business regulations shall be re-issued if the previous one is lost or damaged. Procedures for reissuing the certificate of conformance to e-authentication service business regulations shall be followed as follows:

a) In order to do so, the applicant must submit an application for reissuance of the certificate of conformance to e-authentication service business regulations to the Ministry of Public Security in accordance with point a of Clause 2 of Article 24 herein. The application for reissuance of the certificate is composed of: application form for replacement of, revision to the certificate of conformance to e-authentication service business regulations; full texts of the service scheme and documents proving satisfaction of conditions specified in Clause 2, Clause 3 Article 23 of this Decree;

b) Within 03 working days of receipt of the valid application, the Ministry of Public Security shall consider reissuing another certificate of conformance to e-authentication service business regulations to the applicant; in case of rejection, a written notification, clearly stating reasons for such rejection, must be sent.

Article 26. Revocation of certificates of conformance to e-authentication service business regulations

1. E-authentication service provider's certificate of conformance to e-authentication service business regulations is revoked in the following cases:

a) It has not operated for at least six consecutive months;

b) It is dissolved or bankrupt as per law;

c) It fails to remedy violations against regulations on protection of personal data, cybersecurity at the request of the competent state agency.

2. The Ministry of Public Security may issue its decision on revocation of certificates of conformance to e-authentication service business regulations by completing the application form XT04 given in Appendix hereto.

3. The e-authentication service provider that has its certificate of conformance to e-authentication service business regulations revoked shall have the burden of protection of legitimate rights and interests of the eID holder and relevant parties in accordance with law.

Article 27. Costs and expenses incurred from issuance and use of eID accounts and use of e-authentication services 

1. Any eID holder that is a Vietnamese agency, organization, citizen or a foreigner shall be exempted from paying costs and expenses incurred from registering and using eID accounts created by the electronic identification and authentication system and using their eID accounts for electronic transactions.

2. Any organization or individual using e-authentication services shall pay costs and expenses to e-authentication service providers in accordance with law on prices.

3. State agencies, political organizations and socio-political organizations are not required to pay costs and expenses when using e-authentication services.

Chapter IV

E-IDENTIFICATION 

Article 28. Issuance of e-identification 

1. E-identification is expressed in the form of a feature or utility of the national identification application through access to a citizen’s eID account.

2. The Vietnamese citizen’s e-identification and level-2 eID account shall be issued at the same time according to procedures specified in Article 10 of this Decree.

3. E-identification used by access to a citizen’s level-2 eID account shall have the same value as their citizen ID card or ID card that is still valid upon following administrative procedures, providing or using public services, or conducting other transactions and operations.

4. E-identification shall be stored permanently in the electronic identification and authentication system. History of access to e-identification shall be stored in the electronic identification and authentication system for 05 years after access.

5. The Minister of Public Security shall issue regulations on e-identification forms on the national identification application.

Article 29. Procedures for locking e-identification 

1. The electronic identification and authentication system automatically remembers, inspects, authenticates and locks e-identification in the cases specified in points b, c and d Clause 1 Article 34 of the Law on Identification. The electronic identification and authentication system can remember through input of information to the system according to regulations in Article 8 of this Decree.

2. A person issued with e-identification can make request for locking the e-identification in person at the police authority of the commune, ward or town or the nearest identification-managing agency of the police authority of the province or district or via the national identification application according to Form TK03 enclosed with this Decree. The identification-managing agency shall take record, inspect, authenticate and lock the e-identification after receiving the request on the electronic identification and authentication system.

3. A procedure-conducting agency or another competent authority shall send a written request for locking e-identification to the police authority of the commune, ward or town or the nearest identification-managing agency of the police authority of the province or district for receipt and processing.

4. Within 01 working day from the date of receipt of the written request from the procedure-conducting agency or the competent authority, the police authority of the commune, ward or town or the nearest identification-managing agency of the police authority of the province or district shall consider transferring the written request to the head of the identification-managing agency affiliated to the Ministry of Public Security for consideration and approval through the electronic identification and authentication system.

