Decree No. 69/2024/ND-CP on electronic identification and authentication

DECREE

REGULATION on electronic identification and authentication

Pursuant to the Law on Organization of the Government dated June 19, 2015; the Law Amending and Supplementing Certain Provisions of the Law on Organization of the Government and the Law on Organization of Local Administration dated November 22, 2019;

||| Pursuant to the Cybersecurity Law dated November 19, 2015;

||| Pursuant to the Cyber Security Law dated June 12, 2018;

Pursuant to the Law on Electronic Transactions dated June 22, 2023;

Pursuant to the Law on Identity Cards dated November 27, 2023;

Pursuant to the Investment Law dated June 17, 2020, amended and supplemented by certain articles according to Law No. 72/2020/QH14, Law No. 03/2022/QH15, Law No. 05/2022/QH15, Law No. 08/2022/QH15, Law No. 09/2022/QH15, Law No. 20/2023/QH15; Law No. 26/2023/QH15;

The Government promulgates this Decree on regulations regarding entry, exit, and residence policies for foreigners at the International Financial Center in Vietnam.

The Government issues this Decree detailing electronic identification and authentication.

PART I

GENERAL PROVISIONS

Article 1. Scope of Regulation

This Decree specifies detailed regulations on electronic identity; issuance, management, and use of electronic identification accounts; updating and storing information in the electronic identification and authentication system; conditions and procedures for connecting to the electronic identification and authentication system; electronic authentication services; procedures and formalities for issuing, locking, and unlocking electronic identification cards; and responsibilities of agencies, organizations, and individuals related to electronic identification, authentication, and electronic identification cards.

Article 2. Applicability

This Decree applies to agencies, organizations, and Vietnamese citizens; foreign organizations and individuals residing or operating in Vietnam who directly participate or are involved in electronic identification and authentication activities.

Article 3. Explanation of Terms

In this Decree, the following terms are understood as follows:

1. Electronic identity is information of an agency, organization, or individual in the electronic identification and authentication system that allows the unique determination of such individual, agency, or organization in the electronic environment.

2. Subject of electronic identity is the agency, organization, or individual identified with the electronic identity.

3. Electronic identification is the activity of registering, reconciling, establishing, and linking electronic identity with the subject of electronic identity.

5. Electronic identification account is a set comprising login name, password, or other authentication means established by the agency managing electronic identification and authentication, used to access and utilize features, utilities, applications of the electronic identification and authentication system and connected information systems in accordance with the law.

7. Authentication factor is the authentication means used to confirm and affirm accurately the subject of electronic identity before accessing and exploiting information in the electronic identification and authentication system.

8. Authentication means are various methods allowing users to perform electronic authentication: password, secret code, barcode, terminal device, password token, one-time password device or software, cryptographic device or software, citizen identity card, resident identity card, passport, facial image, fingerprint, voiceprint, iris or other tools and methods used for electronic authentication purposes.

10. Electronic identification information page is a utility developed by the Ministry of Public Security from the electronic identification and authentication system to implement electronic identification and authentication activities in administrative procedures, public administration services, and other transactions in the electronic environment; developing features, utilities, applications to serve agencies, organizations, and individuals.

11. Electronic identification and authentication platform is an information system serving the exchange of information between the electronic identification and authentication system and the information systems of state agencies, political organizations, political-social organizations, organizations providing electronic authentication services, and other organizations and individuals.

Article 4. Principles for Electronic Identification and Authentication

1. Compliance with the Constitution and laws, ensuring the rights and legitimate interests of agencies, organizations, and individuals.

2. Ensuring accuracy, transparency, and openness in management, facilitating agencies, organizations, and individuals.

3. Ensuring security and safety of devices, data confidentiality when conducting electronic identification and authentication.

4. Agencies, organizations, and individuals exploiting and using electronic identities must keep electronic identification account information confidential and comply with legal regulations on personal data protection.

5. Any violation of laws on electronic identification and authentication must be detected and handled promptly according to legal provisions.

6. Ensuring compliance with international treaties to which Vietnam is a party.

7. Electronic identification accounts shall not be used for activities or transactions contrary to legal provisions; infringing upon national security, defense, national interests, public interests, and the legitimate rights and interests of organizations and individuals.

8. No agency, organization, or individual may illegally interfere with the operations of the electronic identification and authentication system.

Chapter II

ELECTRONIC IDENTITY, ELECTRONIC IDENTIFICATION, ELECTRONIC IDENTIFICATION ACCOUNT, ELECTRONIC AUTHENTICATION

Article 5. Electronic Identity of Foreign Nationals

1. The electronic identity of foreign nationals includes:

a) The unique identification number of the foreign national;

b) Surname, middle name, and given name;

c) Date of birth;

d) Gender;

đ) Nationality;

e) Passport number, code, date, and place of issuance, or the number, symbol, date, and place of issuance of travel documents;

g) Facial image;

h) Fingerprints.

2. The unique identification number of a foreign national is a natural number sequence established by the electronic identification and authentication system to manage the electronic identity of a single foreign individual.

