Circular No. 12/2025/TT-BKHCN on establishing and operating the system for receiving and consolidating data to serve state management of electronic transactions.

CIRCULAR
Regulations on establishing and operating the System for receiving and consolidating data to serve state management of electronic transactions of state agencies
for the management of electronic transactions by state agencies

Pursuant to the Law on Electronic Transactions dated June 22, 2023;

Pursuant to Decree No. 55/2025/NĐ-CP dated March 2, 2025 of the Government stipulating the functions, tasks, powers, and organizational structure of the Ministry of Science and Technology;

Pursuant to Decree No. 137/2024/NĐ-CP dated October 23, 2024 of the Government stipulating electronic transactions of state agencies and information systems serving electronic transactions;

Pursuant to Decree No. 85/2016/NĐ-CP dated July 1, 2016 of the Government on ensuring the security of information systems according to levels;

At the proposal of the Director of the National Digital Transformation Agency;

The Minister of Science and Technology issues this Circular On regulations regarding the establishment and operation of the System for receiving and consolidating data to serve state management of electronic transactions of state agencies.

PART I
GENERAL PROVISIONS

Article 1. Scope of Regulation

This Circular stipulates the establishment and operation of the System for receiving and consolidating data to serve state management of electronic transactions of state agencies in accordance with Clause 4, Article 18 of Decree No. 137/2024/NĐ-CP dated October 23, 2024 of the Government stipulating electronic transactions of state agencies and information systems serving electronic transactions.

This Circular sets out functional requirements, performance, and information security requirements for the system; responsibilities of relevant agencies in connecting and sharing data to serve state management of electronic transactions.

Article 2. Applicability

1. Administrative state agencies (including Ministries, ministerial-level agencies, agencies under the Government, People's Committees of provinces and centrally governed cities) directly participating or related to electronic transactions of state agencies and information systems serving electronic transactions.

2. Organizations and individuals involved in providing solutions, building, developing, upgrading, expanding, and operating information systems serving electronic transactions, or other information systems connected to the System for receiving and consolidating data to serve state management of electronic transactions of state agencies.

Article 3. Explanation of Terms

In this Circular, the following terms shall be understood as follows:

1. The System for receiving and consolidating data to serve state management of electronic transactions of state agencies (hereinafter referred to as the DTM System) is an extension component of the reporting information system of the Ministry of Science and Technology as prescribed by the administrative reporting regime of state agencies, aimed at serving activities of data consolidation, analysis, evaluation, and information collection to support state management of electronic transactions, ensuring timeliness, accuracy, security, and effectiveness.

2. Information systems serving state management of electronic transactions by sector and locality (hereinafter referred to as the Sectoral and Local Management Information Systems) are components of the reporting information system, or information systems serving electronic transactions, or digital platforms of Ministries, ministerial-level agencies, agencies under the Government, and People's Committees of provinces and centrally governed cities established to collect, store, process, and consolidate data to perform state management tasks of electronic transactions within their sectors and localities.

3. Consolidated data is data processed and combined from various sources, forming higher comprehensive information for analysis, reporting, and decision-making support.

4. Data reception methods are a set of mechanisms and techniques applied by the DTM System to collect data, including two data collection methods: (i) online, automatic connection, and (ii) manual entry into the DTM System according to the reporting regime. For the online, automatic data collection method, it includes but is not limited to real-time data and batch data collection.

5. Application Programming Interface (API) is a set of functions and procedures that allow interaction between the DTM System and other information systems.

6. Real-time data reception is a method of data reception where data messages are sent to the system almost simultaneously with the occurrence of the event generating the data message.

7. Batch data reception is a method of receiving sets of data messages over a defined period such as hourly, daily, weekly, etc.

8. Data reception format is the form of collected data, including but not limited to raw data and partially masked data to ensure confidentiality.

9. Partially masked data is data processed to hide or blur sensitive information, ensuring privacy while retaining value and usefulness for analysis or processing.

10. Sources of data collected for the DTM System include:

- Sectoral and Local Management Information Systems;

- Information systems serving electronic transactions;

- Organizations and individuals providing data;

- Other information systems and digital platforms.

Chapter II
REGULATIONS ON THE ESTABLISHMENT AND OPERATION OF THE SYSTEM FOR RECEIVING AND CONSOLIDATING DATA TO SERVE STATE MANAGEMENT OF ELECTRONIC TRANSACTIONS OF STATE AGENCIES

COMBINED DATA FOR STATE MANAGEMENT

OF ELECTRONIC TRANSACTIONS BY STATE AGENCIES

Article 4. General Requirements

1. The establishment of the DTM System ensures the fulfillment of the Ministry of Science and Technology’s (previously the Ministry of Information and Communications) responsibility for state management of electronic transactions as stipulated in Articles 48 and 50 of the Law on Electronic Transactions No. 20/2023/QH15 dated June 22, 2023.