5. Within 02 working days from the date of receipt of the request from the police authority of the commune, ward or town or the identification-managing agency of the police authority of the province or district, the head of the identification-managing agency affiliated to the Ministry of Public Security shall consider approving the e-identification locking request in the case specified in Clause 2 of this Article and notify this to the agency making the e-identification locking request and the e-identification holder. In case of rejection, a written reply with clear reasons for such rejection shall be sent.

Article 30. Procedures for unlocking e-identification 

1. The electronic identification and authentication system automatically conducts review and inspection, and unlocks e-identification when grounds for automatically locking e-identification no longer exist.

2. A person who has their e-identification locked can make request for unlocking the e-identification in person at the police authority of the commune, ward or town or the nearest identification-managing agency of the police authority of the province or district or via the national identification application according to Form TK03 enclosed with this Decree. The identification-managing agency shall take record, inspect, authenticate and unlock the e-identification after receiving the request for unlocking e-identification on the electronic identification and authentication system.

3. A procedure-conducting agency or another competent authority shall send a written request for unlocking e-identification to the police authority of the commune, ward or town or the nearest identification-managing agency of the police authority of the province or district for receipt and processing.

4. Within 01 working day from the date of receipt of the written request from the procedure-conducting agency or the competent authority, the police authority of the commune, ward or town or the nearest identification-managing agency of the police authority of the province or district shall consider transferring the written request to the head of the identification-managing agency affiliated to the Ministry of Public Security for consideration and approval through the electronic identification and authentication system.

5. Within 02 working days from the date of receipt of the request from the police authority of the commune, ward or town or the identification-managing agency of the police authority of the province or district, the head of the identification-managing agency affiliated to the Ministry of Public Security shall consider approving the e-identification unlocking request in the case specified in Clause 2 of this Article and notify this to the agency making the e-identification unlocking request and the e-identification holder. In case of rejection, a written reply with clear reasons for such rejection shall be sent.

Chapter V

RESPONSIBILITIES OF AGENCIES, ORGANIZATIONS AND INDIVIDUALS

Article 31. Responsibilities of eID holders

1. Protect eID data.

2. Secure authentication factors.

3. Immediately report to electronic authentication service providers when losing control of authentication means or detecting illegal access to their electronic identity, or having any other reasons that may pose threats to their use of service.

Article 32. Responsibilities of e-authentication service users

1. Comply with technical regulations on e-authentication and identification.

2. Manage and secure eID account information; ensure that eID accounts are used in a safe manner.

3. Ensure accountability for transactions already performed and regulations of related parties on electronic transactions.

Article 33. Responsibilities of e-authentication service providers and agencies, organizations and individuals self-creating accounts

1. Responsibilities of e-authentication service providers

a) Render e-authentication services to organizations or individuals on the basis of service provision contracts;

b) Manage operations performed by organizations authorized to provide e-authentication services and products according to regulations in Clause 4 Article 23 of this Decree;

c) Ensure that information-receiving channels are up and access to services is continuous 24 hours in 7 days a week;

d) Comply with regulations of law on information safety, network security, cybersecurity, electronic transactions, technical standards and regulations in electronic authentication activities in order to secure information and ensure the accuracy of authentication; issue procedures for e-authentication and obtain permission from the electronic identification and authentication regulator;

dd) Adhere to the plan and process for provision of electronic authentication services that have been reviewed by the Ministry of Public Security;

e) Send six-monthly and annual performance reports on e-authentication services according to Form XT05 in the Appendix enclosed with this Decree to the electronic identification and authentication regulator, or as requested by the electronic identification and authentication regulator.

2. Responsibilities of agencies, organizations and individuals self-creating accounts for their operations:

a) Bear responsibility for accuracy of their self-created accounts;

b) Protect personal data that they collect or manage in accordance with law;

c) Ensure that access to data is granted by owners of these data for use in all activities related to management and use of these data;

d) Delete collected data and manage them at the request of data owners, unless otherwise provided for by law;

Article 34. Responsibilities of the Ministry of Public Security

1. Build, administer, protect and operate the electronic identification and authentication system, electronic identification and authentication platform, apply electronic identification accounts to state management, administrative reform, prevention and control of natural disasters and epidemics.