Article 6. Electronic Identity of Agencies and Organizations

1. Information on the electronic identity of agencies and organizations includes:

a) The unique identification number of the agency or organization;

b) Name of the agency or organization including Vietnamese name, abbreviation (if any), and foreign language name (if any);

c) Date of establishment;

d) Main office address;

đ) Tax registration number (if any);

e) Business registration number (if any);

g) Electronic identification code of the agency or organization (if any);

h) Full name, middle name, given name, and individual identification number (or foreign national identification number) of the legal representative or head of the agency or organization who performs procedures for opening an electronic identification account for the agency or organization.

2. The unique identification number of an agency or organization is a natural number sequence established by the electronic identification and authentication system to manage the electronic identity of a single agency or organization.

Article 7. Classification and Subjects Eligible for Electronic Identification Accounts

Agencies, organizations, Vietnamese citizens, and foreign organizations and individuals residing in Vietnam are eligible for electronic identification accounts as follows:

1. Vietnamese citizens aged 14 years or older who have been issued a citizen identification card or a valid citizen identification card are eligible for level 01 and level 02 electronic identification accounts.

Vietnamese citizens aged 6 to under 14 years who have been issued a citizen identification card are eligible for level 01 and level 02 electronic identification accounts when needed. Vietnamese citizens under 6 years old who have been issued a citizen identification card are eligible for level 01 electronic identification accounts when needed.

2. Foreign nationals aged 6 years or older who have been issued a residence permit or temporary residence permit in Vietnam are eligible for level 01 and level 02 electronic identification accounts when needed. Foreign nationals under 6 years old who have been issued a residence permit or temporary residence permit in Vietnam are eligible for level 01 electronic identification accounts when needed.

3. Agencies and organizations established or registered to operate in Vietnam are eligible for electronic identification accounts without distinction based on levels.

Article 8. Updating information into the electronic identification and authentication system

1. Information of individuals in the National Population Database, Electronic Registration Records Database, Identity Card Database, National Entry-Exit Database, other national databases, and related specialized databases concerning electronic identity that has been integrated into the electronic identification account and has changed shall be automatically updated into the electronic identification and authentication system.

2. Information of agencies and organizations in the National Enterprise Registration Database, other national databases, and related specialized databases concerning electronic identity shall be automatically updated into the electronic identification and authentication system to establish the electronic identification number and account for agencies and organizations to serve electronic identification and authentication activities.

Article 9. Using electronic identification accounts and other electronic transaction accounts established by agencies, organizations, and individuals

1. Level 01 electronic identification account of Vietnamese citizens and foreigners may be used to access, exploit, and use information about electronic identity and certain features, utilities, applications of the electronic identification and authentication system, and interconnected and shared information systems as prescribed by law.

2. Level 02 electronic identification account of Vietnamese citizens may be used to access, exploit, and use electronic identity cards, information other than that integrated into the electronic identity card, which is shared, integrated, and updated from national databases, specialized databases, and all features, utilities, applications of the electronic identification and authentication system, and interconnected and shared information systems as prescribed by law.

3. Level 02 electronic identification account of foreigners, and electronic identification account of agencies and organizations may be used to access, exploit, and use electronic identity information and other shared, integrated, and updated information from national databases, specialized databases, and all features, utilities, applications of the electronic identification and authentication system, and interconnected and shared information systems as prescribed by law.

4. The electronic identity subject uses the electronic identification account to log in, authenticate, and use features and utilities on the national identification application, electronic identification information website at dinhdanhdientu.gov.vn or vneid.gov.vn, or other utilities on applications and software of other agencies, organizations, and individuals connected to the electronic identification and authentication system.

5. The electronic identification account is used to perform administrative procedures, public administrative services in the electronic environment, and other activities according to the needs of the electronic identity subject.

6. Information about electronic identity and information integrated on the electronic identity card, electronic identification account has evidentiary value, equivalent to providing information or using, presenting documents containing such information when performing administrative procedures, public services, transactions, and other activities.

7. Agencies, organizations, and individuals may establish electronic transaction accounts in accordance with laws on electronic transactions to serve their transactions and activities, and bear responsibility for verifying and ensuring the accuracy of the accounts they establish, determining the level and value of use of each level account. Information for establishing an electronic transaction account must be provided by the account subject and agreed upon by the agency, organization, or individual to use it to establish the account.

Article 10. Procedure for Issuing Electronic Identity Accounts for Vietnamese Citizens

1. Issuance of Level 01 Electronic Identity Account

a) The citizen uses digital devices to download and install the National Identification Application;

b) The citizen uses the National Identification Application to enter personal identification number, main mobile phone number, and email address (if available), declare information according to guidance on the National Identification Application; capture facial image through digital device and send request for issuance of electronic identity account to the authority managing electronic identification and authentication;

c) The authority managing electronic identification and authentication conducts verification and confirmation of the citizen's information requesting issuance of electronic identity account and notifies registration results via the National Identification Application or main mobile phone number or email address;

d) Representatives or guardians use their main mobile phone number and level 02 electronic identity account to declare and register issuance of level 01 electronic identity account for citizens under 14 years old, those under guardianship, or those represented through the National Identification Application.

