Why engineers write about compliance: because in an automated shop, compliance is implemented in code. The invoice is issued by an API call, the customer data sits in your database, the chatbot logs accumulate on a schedule someone configured. Every article in this series touches a rule; this one maps them in one place — the obligations that are real, and the traps that catch sellers who assumed the software "handles it".
E-invoices: an obligation your pipeline must own
Under the Decree 123 framework and its guiding regulations, sales require electronic invoices issued through an authorised provider and transmitted to the tax authority. For an automated shop this means every completed order — storefront, TikTok Shop, marketplace where applicable — must flow into an invoicing pipeline with validation before submission and a human review queue for rejects. We detailed the build in the Shopify → MISA AMIS guide. The trap is silence: an integration that drops failed invoices without alerting turns a data-quality bug into a compliance gap that surfaces months later at audit.
Personal data: Decree 13/2023/NĐ-CP applies to you
The Personal Data Protection Decree (13/2023/NĐ-CP) is not a big-tech-only regulation. A shop holding names, phone numbers, addresses and purchase histories processes personal data, and three duties matter most in practice:
- Consent. Collect it explicitly for each purpose, record when and how it was given, and separate transactional necessity (shipping an order requires an address) from marketing (remarketing on Zalo requires its own consent — see the Zalo automation article).
- Purpose limitation. Data collected to fulfil orders is not automatically available for lookalike audiences or model training. Your architecture should make purposes visible: which systems read customer data, and why.
- Data subject requests. Customers can ask what you hold, and ask for deletion. If answering takes an engineer a week of grepping, you are structurally non-compliant. A customer-data index — one query that finds a person across orders, chat logs and marketing lists — is a half-day of work when designed early and a month when retrofitted.
Chatbot logs are personal data too
Transcripts from your customer service bot contain names, phone numbers and addresses volunteered mid-conversation. They fall under the same rules as your order database. Set a retention period, state it, and enforce it with an automated deletion job — keeping transcripts longer than your stated retention policy is one of the most common gaps we find, precisely because storage is cheap and nobody scheduled the cleanup. And when the data is sensitive enough that it should not transit a third-party AI API at all, the model can run on infrastructure you control — we cover that architecture in our local LLM and data sovereignty guide.
Messaging channels: registration is part of the stack
Reaching customers by SMS requires a registered brandname with approval lead times and per-message costs; ZNS offers a template-reviewed alternative inside Zalo. Both are regulated channels — unsolicited marketing rules apply, and opt-outs must be honoured across channels. Factor registration and template-approval timelines into project plans as dependencies, not afterthoughts.
Business structure: hộ kinh doanh or company?
Whether you operate as a business household (hộ kinh doanh) or a registered company changes your invoicing method, tax regime and accounting obligations — and therefore your automation design. A business household on presumptive tax has different invoice duties than a company doing declaration-based VAT; growth can force the transition mid-year. Two engineering consequences: build the invoicing pipeline so the issuing entity and method are configuration, not hard-coded assumptions; and never mix personal and business bank accounts. Mixed accounts break payment reconciliation (your matching jobs from the gateway article and COD đối soát cannot distinguish a customer payment from a family transfer) and destroy tax clarity at exactly the moment you need it.
Marketplaces withhold tax — reconcile accordingly
E-commerce platforms are increasingly required to withhold and remit tax on sellers' behalf. Practically: the amount a marketplace settles to you is net of fees and withheld tax, and your reconciliation must book those lines separately or your revenue figures and your tax position will both be wrong. If you sell on TikTok Shop alongside Shopify, this lands in the same settlement-matching job described in the two-storefront article.
Imported goods: labeling basics
Imported products require Vietnamese labeling — origin, importer details, and usage information as applicable to the category. For an automated listing pipeline this is a data requirement: the product record should carry label-compliance fields, and listings for imported SKUs missing them should be blocked from publishing, the same validation-gate pattern used everywhere else in the stack.
The compliance checklist
| Area | Check | Automation hook |
|---|---|---|
| E-invoices | Every completed order produces an accepted invoice | Pipeline + reject review queue, daily gap report |
| Personal data | Consent recorded per purpose; deletion requests answerable | Consent fields at capture; customer-data index |
| Chat logs | Retention period stated and enforced | Scheduled deletion job with audit log |
| Messaging | Brandname/ZNS registered; opt-outs honoured everywhere | Central opt-out store checked before every send |
| Banking | Business account only for business flows | Reconciliation alerts on unknown counterparties |
| Marketplace tax | Withholding booked separately from fees | Settlement parser with distinct ledger lines |
| Imported goods | Label data present per SKU | Publishing gate on missing compliance fields |
Make compliance a property of the system
The pattern across every section: compliance done manually decays, compliance built into pipelines persists. Validation gates, review queues, retention jobs and reconciliation ledgers are the same engineering primitives you already use for shipping and payments — pointed at obligations instead of orders.
Disclaimer: this article is engineering guidance on how to implement compliance-related workflows in software. It is not legal or tax advice. Regulations change and their application depends on your specific situation — consult a qualified Vietnamese lawyer or tax advisor for decisions about your obligations.