2. Carry out state management of electronic identification and authentication. Promulgate uniform regulations on principles and structure of ID numbers of foreigners and agencies and organizations.

3. Assume the prime responsibility for, and cooperate with ministries and quasi-ministries in, connecting national and specialized databases to facilitate electronic identification and authentication.

4. Take charge of, and cooperate with the Ministry of Information and Communications, the Ministry of Planning and Investment, the Ministry of National Defense, the Ministry of Justice, the Government Office and relevant ministries and quasi-ministries in, inspecting and examining electronic identification and authentication activities.

5. Connect and integrate the electronic identification and authentication system with the electronic identity exchange platform of the National Public Service Portal in order to serve inspection of accounts, settlement of administrative procedures and provision of online public services in accordance with law.

6. Take charge of, and cooperate with the Ministry of Information and Communications, the Ministry of National Defense, and the Government’s Cipher Committee in ensuring information safety and security for the electronic identification and authentication system.

7. Take charge of, and cooperate with ministries, quasi-ministries, government bodies, Government Cipher Committee, and People's Committees of provinces and central- affiliated cities in agreeing on the plan to connect, share and access data for use of electronic identities, eID accounts and e-identification; ensure data confidentiality and security in conformity with methods for following administrative procedures both online and offline.

8. Take charge of, and cooperate with ministries, quasi-ministries, government bodies, Government Cipher Committee, and People's Committees of provinces and central- affiliated cities in agreeing on the plan to connect, share and access data for use of electronic identities, eID accounts and e-identification provided and created by the electronic identification and authentication system; ensure data confidentiality and security in conformity with methods for following administrative procedures both online and offline.

9. Take charge of, and cooperate with the Ministry of Justice, the Ministry of Planning and Investment and the Ministry of National Defense in, ensuring that data and information available in the national population database, the national entry/exit database, and the electronic civil registration database and the national business registration database are connected, shared and updated to serve the electronic identification and authentication purposes.

10. Ensure that information-receiving channels are up and access to the electronic identification and authentication system is continuous 24 hours in 7 days a week.

Article 35. Responsibilities of the Ministry of Information and Communications

Cooperate with the Ministry of Public Security and the Ministry of National Defense to ensure data and information confidentiality and security for the electronic identification and authentication system.

Article 36. Responsibilities of the Ministry of Planning and Investment 

1. Take charge of, and cooperate with the Ministry of Public Security and relevant ministries and central authorities in agreeing on the plan to connect and share data on organizations and individuals available in the national business registration database with the electronic identification and authentication system for creation of ID numbers and eID accounts of agencies and organizations, thereby serving electronic identification and authentication purposes; ensure data confidentiality and security.

2. Cooperate with the Ministry of Public Security in issuing eID accounts to organizations and enterprises and managing such eID accounts within its assigned tasks, functions and scope.

3. Ensure that eIDs and eID accounts are used for carrying out administrative procedures or public administration services in cyberspace under their authority according to regulations of law.

Article 37. Responsibilities of the Ministry of National Defense

1. Instruct its directly-controlled agencies, units, enterprises and individuals to conduct electronic identification and authentication in accordance with regulations on protection of state secrets in national defense sector.

2. Cooperate with the Ministry of Public Security in agreeing on the plan for connection and sharing for use of electronic identities, eID accounts, e-identification provided and created by the electronic identification and authentication system.

3. Cooperate with the Ministry of Public Security in ensuring data and information security and cybersecurity for the electronic identification and authentication system.

Article 38. Responsibilities of the Government Cipher Committee

1. Provide guidance on application of technical standards and regulations on civil cryptography and use of civil service digital signature authentication service to electronic identification and authentication activities.