2. Issuance of Level 02 Electronic Identity Account

a) The citizen goes to the Police Station of the commune, ward, town or non-residential domicile management agency, presents the Citizen Identity Card or valid Citizen Identity Card, and proceeds with the procedure for issuing level 02 electronic identity account;

b) The citizen provides complete and accurate information on the Application Form for Issuing Electronic Identity Account according to Model TK01 issued together with this Decree; including clearly stating the main mobile phone number, email address (if available), and other information requested to be integrated into the electronic identity card (if needed) to the receiving officer;

c) The receiving officer enters the citizen's provided information into the electronic identification and authentication system for verification; verifies the facial image and fingerprints of the citizen applying for the procedure with the National Identity Database;

d) The authority managing electronic identification and authentication conducts verification and confirmation of the citizen's information requesting issuance of level 02 electronic identity account and notifies registration results for issuance of level 02 electronic identity account via the National Identification Application or main mobile phone number or email address;

đ) Citizens under 14 years old, those under guardianship, or those represented, along with their representatives or guardians, go to the Police Station of the commune, ward, town or place where the identity card application procedures are carried out to apply for issuance of level 02 electronic identity account;

Representatives or guardians use their main mobile phone number to declare and register issuance of level 02 electronic identity account for Vietnamese citizens under 14 years old, those under guardianship, or those represented.

3. In cases where citizens have not been issued a Citizen Identity Card or valid Citizen Identity Card, they shall simultaneously request issuance of an electronic identity account while proceeding with the identity card issuance procedures and follow the procedures and formalities stipulated in Clause 1 and Clause 2 of this Article.

Article 11. Procedure for Issuing Electronic Identity Accounts for Foreigners

1. Issuance of Level 01 Electronic Identity Account

a) Foreigners use digital devices to download and install the National Identification Application;

b) Foreigners use the National Identification Application to enter passport number or international travel document number and email address or registered mobile phone number (if available); declare information according to guidance on the National Identification Application; capture facial image using digital device and send request for issuance of electronic identity account to the authority managing electronic identification and authentication through the National Identification Application;

c) The authority managing electronic identification and authentication notifies registration results via the National Identification Application or main mobile phone number or email address;

d) Representatives or guardians use their main mobile phone number and level 02 electronic identity account to declare and register issuance of level 01 electronic identity account for foreigners under 14 years old, those under guardianship, or those represented through the National Identification Application.

2. Issuance of Level 02 Electronic Identity Account

a) Foreigners go to the Exit-Entry Management Authority under the Ministry of Public Security or provincial-level police to present passports or international travel documents and proceed with the procedure for issuing level 02 electronic identity account;

b) Foreigners provide complete and accurate information on the Application Form for Issuing Electronic Identity Account according to Model TK01 issued together with this Decree; including clearly stating the main mobile phone number, email address (if available), and other information requested to be integrated into the National Identification Application to the receiving officer;

c) The receiving officer enters the foreigner's provided information into the electronic identification and authentication system; captures facial image and fingerprints of the foreigner applying for the procedure with the National Database on Exit-Entry;

d) The Exit-Entry Management Authority sends request for issuance of electronic identity account to the authority managing electronic identification and authentication;

đ) The authority managing electronic identification and authentication notifies registration results via the National Identification Application or main mobile phone number or email address;

e) Foreigners under 14 years old, those under guardianship, or those represented, along with their representatives or guardians, go to the Exit-Entry Management Authority under the Ministry of Public Security or provincial-level police to apply for issuance of level 02 electronic identity account;

Representatives or guardians use their main mobile phone number to declare and register issuance of level 02 electronic identity account for foreigners aged from 6 to under 14 years old, those under guardianship, or those represented.

Article 12. Procedures for issuing electronic identity accounts for agencies and organizations

In cases of direct submission, the legal representative, head of the agency or organization, or the authorized person shall fill out the Application Form for Issuance of Electronic Identity Account for Agencies and Organizations according to Model TK02 issued together with this Decree, and submit the application at the Agency for Identity Management and Authentication or the agency managing identification cards where it is convenient.

2. The Agency for Identity Management and Authentication shall conduct verification and authentication of information about the agency or organization in the National Database on Business Registration, national databases, and specialized databases.

If information about the agency or organization is not available in the National Database on Business Registration, national databases, and specialized databases, verification of such information shall be carried out.

3. The Agency for Identity Management and Authentication shall notify the result of the issuance of the electronic identity account to the legal representative, head of the agency or organization who has completed the procedures through the National Identity Application, main mobile number, or email address.

If the conditions for issuing an electronic identity account are not met, the Agency for Identity Management and Authentication shall notify in writing, via text message, or through the electronic identity account of the person who made the application.

Article 13. Time limit for processing the issuance of electronic identity accounts

From the date of receipt of complete and valid applications as stipulated in this Decree, the Agency for Identity Management and Authentication shall be responsible for processing the issuance of electronic identity accounts within the following time limits:

1. For Vietnamese citizens who already have a valid citizen identification card:

a) Not exceeding one working day for the issuance of level 1 electronic identity accounts;

b) Not exceeding three working days for the issuance of level 2 electronic identity accounts.

2. For Vietnamese citizens who have an expired citizen identification card or do not have one, the processing time shall not exceed seven working days.