2. The DTM System shall meet the following requirements:

a) Compliance with the Vietnam Digital Government Architecture Framework.

b) Connection and data collection from information systems serving electronic transactions and Sectoral and Local Management Information Systems through one of the two methods: (i) online, automatic connection, or (ii) manual entry into the DTM System according to the reporting regime.

Article 5. Functional Requirements for the DTM System

The DTM system must meet the following minimum functional requirements:

1. Data reception function from various sources, supporting diverse reception methods and formats as prescribed, ensuring scalability, integration with other systems, and interaction through open standards.

2. Data processing, classification, aggregation, enrichment, and analysis functions; supporting big data exploration and visualization of results to effectively serve management activities, evaluation, and decision-making.

3. Data schema and metadata management function: allowing definition, publication, and control of data schemas and accompanying metadata; supporting data lineage retrieval and data normalization for interoperability and sharing.

4. Flexible reporting and statistical function, supporting real-time or periodic data retrieval according to management requirements.

5. Automatic testing and performance monitoring function: the system automatically checks page load metrics, response time, concurrent access, and issues early warnings when abnormal signs or thresholds are exceeded.

6. Comprehensive system management function, including user management, access permission control, automatic configuration, data reconciliation, data backup and recovery, cluster model support, load balancing, and disaster recovery.

7. Network information security and data encryption (transmission and storage) function, multi-factor authentication (MFA), digital certificate management, regular security testing, recording and monitoring of information security events.

8. System logging function, tracking, monitoring, and storing all access and data manipulation activities, configuration changes to serve auditing, inspection, investigation, and accountability; logs must be immutable and stored for at least one year or as prescribed by law.

9. Auditing and transparency function: providing tools and automated audit reports on data access, changes, and sharing, enhancing transparency and serving inspection and incident investigation work.

10. Standardized data sharing function, interoperable with other information systems of ministries, sectors, and localities, ensuring compliance with technical, security, and data governance standards, and supporting flexible access and exploitation across multiple platforms (including mobile devices and assistive devices for persons with disabilities).

Article 6. Performance Requirements

1. The system must ensure appropriate page load performance suitable for user experience, including: first content display time, maximum content display time, content loading time, and response time. Detailed criteria are specified in Appendix 02 issued together with this Circular.

2. The system must ensure overall processing performance, including: average response time, maximum response time, ability to handle concurrent access and active users simultaneously. Detailed requirements are set out in Appendix 02 issued together with this Circular.

Article 7. Information Security Assurance Requirements

1. The DTM system complies fully with regulations on network information security and cybersecurity.

2. The DTM system must undergo regular and ad hoc network information security assessments and evaluations as prescribed, and before being put into operation and exploitation as required by law.

Chapter III
REGULATIONS ON CONNECTION AND DATA SHARING

FOR ELECTRONIC TRANSACTION MANAGEMENT

BY STATE AUTHORITIES

Article 8. General provisions on connection and sharing of data for the DTM System

1. Information and data collected by the DTM System shall come from the following sources:

a) Ministries, ministerial-level agencies, and agencies under the Government.

b) People's Committees of provinces and centrally-administered cities.

c) Organizations, enterprises, and individuals related to providing solutions for building, developing, upgrading, expanding, and operating information systems serving electronic transactions.

2. Methods of collecting information and data by the DTM System

a) Online, automatic connection: Information systems serving electronic transactions, sectoral administrative systems, and territorial administrative systems connect and share data online with the DTM System. The DTM System automatically collects information and data through APIs.

b) Reporting on the DTM System: Various types of information and data collected through reporting regimes are entered into the DTM System by organizations and individuals specified in Clause 1 of this Article.

c) Other methods according to regulations on forms and periodic reporting regimes; however, the periodic reporting regime of the Ministry of Science and Technology is not encouraged to ensure consistency and effectiveness in consolidation and processing.

3. Types of information and data received by the DTM System

a) Strategies, plans, and policies for developing electronic transactions; legal documents on electronic transactions; technical standards, technical requirements, economic-technical norms, product and service quality in electronic transactions.

b) Statistical data on the operation of electronic transactions; data monitoring the safety of information systems serving electronic transactions by system managers.

c) Data on training, capacity building, and human resource development for electronic transactions.

d) Data serving inspection, supervision, complaint resolution, and handling violations of laws on electronic transactions; data related to acts of violation, signs, and risks of exploiting information systems to commit violations of Vietnamese laws; reports on incidents that have occurred.

