In the context of increasingly widespread electronic transactions, from electronic invoices and contracts to online public services, determining the exact time when electronic data is created, digitally signed, or stored has become a crucial factor. 

In practice, when disputes arise or information needs to be retrieved, the question "when did this data come into existence?" often carries decisive legal implications.  This is where timestamping services come in – services that provide electronic evidence to confirm the time of data existence. 

Globally, this service is considered a crucial component of digital trust infrastructure; however, in Vietnam, during its early stages of development, technical and operational requirements remain fragmented, primarily based on a list of mandatory standards, and have not yet formed a unified standard.

Standardize technical and operational requirements.

The issuance of QCVN 138:2025/BKHCN aims to address this gap. The standard comprehensively specifies the technical requirements for timestamping services, while also setting strict requirements for operational procedures, control, and the responsibilities of the service provider.

According to regulations, timestamping services must meet requirements related to core technical infrastructure such as: hardware security devices (HSM), reliable time sources, monitoring and logging systems, and data backup and recovery mechanisms. These components determine the security and reliability of timestamps, especially in sensitive areas such as finance and banking, securities, online bidding, and digital record keeping.

The circular also clarifies fundamental concepts such as: timestamping service; timestamp token; timestamp issuance time; private key of the service provider; technical audit and technical audit organization. Standardizing terminology helps to unify understanding among regulatory agencies, service providers, and conformity assessment organizations, limiting legal risks during implementation.

According to Circular 51/2025/TT-BKHCN, except in cases where the service provider chooses to directly apply the provisions of the Law on Electronic Transactions No. 20/2023/QH15, organizations legally operating in the field of timestamping are responsible for reviewing and upgrading their information systems, technical processes, and personnel to fully meet the requirements of QCVN 138:2025/BKHCN before April 10, 2027.

This transitional period is considered necessary, allowing businesses to proactively invest in infrastructure, especially in sophisticated technical systems that require high costs and skilled personnel.

The Circular takes effect from July 1, 2026. From this date, Circular No. 06/2015/TT-BTTTT and Circular No. 16/2019/TT-BTTTT of the Ministry of Information and Communications on the list of mandatory standards for digital signatures and digital signature certification services will cease to be in effect. However, applications for licenses to provide timestamping services submitted before the effective date of Circular 51 but not yet licensed will continue to be considered and processed according to the old regulations, ensuring continuity in state management.

Circular No. 51/2025/TT-BKHCN will officially take effect from July 1, 2026.

Strengthening control and enhancing digital trust.

Another noteworthy point is the regulation on conformity assessment. Accordingly, the assessment of operational and control process requirements is carried out using Method 6 – management system assessment, in accordance with Circular No. 28/2012/TT-BKHCN and Circular No. 19/2025/TT-BKHCN on technical auditing of electronic signatures and trusted services.

Organizations providing timestamping services are responsible for declaring conformity, subject to inspection and supervision by state management agencies, and maintaining complete records and documents as prescribed in Circular No. 03/2025/TT-BKHCN. Conformity assessment organizations must conduct assessments and certifications according to the correct procedures and periodically report their results to the National Committee for Standards, Metrology and Quality.

According to experts, incorporating timestamping services into a unified national technical standard will contribute to enhancing the security and transparency of electronic transactions. When timestamps are strictly controlled technically and operationally, the ability to prove, trace, and resolve disputes in the digital environment will be better ensured.

The promulgation of QCVN 138:2025/BKHCN is considered a crucial piece in the ecosystem of trusted digital services in Vietnam, alongside digital signatures, electronic authentication, and electronic identification. When these services are standardized and operated synchronously, the trust of citizens and businesses in electronic transactions will be strengthened, creating a foundation for the development of the digital economy, digital society, and digital government.

In a context where digital signatures and timestamps are no longer exclusive tools of government agencies or large enterprises, but are gradually becoming the "foundation infrastructure" for the entire society, standardizing technology and operations at this time is considered an essential requirement with long-term significance for the national digital transformation process.

Center for Science and Technology Communication