3. For foreign individuals:

a) Not exceeding one working day for the issuance of level 1 electronic identity accounts;

b) Not exceeding three working days for the issuance of level 2 electronic identity accounts if there is facial image and fingerprint information in the National Database on Entry and Exit.

c) Not exceeding seven working days for the issuance of level 2 electronic identity accounts if there is no facial image and fingerprint information in the National Database on Entry and Exit.

4. For organizations:

a) Not exceeding three working days if the information required for verification about the organization is available in the national database or specialized databases;

b) Not exceeding fifteen working days if the information required for verification about the organization is not available in the national database or specialized databases.

Article 14. Activation and Use of Electronic Identity Account

1. The electronic identity subject shall activate the individual, agency, or organization's electronic identity account on the National Identification Application within seven days from the date of receiving the notification of the issuance result of the electronic identity account. After seven days, if the electronic identity account has not been activated, the electronic identity subject shall contact the electronic identification and authentication management agency through the hotline for receiving and resolving requests related to electronic identification and authentication to activate the electronic identity account.

2. Individuals under 14 years old, those under guardianship, and those represented must obtain the consent and confirmation of their representatives or guardians through the National Identification Application when using the electronic identity account. Representatives or guardians may use the electronic identity account of individuals under 14 years old, those under guardianship, or those represented to perform transactions and other activities serving their rights and interests.

3. The use of the electronic identity account and electronic authentication services have legal validity to affirm and prove that the electronic identity subject has performed and agreed to the transaction.

4. The electronic identification and authentication management agency shall connect, share, and authenticate data so that the electronic identity subject can use the electronic identity account in other countries according to international treaties to which Vietnam is a party.

1. Locking and Unlocking the Electronic Identity Account of Vietnamese Citizens

The electronic identification and authentication system automatically locks or unlocks the electronic identity account of citizens when the citizen’s electronic ID card is locked or unlocked, or when the citizen’s ID card or passport expires.

2. Locking the Electronic Identity Account of Foreigners and Organizations

a) The electronic identification and authentication system automatically records, checks, authenticates, and locks the electronic identity account in cases where foreigners request to lock their own electronic identity account; foreigners violate the terms of use of the National Identification Application; foreign passports or international travel documents expire; foreigners exceed their residence period in Vietnam; or foreigners die. The recording is done through the declaration by the foreigner on the National Identification Application or through the update of information as stipulated in Article 8 of this Decree.

b) The electronic identification and authentication system automatically records, checks, authenticates, and locks the electronic identity account in cases where organizations request to lock their own electronic identity account or when they violate the terms of use of the National Identification Application, or when they are dissolved, bankrupt, suspended, or terminated according to the law. The recording is done through the declaration by the organization on the National Identification Application or through the update of information as stipulated in Article 8 of this Decree.

3. Unlocking the Electronic Identity Account

a) The electronic identification and authentication system automatically unlocks the electronic identity account when there is no longer a basis for locking the account.

Article 16. Competence to issue, lock, and unlock electronic identity account for Vietnamese citizens, foreigners, agencies, and organizations

The Director of the Administrative Police Management Department under the Ministry of Public Security has the authority to issue, lock, and unlock electronic identity accounts for Vietnamese citizens, foreigners, agencies, and organizations.

Article 17. Storage of information in the electronic identification and authentication system

1. All information about electronic identity and other information integrated into the electronic identity account shall be permanently stored in the electronic identification and authentication system.

2. All historical access information of the electronic identity account shall be stored in the electronic identification and authentication system with a minimum retention period of five years from the date of access. The account holder may exploit information about their own account's historical access; the management agency of the electronic identification and authentication system may exploit information about historical access to serve state management work; other cases shall be carried out in accordance with the provisions of the law.

Article 18. Conditions and procedures for connecting to the electronic identification and authentication system

1. State agencies, political organizations, socio-political organizations, service providers must ensure that the information systems they manage meet the minimum level 3 information system security requirements as stipulated by the law on information system security levels when connecting their information systems to the electronic identification and authentication system.

2. The connection and sharing of information as provided for in Clause 1 of this Article shall be implemented based on a written agreement between the management agency of the electronic identification and authentication system and the agency or organization managing the database or information system to be connected, specifying the scope and purpose of the connection.

3. Within thirty days from the date of the written agreement referred to in Clause 3 of this Article, the management agency of the electronic identification and authentication system shall conduct an assessment and actual inspection of the database and information system proposed for connection by the agency or organization; if the database and information system of the agency or organization have already been connected to the National Population Database, the examination and permission period for connection shall not exceed seven working days.

In case of agreement to allow connection, the management agency of the electronic identification and authentication system shall notify in writing the agency or organization and proceed to implement the connection according to the written agreement. In case of disagreement to allow connection, a written response must be given along with the reasons.

4. Agencies and organizations not covered by Clause 1 of this Article shall connect to the electronic identification and authentication system through electronic authentication service providers.

5. Electronic authentication service providers connecting to the electronic identification and authentication system to provide electronic authentication services are exempted from the procedures stipulated in this Article.

