Vietnam TISI Expands Data Sandbox Exemption for Kiosk Tech

On May 11, 2026, Vietnam’s Institute of Standards and Industrial Research (TISI) updated its Implementation Rules on Data Localization for Kiosk Technology, introducing a data sandbox exemption for Sino-Vietnamese joint entities holding both China’s CCRC Level 3 (or higher) and Vietnam’s VNCERT Level 2 certifications. This development directly affects enterprises in smart cultural tourism, hospitality digital services, and self-service terminal deployment—particularly those operating or supplying kiosks for scenic area guidance and hotel check-in systems.

Event Overview

On May 11, 2026, the Vietnam Institute of Standards and Industrial Research (TISI) issued an update to the Kiosk Tech Data Localization Implementation Rules. Under the revised rules, Sino-Vietnamese joint entities that hold both China’s Cybersecurity Capacity Evaluation Certification (CCRC) at Level 3 or above and Vietnam’s National Center for Information Security Certification (VNCERT) at Level 2 are fully exempted from mandatory pre-export sandbox simulation testing for user behavior data. The policy took effect immediately and applies specifically to smart cultural tourism guide terminals and hotel self-check-in kiosks.

Industries Affected by This Policy Change

Channel Distributors in Vietnam

Channel distributors—including local system integrators, hospitality technology resellers, and tourism infrastructure providers—are directly impacted because the exemption eliminates the average 45-day data compliance lead time previously required before deploying kiosk solutions. Their ability to accelerate project timelines depends on partnering with qualified Chinese solution providers holding the dual certification.

Chinese Solution Providers (Hardware + Software Integrators)

Chinese vendors offering end-to-end kiosk systems—including hardware OEMs, firmware developers, and cloud-based service platforms—face new market access conditions. Without both CCRC Level 3+ and VNCERT Level 2, they cannot qualify for the exemption, limiting their competitiveness in time-sensitive Vietnamese deployments.

Joint Venture & Consortium Operators

Entities structured as formal Sino-Vietnamese joint ventures—or certified consortiums registered under applicable Vietnamese commercial law—are the only operational models explicitly recognized under the exemption. Standalone foreign subsidiaries or informal partnerships do not qualify, even if technically compliant.

What Relevant Enterprises or Practitioners Should Focus On

Monitor official TISI guidance on dual-certification verification procedures

While the exemption is effective, TISI has not yet published detailed criteria for validating joint entity status or cross-recognition of CCRC/VNCERT credentials. Enterprises should track TISI’s forthcoming technical notices or FAQs—especially regarding documentation requirements for consortium registration and certificate submission formats.

Confirm eligibility of existing or planned kiosk deployments

The exemption applies only to devices used in smart cultural tourism guidance and hotel self-check-in contexts. It does not extend to other kiosk applications (e.g., banking, government services, retail). Companies must verify whether their current or planned product scope falls within the defined use cases before assuming applicability.

Distinguish between regulatory signal and immediate operational readiness

Analysis shows this exemption reflects TISI’s prioritization of interoperability and trusted bilateral certification frameworks—but it does not replace broader Vietnamese data protection obligations under Decree 13/2023/ND-CP. Entities remain responsible for lawful data collection, storage, and processing; the sandbox waiver applies solely to outbound simulation testing for user behavior data.

Prepare documentation and alignment with Vietnamese partners early

Because joint entity qualification requires coordinated certification maintenance, Chinese suppliers should initiate alignment with Vietnamese partners on documentation workflows—including bilingual audit reports, certificate validity windows, and renewal coordination cycles—well ahead of project tendering or contract signing.

Editorial Perspective / Industry Observation

Observably, this update functions less as a broad deregulatory shift and more as a targeted facilitation mechanism for vetted, certifiably secure cross-border tech delivery. From an industry perspective, it signals growing institutional recognition of aligned cybersecurity evaluation standards between China and Vietnam—but only within narrowly defined technical and operational boundaries. Current implementation remains contingent on verifiable joint certification status and strict use-case alignment. Therefore, the policy is better understood as an operational enabler for specific projects rather than a structural easing of Vietnam’s data localization regime.

In summary, this TISI update introduces a concrete, conditional pathway to accelerate kiosk deployment in Vietnam’s tourism and hospitality sectors—yet its utility is tightly bound to certification rigor, joint-entity structure, and precise functional scope. It does not represent a general relaxation of data governance requirements, nor does it extend to adjacent verticals or uncertified actors. For stakeholders, the most pragmatic interpretation is that it lowers one procedural barrier—not a systemic one—and only for those already positioned within the dual-certification framework.

Source: Official announcement by Vietnam Institute of Standards and Industrial Research (TISI), dated May 11, 2026; referenced document: Implementation Rules on Data Localization for Kiosk Technology (revised edition). Note: Verification procedures for dual certification and consortium validation remain pending formal publication and are subject to ongoing observation.