đ) Other data when there is mutual written agreement between the DTM System management agency and the manager of information systems serving electronic transactions, ensuring compliance with the contents of Articles 10 and 11 of this Circular.

4. Agencies and organizations implementing connections and data sharing with the DTM System are responsible for storing complete logs of connections and data sharing for a minimum period of one year from the completion date of the connection to serve tracking, inspection, and supervision work.

5. The Ministry of Science and Technology (National Digital Transformation Agency) shall take the lead in organizing inspections, supervision, and evaluations of the connection between the DTM System and related systems annually.

Article 9. Specific Provisions on Connection and Sharing of Data for the DTM System

1. Information systems serving electronic transactions must implement connections and sharing of information and data with sectoral administrative systems, territorial administrative systems, or the DTM System.

2. Sectoral administrative systems and territorial administrative systems must implement connections and sharing of comprehensive information and data with the DTM System to serve statistical work, evaluation, forecasting, and decision-making.

3. The DTM System maintains two simultaneous data reception methods: real-time data reception and batch data reception. Depending on technical conditions, actual system performance, network conditions, nature of the data, etc., relevant parties may choose one of the two methods or combine both methods.

4. The DTM System supports two data reception formats simultaneously: full data reception (raw data) and partial data reception (masked data). The application of specific reception formats depends on the nature of the data, security requirements, special requirements, and consensus between the managing agency of the system and the data provider in one of the two formats above.

5. Technical requirements for connecting and sharing data with the DTM System are stipulated in Appendix 01 attached to this Circular.

Article 10. Responsibilities of the Managing Authorities of Information Systems Serving Electronic Transactions and Sectoral and Territorial Information Systems Connected to Share Data with the National Data Exchange System (NDXS)

1. Provide complete, accurate, and timely information and documents necessary for connecting their systems to the NDXS.

2. Organize the implementation of system connection and data sharing between their systems and the NDXS in accordance with the agreed content, technical requirements, and timeline with the NDXS management authority.

3. Closely cooperate with the NDXS management authority during the review, inspection, reconciliation processes to ensure that collected data is comprehensive, intact, accurate, and timely.

4. Promptly notify the NDXS management authority of any changes to infrastructure, software, data structure, system configuration, or any other factor that may affect data transmission, reception, and processing.

5. Ensure the full implementation of all measures for monitoring network security during the connection and data sharing process and securing data extracted from the NDXS; comply with regulations on personal data protection.

6. Decide on the content of data not to be shared within their authority, in cases where the data falls under state secrets, based on Article 9 of the Law on State Secrets No. 29/2018/QH14 dated November 15, 2018, and related guiding documents.

7. Regularly report annually to the Ministry of Science and Technology (National Digital Transformation Agency) on the situation of system connection, data exploitation, and usage shared with the NDXS.

The report content includes: connection status, usage metrics, arising issues, and recommendations (if any). The latest date for submitting the report is December 31 each year or at any time upon request by the NDXS management authority.

Article 11. Responsibilities of the NDXS Management Authority

1. Establish and publish the NDXS.

2. Develop, publish, and promptly update technical guidance materials and technical support for agencies and organizations implementing system connections with the NDXS.

3. Lead and coordinate with the managing authorities of connected systems and relevant individuals and organizations to promptly address incidents and issues arising during the connection and data sharing process.

4. Implement fully all measures to ensure information security for the NDXS in compliance with laws on network security, cybersecurity, and personal data protection.

5. Ensure stable, continuous, efficient, secure operation of the NDXS in terms of network security and cybersecurity.

6. Share aggregated transaction data with ministries, sectors, and localities when there is a legitimate and necessary request to serve state management tasks, ensuring compliance with regulations.

7. Aggregate, evaluate, and publish annual reports on the connection and data exploitation of systems integrated into the NDXS. Reports should reflect key contents about the degree of connection, frequency of use, exploitation indices, information security, and technical recommendations to enhance system operation efficiency. Reports can be publicly disclosed in full or summarized according to current regulations.

Chapter IV
IMPLEMENTING PROVISIONS

Article 12. Responsibility for Implementation

1. The Minister, Heads of Ministries equivalent to Ministries, Heads of Government Agencies, Chairpersons of Provincial People's Committees, and relevant organizations and individuals are responsible for implementing this Circular.

2. Organizations and individuals involved are responsible for complying with the connection and data sharing with the NDXS as prescribed.