Article 19. Electronic Authentication

1. Electronic authentication of electronic identity and electronic identity account shall be conducted through the electronic identification and authentication system and the electronic identification and authentication platform as prescribed by this Decree.

2. State agencies, political organizations, socio-political organizations, and service providers may request electronic authentication through the connection and sharing of information with the electronic identification and authentication system or the connection and sharing of information with national databases or specialized databases containing the information to be electronically authenticated.

3. Organizations and individuals not covered by Clause 2 of this Article may request electronic authentication through the services of electronic authentication service providers; the implementation of electronic authentication of electronic identity and electronic identity account at the request of organizations and individuals specified in this clause must be agreed upon by the subject of electronic identity through confirmation on the National Identification Application, SMS message via the main phone number, or other confirmation methods as prescribed.

4. Organizations and individuals are not allowed to provide or share the results of electronic authentication with other organizations or individuals, except where otherwise provided by laws on personal data protection; the results of electronic authentication do not have value to become a factor of authentication in other transactions.

Article 20. Levels of Account Authentication for Electronic Identity

1. The electronic identity and authentication system provides the following levels of account authentication for electronic identity:

a) Level 01: Account authentication for electronic identity is carried out based on one factor of authentication as prescribed in Clause 7, Article 3 of this Decree and corresponding authentication means as prescribed in Clause 8, Article 3 of this Decree, without biometric information.

b) Level 02: Account authentication for electronic identity is carried out based on two different factors of authentication as prescribed in Clause 7, Article 3 of this Decree and corresponding authentication means as prescribed in Clause 8, Article 3 of this Decree, without biometric information.

c) Level 03: Account authentication for electronic identity is carried out based on two or more different factors of authentication as prescribed in Clause 7, Article 3 of this Decree and corresponding authentication means as prescribed in Clause 8, Article 3 of this Decree, including one piece of biometric information.

d) Level 04: Account authentication for electronic identity is carried out based on factors of authentication including at least one biometric factor (facial image, fingerprint, voice, iris), at least one factor owned by the subject of electronic identity (ID card, digital device, software), and one factor known by the subject of electronic identity (password; secret code; QR code).

2. For other electronic transaction accounts established by agencies, organizations, or individuals, classification and determination shall be made according to the provisions of Clause 1 of this Article, corresponding to each business process of the agency, organization, or individual, or in accordance with the specialized laws and guidance of the competent state management agency in each field.

1. Electronic authentication for online transactions is conducted through appropriate authentication means based on the level of authentication required by the online service provider.

2. In cases where account information verification is conducted at the transaction location, it shall be verified through the authentication solution provided in the national identity application.

Chapter III

ELECTRONIC AUTHENTICATION SERVICES

Article 22. Electronic Authentication Services

1. Electronic authentication services are conditional business activities.

2. Organizations providing electronic authentication services must meet the conditions stipulated in Article 23 of this Decree and obtain certification from the Ministry of Public Security confirming their eligibility to operate electronic authentication services.

3. Organizations providing electronic authentication services are responsible for publicly listing the product and service catalog they provide on the electronic identity information website.

Article 23. Conditions for Providing Electronic Authentication Services

2. Human resources conditions

a) The head of the organization or the legal representative of the enterprise must be a Vietnamese citizen residing in Vietnam;

b) The organization or enterprise must have personnel with a bachelor’s degree or higher in information security, information technology, or telecommunications responsible for providing services, managing, and operating the system, ensuring the security of the system.

3. Conditions regarding infrastructure, technical equipment, service provision management procedures, and security and order assurance plans

An organization or enterprise applying for a Certificate of Eligibility to Operate Electronic Authentication Services must submit a Business Operation Plan including the following contents: Service provision plan and procedures including a description of the information technology system; technical solution description; data storage plan, ensuring data integrity, and system information security; personal and organizational data protection plan; security and public order assurance plan; fire prevention and disaster preparedness plan, ensuring stable and uninterrupted operation of electronic authentication services; technical equipment must be located in Vietnam and must be inspected for information security in accordance with the law.

Article 24. Documents and procedures for issuing the Certificate of Eligibility to Operate Electronic Authentication Services

a) Application form for issuance of a certificate confirming eligibility to operate electronic authentication services according to Model XT01 attached to this Decree;

a) The application form for requesting the Certificate of Eligibility to Operate Electronic Authentication Services according to Model XT01 attached as Appendix to this Decree;

b) The project and relevant documents proving compliance with the conditions stipulated in Clause 2 and Clause 3 of Article 23 of this Decree.

Clause 2. Procedure and Time Limit for Resolution:

a) Organizations and enterprises submit one set of documents as prescribed in Clause 1 of this Article directly or through postal services to the Ministry of Public Security or submit the documents via the National Public Service Portal or the Ministry of Public Security's Public Service Portal;

b) In case the submitted documents are incomplete or invalid, within three working days from the date of receipt of the documents, the Ministry of Public Security shall notify the organization or enterprise in writing to supplement the documents;

c) Within three working days from the date of receipt of valid documents, the Ministry of Public Security shall seek opinions in writing from relevant ministries and ministerial-level agencies;

d) Within ten days from the date of receipt of the written opinion from the Ministry of Public Security, the ministry or ministerial-level agency shall examine, review and provide a written response to the Ministry of Public Security;

đ) Within thirty days from the date of receipt of complete and valid documents, the Ministry of Public Security shall conduct an examination and on-site inspection at the organization or enterprise and issue the Certificate of Eligibility to Operate Electronic Authentication Services according to Model XT03 attached as Appendix to this Decree to organizations and enterprises meeting the conditions; in case of refusal, a written notification must be issued stating the reasons.