2. Take charge of, and cooperate with the Ministry of Public Security in, assessing cryptographic security for users of electronic authentication services.

3. Cooperate with the Ministry of Public Security in ensuring data and information confidentiality and security by using cryptographic products for the electronic identification and authentication system; using electronic identities, eID accounts, e-identification for provision of civil service digital signature services.

Article 39. Responsibilities of ministries, quasi-ministries, government bodies and People's Committees of central-affiliated cities and provinces

1. Ensure that eIDs, eID accounts and e-identification are used for carrying out administrative procedures or public administration services in cyberspace.

2. Cooperate with the Ministry of Public Security in agreeing on the plan for connection and sharing for use of electronic identities, eID accounts, e-identification provided and created by the electronic identification and authentication system; ensuring data and information confidentiality and security.

3. Ensure stable and smooth operation of national databases, specialized databases in authentication at the request of specialized database managing agencies, state agencies, political organizations, socio-political organizations and other organizations assigned to perform public services.

Chapter VI

IMPLEMENTATION PROVISIONS

Article 40. Effect

1. This Decree comes into effect from July 01, 2024.

2. The Government’s Decree No. 59/2022/ND-CP dated September 05, 2022 shall cease to have effect from the effective date of this Decree.

3. Accounts created and issued by the National Public Service Portal and Information Systems for handling administrative procedures at ministerial and provincial levels to individuals can be used until the end of June 30, 2024.

4. Accounts created and issued by the National Public Service Portal and Information Systems for handling administrative procedures at ministerial and provincial levels to agencies and organizations can be used until the end of June 30, 2025.

5. EID accounts and certificates of eligibility to provide e-authentication services issued according to regulations in the Government’s Decree No. 59/2022/ND-CP dated September 05, 2022 shall remain valid until the expiry dates according to regulations.

6. Regarding any citizen who has been issued with a level-2 eID account before the effective date of this Decree, the identification-managing agency affiliated to the Ministry of Public Security shall create and display the citizen’s e-identification via the national identification application from July 01, 2024.

7. Clause 1 of Article 7 in the Decree No. 45/2020/ND-CP dated April 8, 2020 on implementation of administrative procedures and public administration services in cyberspace shall be amended as follows:

“1. Organizations and individuals can carry out administrative procedures on the National Public Service Portal and Information Systems for handling administrative procedures at ministerial and provincial levels via eID accounts created by the electronic identification and authentication system that are connected and integrated on the National Public Service Portal and Information Systems for handling administrative procedures at ministerial and provincial levels”.

8. Point a Clause 1 of Article 21a in the Government’s Decree No. 107/2021/ND-CP dated December 06, 2021 on amendments to some Articles of the Government's Decree No. 61/2018/ND-CP dated April 23, 2018 on implementation of single-window system and interlinked single-window system for handling administrative procedures shall be amended as follows:

“a) Inspecting and authenticating an eID account of an individual or organization through personal identification number in case where the individual is a Vietnamese citizen or number of passport (or another international travel document) in case where the individual is a foreigner and code of the organization on Information Systems for handling administrative procedures at ministerial and provincial levels by connecting and sharing data with the electronic identification and authentication system. If the organization or individual has not yet been issued with the eID account, the recipient at single-window section shall instruct the individual or organization to create or assist them in creating a level-1 eID account. If the organization or individual authorizes another organization or individual to handle administrative procedures, the eID account shall be considered as the eID account of the authorized organization or individual.”

Article 41. Implementation responsibilities

1. The Ministry of Public Security shall be responsible for providing guidance on, inspecting and encouraging implementation of this Decree.

2. In the course of implementation thereof, the Ministry of Public Security shall cooperate with the Ministry of Information and Communications in dealing with issues under its delegated authority. Where necessary, the Prime Minister’s decision should be sought.

3. Ministers, heads of quasi-ministries, heads of government bodies and Presidents of People’s Committees of provinces and central-affiliated cities shall be responsible for the implementation of this Decree./.