3. The Ministry of Science and Technology (National Digital Transformation Agency) is responsible for:

a) Leading and coordinating with agencies and organizations with systems connected to the NDXS and relevant agencies and organizations to handle incidents and issues arising during the establishment and maintenance of connections and data sharing.

b) Organizing regular and ad hoc inspections, supervision, and evaluations of the implementation of system connections and data sharing with the NDXS in accordance with the law; organizing the publication of inspection, supervision, and evaluation results annually as stipulated by law and management requirements.

Article 13. Effective Date

1. This Circular takes effect from January 1, 2026.

2. During implementation, if difficulties or issues arise, agencies and units must promptly report to the Ministry of Science and Technology (National Digital Transformation Agency) for guidance, support, and resolution.

Article 14. Transitional Provisions

Within one year from the effective date of this Circular, ministries, sectors, localities, and related units are responsible for reviewing, building, adjusting, expanding, or upgrading existing information systems to meet technical requirements for connection and data sharing with the national data receiving and aggregating system serving state management of electronic transactions as prescribed in this Circular./.

Appendix 01

TECHNICAL REQUIREMENTS FOR CONNECTING INFORMATION SYSTEMS SERVING ELECTRONIC TRANSACTIONS OF STATE AGENCIES

(Annexed to Circular No. /2025/TT-BKHCN dated / /2025
of the Minister of Science and Technology)

1. General Requirements

1.1. The system must ensure scalability: When integrating additional systems or new agencies, the system must maintain performance and data processing stability without affecting ongoing transactions or significantly increasing response times.

1.2. Multilingual Support: Ensure the system can operate in multiple regions or organizations with specific language characteristics, supporting the diversity of data sending units.

1.3. Continuous Operation 24/7: The system must ensure constant availability, with maximum downtime not exceeding 1% of total time in a year, including maintenance time.

1.4. Disaster Recovery Capability: The system must establish and maintain backup and data recovery plans to ensure continuous operation during major incidents or natural disasters. Large systems are encouraged to use Cloud or DR sites; smaller, local systems may choose appropriate solutions such as outsourcing or using domestic cloud services. Large systems must conduct regular data recovery drills at least once a year; smaller systems should organize checks suitable to their actual conditions, ensuring data recovery capability.

1.5. Data Quality Control and Consolidation: The system must gradually develop functions for checking, comparing, and consolidating data from various sources to minimize duplication and errors. For new systems or standardized data, automated control and consolidation should be implemented. For old systems, a combination of automatic and manual checks, along with phased deployment according to a schedule, should be allowed based on actual conditions.

1.6. Interoperability and Compliance with Open Standards: The system must be designed to easily interact with other systems through compliance with widely recognized open standards regarding data formats (e.g., JSON, XML, Excel, CSV, Parquet, etc.), communication protocols, and APIs, while also complying with national technical standards and regulations (TCVN, QCVN) related to data and information security.

1.7. Data Governance and Compliance: The system supports the implementation of data governance policies, allowing for tracking the lifecycle, managing data versions, and ensuring compliance with relevant legal regulations, particularly those concerning personal data protection. New systems or upgraded systems must fully implement all data governance functions, including data version and lifecycle management. For older systems, compliance with personal data protection regulations should be prioritized, with additional tracking, logging, and data version management functions gradually added during upgrades or technology changes.

1.8. Auditability: All access, data changes, configuration changes, and significant administrative actions must be logged in detail, securely, and immutably to serve auditing, incident investigation, and accountability purposes. Operational logs and security logs must be stored for a minimum of one year (or as prescribed by law).

1.9. Usability and Accessibility: If the system has a user interface, it must be intuitive, easy to use, and comply with accessibility standards to ensure that users with disabilities can also use it.

1.10. Evaluation, Testing, and Security Assurance: The system must conduct penetration testing and independent security assessments regularly in accordance with laws on information security and cybersecurity.

2. Communication via Authenticated API

2.1. Support for RESTful and SOAP Standards: Ensure that the system is easy and convenient to connect and share data with other systems.

2.2. API Version Management: Each API must support version management to ensure uninterrupted service when updating, expanding, or upgrading the system. New or upgraded systems must mandatorily apply API version management. For older systems without versioning support, gradual application of version management should be considered, prioritizing current operational stability, while developing a roadmap for versioning upgrades or additions during maintenance or integration expansion.

2.3. Rate-Limiting Mechanism: Limit the number of API requests within a time period to protect the system from overload due to attacks or invalid traffic. Set flexible thresholds according to each business process. New systems must fully deploy rate-limiting mechanisms. For older systems, it is recommended to gradually supplement or configure basic rate-limiting controls suitable to technical conditions, prioritizing APIs with high risk or high access frequency.