Article 25. Reissuing and Amending the Certificate of Eligibility to Operate Electronic Authentication Services

1. The Certificate of Eligibility to Operate Electronic Authentication Services may be amended in cases where the organization or enterprise changes one of the following information: legal representative, registered address, trading name, plan, or procedure reviewed by the Ministry of Public Security as stipulated in Clause 3 of Article 23 of this Decree.

2. Organizations and enterprises submit one set of documents requesting to amend the Certificate of Eligibility to Operate Electronic Authentication Services to the Ministry of Public Security as prescribed in Point a, Clause 2 of Article 24 of this Decree. The application for adjustment or amendment of the certificate includes:

a) The application form for requesting to change or replace the Certificate of Eligibility to Operate Electronic Authentication Services according to Model XT02 attached as Appendix to this Decree;

b) Legal documents proving the changed information as stipulated in Clause 1 of this Article.

3. In cases where the organization or enterprise changes one of the following information: legal representative, registered address, or trading name, within ten days from the date of receipt of complete and valid documents, the Ministry of Public Security shall review and issue the Certificate of Eligibility to Operate Electronic Authentication Services to organizations and enterprises meeting the conditions; in case of refusal to amend, a written notification must be issued stating the reasons.

4. In cases where the organization or enterprise changes one of the following information: plan or procedure for providing electronic authentication services as stipulated in Clause 3 of Article 23 of this Decree, within thirty days from the date of receipt of complete and valid documents, the Ministry of Public Security shall conduct an examination, seek opinions from relevant ministries and ministerial-level agencies, conduct an on-site inspection, and issue the Certificate of Eligibility to Operate Electronic Authentication Services to organizations and enterprises meeting the conditions; in case of refusal to amend, a written notification must be issued stating the reasons.

5. The Certificate of Eligibility to Operate Electronic Authentication Services will be reissued in cases where it is lost or damaged and cannot be used. The procedures for reissuing the Certificate of Eligibility to Operate Electronic Authentication Services are as follows:

a) Organizations and enterprises submit one set of documents requesting to reissue the Certificate of Eligibility to Operate Electronic Authentication Services to the Ministry of Public Security as prescribed in Point a, Clause 2 of Article 24 of this Decree. The application for reissuance includes: the application form for requesting to change or replace the Certificate of Eligibility to Operate Electronic Authentication Services; the project and relevant documents proving compliance with the conditions stipulated in Clause 2 and Clause 3 of Article 23 of this Decree;

b) Within three working days from the date of receipt of valid documents, the Ministry of Public Security shall review and reissue the Certificate of Eligibility to Operate Electronic Authentication Services to the service provider; in case of refusal to reissue, a written notification must be issued stating the reasons.

Article 26. Revocation of the Certificate Confirming Eligibility for Electronic Authentication Services Business

1. An organization providing electronic authentication services shall have its Certificate Confirming Eligibility for Electronic Authentication Services Business revoked in the following cases:

a) Not operating continuously for six months or more;

b) Being dissolved or declared bankrupt in accordance with the law;

c) Failure to rectify violations related to personal data protection, information security, and cybersecurity as required by competent state agencies.

2. The Ministry of Public Security shall issue a decision on the revocation of the Certificate Confirming Eligibility for Electronic Authentication Services Business according to Model XT04 attached and promulgated with this Decree.

3. An organization providing electronic authentication services that has had its Certificate Confirming Eligibility for Electronic Authentication Services Business revoked shall ensure the rights and legitimate interests of electronic identity subjects and other relevant parties in accordance with the provisions of the law.

Article 27. Costs for Issuance, Use of Digital Identity Accounts, and Use of Electronic Authentication Services

1. An electronic identity subject, which is an agency, organization, Vietnamese citizen, or foreigner, shall not be required to pay costs for registering for issuance of a digital identity account established by the electronic identification and authentication system, nor for using their own digital identity account in electronic transactions.

2. Organizations and individuals utilizing electronic authentication services shall pay fees to the service provider in accordance with the law on pricing.

3. State agencies, political organizations, and social-political organizations shall not be required to pay costs when using electronic authentication services.

Chapter IV

ELECTRONIC IDENTITY CARD

Article 28. Issuance of Electronic Identity Card

1. The electronic identity card is manifested as a feature or utility of the national identification application through access to the citizen's digital identity account.

2. The electronic identity card is issued concurrently with the issuance of a level 02 digital identity account for Vietnamese citizens, and it is carried out according to the procedures and formalities stipulated in Article 10 of this Decree.

3. The use of the electronic identity card through access to the citizen's level 02 digital identity account has equivalent value to the use of the citizen's identity card or valid identity card in administrative procedures, public services, transactions, and other activities.

