Using Vietnamese public company data responsibly: sources, freshness and personal data limits

Vietnam publishes a useful core of company data: registered name, tax code, address, legal representative, business lines, registration date, managing tax office and tax code status. It comes from two official systems — business registration and tax registration — and can be looked up one company at a time. Used carefully, it supports supplier onboarding, credit decisions, market sizing and compliance checks. Used carelessly, it produces confident conclusions from records that are months out of date, and it can cross the line into mishandling personal data.

This guide is for finance teams, compliance officers and analysts who rely on Vietnamese company data, whether they look it up themselves or buy it from a provider. It covers where each field comes from, how fresh it is likely to be, what to do when a record is wrong, and the rules that apply to the personal information inside company records.

Two official sources, and why they sometimes disagree

Company data in Vietnam has two official origins:

For companies the enterprise code and the tax code are the same number, and the two systems exchange data. Still, they are updated by different events, so at a given moment they can disagree: a company can show as active in business registration and as not operating at its address in the tax record, or have a new address in one system a few days before the other. When the two disagree, the difference is itself information. Record both, with the date, and ask the counterparty.

Anything beyond these fields — revenue, employees, credit scores, "risk ratings" — comes from somewhere else: the company's own statements, filings made for other purposes, surveys or a provider's estimates. Treat those figures according to their real source, not as official data.

How fresh is the data you are looking at?

Official lookups show the current record, but "current" means as of the last event someone recorded. Three kinds of lag matter:

• Company lag. Companies are required to register changes, but many are slow. An office move can take months to appear.
• Authority lag. A tax office may take time to record the outcome of a verification visit. Statuses such as 06 therefore trail reality, sometimes by weeks.
• Copy lag. A database you bought, or a list your team exported last year, is a snapshot. Any record in it may have changed since.

2026 adds a fourth factor. Since 1 July 2025 Vietnam has 34 provinces and no district level, and many records still carry addresses in the earlier format. And the tax code clean-up campaign under Official Dispatch 18/CĐ-CT of 13 July 2026 began with a review list of 617,462 enterprises (the July 2026 list), so statuses are being updated in bulk. Any company dataset older than mid-2026 should be treated as stale for status and address fields.

The practical rule: for a decision that matters — a payment, a credit limit, a contract — look up the record on the day, from the official source, and keep a dated copy.

What the data can support, and what it cannot

Public company data answers identity questions well and quality questions poorly.

• It can support: confirming a company exists; matching the name and code on contracts and invoices; identifying the legal representative; checking whether the business lines fit the transaction; checking whether the tax code is recorded as active; finding the managing tax office.
• It cannot support: conclusions that a company is "clean", "safe", "fraudulent" or "in debt"; judgements about solvency; statements about how a company treats its suppliers or employees.

This matters most when data is turned into scores or labels. A model that marks every company with a recent address change as "high risk" will be wrong for thousands of companies that simply moved office. If you publish or share such labels, you also take on the risk of stating something about a named company that the underlying data does not support. Keep outputs close to the facts: "status recorded as 06 on this date" is defensible; "fraudulent supplier" is not.

Using the data for customer credit decisions

Sales teams in foreign-invested companies often use company data to decide whether to sell on credit. The public record helps with the first half of that decision — is this the company it claims to be, and is it recorded as operating — but it says nothing about ability to pay. A workable approach combines three layers:

• Identity and status from official sources, looked up on the day the credit limit is set and again before it is raised.
• Behaviour from your own ledger: payment history, disputes, returned goods. For existing customers this is the best predictor you have.
• Information the customer provides: financial statements, references, guarantees, with the source noted.

A status change on an existing customer is a trigger to review the limit, not an automatic write-off. And remember that the record of a newly registered customer is thin by nature; start with a small limit or payment in advance rather than reading meaning into the absence of data.

When a record is wrong

Official records are sometimes simply wrong: a misspelled name, an address that was never updated, a status that should have changed. The fix depends on who holds the error:

1. If it is your own company's record, correct it at the source. Business registration details are corrected through the business registration authority; tax registration details through the managing tax office. Circular 90/2026/TT-BTC is the current circular on tax registration; read it or ask your adviser for the exact procedure.
2. If it is a counterparty's record, ask the counterparty to correct it and meanwhile record the discrepancy and their explanation in your file. Do not "fix" official data in your own systems by overwriting it; keep the official value and your note side by side.
3. If it is a provider's copy, report it to the provider and check whether the official source is already correct. Many errors in bought datasets are simply old snapshots.

For a Vietnamese-language overview of what company information is public and how to request corrections, see ThueSo.com.

Personal data inside company records

Company records contain information about people: the legal representative's name, sometimes owners' names, and in registration files more detailed personal information. The fact that a name is visible in a public lookup does not mean every use of it is unrestricted. Vietnam has personal data protection rules that apply to collecting, storing and using personal information, including by companies based abroad that process data about people in Vietnam.

Sensible practice for foreign-invested companies and data users:

• Collect what the purpose needs. Verifying a signatory needs the name and authority; it rarely needs a full copy of the person's ID card forwarded around a team.
• Keep personal data out of bulk exports and marketing lists unless you have a lawful basis for that use.
• Restrict access to onboarding files that contain identity documents, and set a retention period.
• Take advice before building a product on Vietnamese company data that includes individuals, especially one that is resold or published.

Identifiers for individuals changed recently as well: since 1 July 2025 the personal identification number is used in place of a separate personal tax code. That number is sensitive; do not store it where a company tax code would do.

Building a reliable internal record of counterparties

Most foreign-invested companies do not need a large dataset. They need a vendor and customer master that is right for the few hundred companies they actually deal with. A reliable setup has five parts:

1. One key. The 10-digit tax code, or 13-digit code for a dependent unit, as the unique identifier. Never the name.
2. Official values, dated. Name, address, legal representative, status and managing tax office as looked up, with the lookup date.
3. Your own facts, separate. Contacts, bank accounts, payment terms, performance notes — kept in different fields from the official ones.
4. A refresh rule. Re-check before large payments and on a regular cycle; flag any record not checked within the cycle.
5. A change log. When an official value changes, keep the old value and the date. The history is often more useful than the current value.

A set-up like this costs little and does most of what a paid "risk score" promises, with the advantage that every statement in it can be traced to a dated official record.