2.4. Protection Against Injection Attacks: APIs must be configured to filter and check input parameters to prevent malicious code or abnormal data causing errors. For older systems, if comprehensive automatic checks cannot be implemented, at least manual reviews and input parameter checks for critical APIs are required, with gradual enhancements made during maintenance or new development.

2.5. Organizations or applications using APIs must authenticate through modern security methods, including at least one of the following: API Key, OAuth2.0, or OpenID Connect. Each organization or application must have separate authentication information. The management mechanism must ensure that only authorized applications or users can access the API, while supporting revocation, permission management, and full access logging as prescribed.

2.6. Encryption of API Data: All connection and shared data must be encrypted using valid HTTPS and SSL/TLS protocols to protect against theft or forgery.

2.7. API Documentation: Provide detailed, clear, and updated API documentation (preferably using OpenAPI/Swagger standards) for developers integrating the system.

2.8. Use and Management of APIs via API Gateway

a) Mandatory deployment and use of API Gateway for electronic transaction information systems classified as large or very large scale under the law on electronic transactions of state agencies and electronic transaction information systems. The API Gateway must be used to centrally manage all APIs, controlling access, distribution, protection, logging, monitoring operations, detecting and preventing abnormal behaviors, and enhancing the efficiency, flexibility, and security of the API system.

b) Encourage the application of API Gateway for information systems not covered under point a of this clause to enhance management capabilities, security, monitoring, and operational efficiency of APIs.

3. Sending aggregated data in general format

3.1. The system must support at least common data exchange formats such as JSON, XML; while encouraging support for formats serving large data processing (Big Data) such as CSV, Parquet.

3.2. Definition of data schema and metadata: Types of exchanged data need to be clearly defined and published with accompanying metadata guidelines, ensuring consistency, automatic validation, traceability, and standardization of data between systems. For legacy systems, a transition roadmap can be applied: initially ensuring clear definition of key data fields, while gradually completing the data schema and metadata according to the common templates issued by the supervising authority or guidelines.

3.3. Security-related data field: Supplement information related to the security status and priority level of data to ensure proper processing according to procedures.

3.4. Data validation and quality control: The system must automatically check data format, type, compliance with data schemas, and other business requirements before accepting or allowing upload, ensuring data quality and minimizing errors.

3.5. Flexible data import/export support: The system allows organizations and users to easily extract or import data in common formats (CSV, Excel, JSON, XML, DOCX) for consolidation, reporting, or business processes, contributing to reducing risks associated with manual operations.

4. Ensuring information security

4.1. Early warning: Integrate IDS/IPS solutions to detect abnormal behaviors such as unauthorized login attempts, access limits based on IP addresses (blacklist, whitelist configuration, foreign IP address limits).

4.2. Encrypting stored data: Stored data must be encrypted using strong algorithms (AES-256) to prevent unauthorized access even if the system is breached.

4.3. Multi-factor authentication (MFA): Apply to administrative accounts to minimize risks from access takeover attacks.

4.4. Reporting and addressing vulnerabilities: Each identified security vulnerability must have a detailed report and a specific plan for resolution, ensuring the system is not threatened long-term.

4.5. Secure connection protocols: Use secure connection protocols that are regularly updated and upgraded from insecure ones.

5. Monitoring and reporting

5.1. Real-time performance metrics: The system must provide a dashboard displaying important metrics such as response time, error rate, daily transactions... for direct monitoring. For small-scale systems, basic dashboard solutions or integration into centralized monitoring systems of higher-level supervising authorities may be used.

5.2. Centralized monitoring and alert process integration: Monitoring data and activity logs must be retained for at least one year (or as prescribed by law). The system should integrate an automated incident alert process, supporting alerts through multiple channels suitable for actual conditions (such as email, applications, dashboards).
For small systems, it is encouraged to apply appropriate alert methods based on capability and needs; they may connect to the alert system of the supervising entity or outsource monitoring services when necessary.

5.3. Periodic reports: Reports must detail system performance during the period, including successful and failed transactions and their causes.

Appendix 02

REQUIREMENTS FOR THE PERFORMANCE OF SYSTEMS RECEIVING AND AGGREGATING DATA TO SERVE STATE MANAGEMENT OF ELECTRONIC TRANSACTIONS BY STATE AGENCIES
(Issued together with Circular number /2025/TT-BKHCN dated / /2025

1. Web page load performance requirements (UX)
of the Minister of Science and Technology)

Web page load performance for user experience under minimum bandwidth of 100 Mbps:

Requirements

Average response time