4. The electronic identity card is permanently stored in the electronic identification and authentication system. Historical information about the use of the electronic identity card is stored in the electronic identification and authentication system for a period of five years from the date of use.

5. The Minister of Public Security shall specify the form of manifestation of the electronic identity card on the national identification application.

1. The electronic identification and authentication system automatically records, checks, verifies, and locks the electronic identity card in the cases specified in points b, c, and d of Clause 1, Article 34 of the Identity Card Law. Recording is done through updating information into the electronic identification and authentication system as stipulated in Article 8 of this Decree.

1. The electronic identity verification system automatically reviews, checks, and unlocks electronic identity cards when there is no longer a basis to lock the electronic identity card.

Chapter V

RESPONSIBILITIES OF ORGANIZATIONS, ENTITIES, AND INDIVIDUALS

Article 31. Responsibilities of Digital Identity Subjects

1. Protect digital identity information.

2. Ensure the security of authentication factors.

3. Immediately inform the organization providing electronic authentication services if they lose control over the authentication means or discover unauthorized use of their digital identity or any other reason that may cause service usage safety issues.

Article 32. Responsibilities of Electronic Authentication Service Users

1. Adhere to technical standards for electronic identification and authentication.

2. Manage and secure account information for electronic identification, ensuring safe use of the electronic identification account.

3. Be responsible for transactions already executed and regulations of related parties concerning electronic transactions.

Article 33. Responsibilities of Organizations Providing Electronic Authentication Services and Entities, Organizations, and Individuals Creating Accounts on Their Own

1. Responsibilities of organizations providing electronic authentication services

a) Provide electronic authentication services to organizations and individuals based on service provision agreements;

b) Manage the activities of entrusted organizations supplying authentication products and services according to Clause 4 of Article 23 of this Decree;

c) Ensure continuous 24-hour, seven-day-a-week access channels for information reception and service use;

d) Comply with laws and regulations on cybersecurity, cyber security, electronic transactions, technical standards and specifications in the field of electronic authentication, information security, and ensure the accuracy of authentication; issue electronic authentication procedures and obtain approval from the identity and authentication management agency;

đ) Comply with operational plans and procedures for providing electronic authentication services that have been reviewed by the Ministry of Public Security;

e) Submit periodic reports every six months and annually about electronic authentication activities according to form XT05 attached to this Decree to the identity and authentication management agency or when requested by the identity and authentication management agency.

2. Responsibilities of entities, organizations, and individuals creating accounts for their own operations:

a) Be responsible for the accuracy of the accounts created by themselves;

b) Protect personal data collected and managed in accordance with the law;

c) Ensure the consent of the data subject in all activities related to data management, exploitation, and use;

d) Delete collected and managed data upon request of the data subject, except where otherwise provided by law.

1. Establish, manage, protect, and operate the electronic identification and authentication system; the electronic identification and authentication platform, and apply electronic identification accounts in state administration work, administrative reform, disaster prevention and control, disease prevention and control.

2. Implement state management over electronic identification and authentication. Uniformly stipulate principles and structure of foreigner identification numbers, agency and organization identification numbers.

3. Take the lead and coordinate with ministries, ministerial-level agencies in connecting national databases, specialized databases to serve electronic identification and authentication.

4. Take the lead and coordinate with the Ministry of Information and Communications, the Ministry of Planning and Investment, the Ministry of Justice, the Ministry of National Defense, the Government Office, and relevant ministries and ministerial-level agencies to conduct inspections and supervision of electronic identification and authentication activities.

5. Connect and integrate the electronic identification and authentication system with the National Public Service Portal's electronic identification exchange platform to serve account verification, administrative procedure handling, and online public service provision in accordance with the law.

6. Take the lead and coordinate with the Ministry of Information and Communications, the Ministry of National Defense, and the Government Cryptographic Agency to ensure information security for the electronic identification and authentication system.

7. Take the lead and coordinate with ministries, ministerial-level agencies, government agencies, the Government Cryptographic Agency, and provincial and centrally-administered city People's Committees to unify connection, sharing, and exploitation schemes for using digital identities, electronic identification accounts, and electronic identity cards; ensure confidentiality, security, and information security, suitable for direct administrative procedures and those conducted electronically.

8. To lead and coordinate with ministries, ministerial-level agencies, government agencies, the Government Cryptographic Agency, provincial people's committees under central cities to unify plans for connecting, sharing, and utilizing electronic identities, electronic identification accounts, and electronic identity cards provided and established by the electronic identification and authentication system; ensure information security, safety, and security, consistent with the methods of implementing administrative procedures directly and on the electronic environment.

9. To lead and coordinate with the Ministry of Justice, the Ministry of Planning and Investment, and the Ministry of National Defense to ensure connectivity, sharing, and updating of information in the national population database, the national entry-exit database, the electronic civil registration database, and the national enterprise registration database to serve electronic identification and authentication.

10. To ensure continuous operation of the electronic identification and authentication system for 24 hours a day, seven days a week.

To coordinate with the Ministry of Public Security and the Ministry of National Defense to ensure the safety and confidentiality of information for the electronic identification and authentication system.

1. To lead and coordinate with the Ministry of Public Security and relevant ministries and sectors to unify plans for connecting and sharing information from agencies and organizations in the national enterprise registration database with the electronic identification and authentication system to establish electronic identification numbers and accounts for agencies and organizations to serve electronic identification and authentication activities; ensure information security and safety.

2. To coordinate with the Ministry of Public Security in the issuance and management of electronic identification accounts for organizations and enterprises within their assigned scope, functions, and tasks.

3. To ensure the use of electronic identities and electronic identification accounts to perform administrative procedures and public administrative services on the electronic environment as prescribed by law.

Article 37. Responsibilities of the Ministry of National Defense

1. To guide subordinate agencies, units, enterprises, and individuals to implement electronic identification and authentication in compliance with regulations on state secrets protection in the defense sector.

2. To coordinate with the Ministry of Public Security to unify plans for connecting and sharing to utilize electronic identities, electronic identification accounts, and electronic identity cards provided and established by the electronic identification and authentication system.

3. To coordinate with the Ministry of Public Security to ensure information security and cybersecurity for the electronic identification and authentication system.

Article 38. Responsibilities of the Government Cryptographic Agency

1. To guide the application of civilian cryptographic standards and technical regulations and the use of specialized official digital signature certification services in electronic identification and authentication activities.

2. To lead and coordinate with the Ministry of Public Security to evaluate cryptographic security for users of electronic authentication services.

3. To coordinate with the Ministry of Public Security to ensure the security and confidentiality of information using key cryptographic products for the electronic identification and authentication system, when using electronic identities, electronic identification accounts, and electronic identity cards in providing specialized official digital signature services.

Article 39. Responsibilities of Ministries, ministerial-level agencies, government agencies, provincial People's Committees, and centrally governed city People's Committees

1. Ensure the use of electronic identity, electronic identification accounts, and electronic ID cards to perform administrative procedures and public services on an electronic environment.

2. Coordinate with the Ministry of Public Security to unify connection and sharing schemes for using electronic identities, electronic identification accounts, and electronic ID cards provided and established by the Electronic Identification and Authentication System; ensure information security.

3. Ensure stable and smooth operation of national databases and specialized databases in authentication activities according to the requirements of specialized database management agencies, state agencies, political organizations, socio-political organizations, and other organizations entrusted to implement public services.

Chapter VI

IMPLEMENTING PROVISIONS

Article 40. Effective Date

1. This Decree takes effect from July 1, 2024.

2. The Government's Decree No. 59/2022/NĐ-CP dated September 5, 2022, on electronic identification and authentication shall cease to be effective from the date this Decree takes effect.

3. Accounts created by the National Public Service Portal and the administrative procedure information system at the ministry and provincial levels for individuals shall remain valid until June 30, 2024.

4. Accounts created by the National Public Service Portal and the administrative procedure information system at the ministry and provincial levels for agencies and organizations shall remain valid until June 30, 2025.

5. Electronic identification accounts and certificates confirming eligibility to operate electronic authentication services issued according to Decree No. 59/2022/NĐ-CP dated September 5, 2022, on electronic identification and authentication shall remain valid until their expiration date as stipulated.

6. For citizens who already have Level 2 electronic identification accounts before the effective date of this Decree, the citizen identification management agency under the Ministry of Public Security shall be responsible for establishing and displaying electronic ID cards for citizens through the National Identification Application from July 1, 2024.

7. Amend and supplement Clause 1, Article 7 of the Government's Decree No. 45/2020/NĐ-CP dated April 8, 2020, on performing administrative procedures in an electronic environment as follows:

"1. Organizations and individuals performing administrative procedures on the National Public Service Portal and the administrative procedure information system at the ministry and provincial levels using electronic identification accounts established by the Electronic Identification and Authentication System, which have been connected and integrated on the National Public Service Portal and the administrative procedure information system at the ministry and provincial levels."

8. Amend and supplement Point a, Clause 1, Article 21a of the Government's Decree No. 107/2021/NĐ-CP dated December 6, 2021, amending and supplementing certain provisions of the Government's Decree No. 61/2018/NĐ-CP dated April 23, 2018, on implementing the single window mechanism in administrative procedure resolution as follows:

"a) Verify and authenticate electronic identification accounts of individuals and organizations through the individual identification number of Vietnamese citizens or the passport number (or international travel document number) of foreign nationals and organization codes on the administrative procedure information system at the ministry and provincial levels through data connection and sharing with the Electronic Identification and Authentication System. In cases where individuals and organizations do not have electronic identification accounts, staff at the Single Window Unit will guide individuals and organizations to establish or assist in creating Level 1 electronic identification accounts for citizens. In cases of delegated administrative procedure resolution, the electronic identification account shall be that of the delegating organization or individual."

1. The Ministry of Public Security is responsible for guiding, inspecting, and urging the implementation of this Decree.

2. During the implementation process, the Ministry of Public Security shall coordinate with the Ministry of Information and Communications to aggregate and handle issues within their respective spheres of state management. If necessary, report.

3. The Minister, head of a ministerial-level agency, head of a government agency, and Chairperson of the provincial or centrally governed city People's Committee shall be responsible for enforcing this Decree.