You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

February 17, 2012

E-Commerce in AEC: Vietnam’s Regulatory Framework

Informed Counsel

In 2010, more than 50 percent of surveyed businesses in Vietnam used electronic means, such as e-mail or websites, to carry out their trading activities. Over the past six years, Vietnam has developed a legal framework that aims to facilitate online transactions, provide confidence in their legal validity, and at the same time protect the interest of consumers. Behind this development was the commitment made by Vietnam and other ASEAN member countries to implement a harmonized legal infrastructure for e-commerce in the ASEAN Economic Community by 2015.

Background

The first e-ASEAN Reference Framework for Electronic Commerce Legal Infrastructure signed in 2001, among other things, aimed to help ASEAN members without e-commerce laws to accelerate the drafting of their own laws. These countries were advised to apply the UNCITRAL Model Law on Electronic Commerce (1996) when drafting their e-commerce laws. In 2005, Vietnam passed the Law on Electronic Transactions, which largely reflected the ideologies of the UNCITRAL Model Law.

The next step was to harmonize laws among member countries in order to facilitate free flow of goods and services. Consequently, the member states have created a Roadmap for an ASEAN Community for 2008–2015, in which member states were required to facilitate mutual recognition of foreign digital signatures in ASEAN by 2011 and to build a fully harmonized legal infrastructure for ASEAN e-commerce by 2015.

Electronic Signatures

The main vision behind the UNCITRAL Model Law on Electronic Commerce was to provide a set of laws that (1) ensured that paper documents and electronic transactions were treated equally by the law, and (2) did not discriminate between different forms of technology.

The current assessment of how well these principles have been applied in Vietnam is problematic. On the one hand, Article 11 of the Law on Electronic Transactions provides that any information in data messages cannot be disclaimed of legal validity only because such information is in the form of a data message.

On the other hand, when assessing Article 11 against provisions on e-signatures and further implementing regulations, it is questionable whether electronic transactions are treated equally with traditional transactions and whether the laws are neutral in terms of technology. Article 21 provides a broad definition of electronic signature as “created in the form of words, script, numerals, symbols, sounds or in other forms by electronic means, logically attached or associated with a data message and shall be capable of certifying the person who has signed the data message and certifying the approval by such person with respect to the content of the signed data message.” In different jurisdictions, electronic signatures are interpreted broadly and may even include a simple facsimiled signature or typed name in the e-mail. This broad definition allows foreign jurisdictions to hold various e-transactions as legally binding.

In Vietnam, Decree 26/2007/ND-CP stipulates that where the law requires a document to be signed or affixed with a seal of a body or institution, the requirement is satisfied if such a data message is signed by a digital signature. A digital signature should be distinguished from an electronic signature. Digital signatures are also called cryptographic signatures, as they use asymmetric cryptography to generate the signature. Therefore, when the law requires a seal or a signature, this requirement can only be met by a data message containing a specific technology—a digital signature, which is provided by a certified organization providing digital signature certification services in Vietnam.

However, Decree 56/2006/ND-CP on e-commerce stipulates that an e-document is regarded as having a signature of a party if the method used to identify the signatory and indicate the signatory’s approval of the signed e-document is sufficiently reliable for creating and interchanging e-documents. When reviewing the above with the implementing Circular 09/2008/TT-BCT, the interpretation follows that a consumer entering into a contract via a commercial website is not required to have a digital signature, if other methods were used to identify the consumer.

Mutual Recognition of Foreign Digital Signatures

According to Decree 26 and implementing regulations, in order for foreign signatures to be recognized as legally valid in Vietnam, the foreign digital signature certification service providers must obtain a certificate from the Ministry of Information and Communications, Obtaining this certificate is subject to conditions relating to international treaties, certification in the home country, digital signature reliability, and representative office presence in Vietnam to resolve issues.

A new regulation, Decree 106/2011, has been implemented recently to amend several provisions of Decree 26. The above requirements, however, have not been amended.

Consumer Protection

By 2011, Vietnam completed the implementation of a legal framework on consumer protection. The Law on Protection of Consumers’ Rights was passed in 2010 and implementing Decree 99/2011/ND-CP passed in late 2011. The regulations provide basic protection to consumers engaging in electronic transactions by requiring suppliers to provide certain information about the transaction to the consumer. Consumers are also given the default right to unilaterally terminate the contract if the supplier does not provide the information. The law allows disputes between consumers and organizations to be resolved by arbitration.

Conclusion

Although drastic steps have been taken to create a legal framework to regulate e-commerce in Vietnam, the implementing regulations are not always consistent with best practices. A more effective system for implementing mutual recognition of digital signatures is necessary for Vietnam to prepare for harmonization of e-commerce legal infrastructure in the AEC by 2015.

RELATED INSIGHTS​ 

July 16, 2026
Thailand’s Office of the Personal Data Protection Committee (PDPC) published a series of draft guidance documents for public consultation on July 7, 2026. Issued under the Personal Data Protection Act B.E. 2562 (2019) (PDPA), the drafts address a range of compliance issues and offer insight into the regulator’s current enforcement priorities. This article examines two of those drafts: one on lawful bases for processing personal data, and another on marketing and direct marketing. Together, they reflect the Office of the PDPC’s evolving expectations on lawful-basis selection, accountability, and the use of personal data in marketing. Organizations operating in Thailand should assess the practical implications now, before the guidance is finalized. Lawful Bases: A Structured Selection Process The draft guidance on lawful bases introduces a systematic five-step process for selecting an appropriate lawful basis for each processing activity. Organizations are expected to: Identify the processing activity involved. Assess the appropriate lawful basis. Evaluate whether the data is necessary for the processing. Conduct a legitimate interest assessment (LIA) where applicable. Ensure transparency through privacy notices. The guidance provides practical explanations and examples for each lawful basis under section 24 of the PDPA—including archiving, research, statistics, vital interests, contractual necessity, legal obligation, public task, legitimate interests, and consent—as well as the bases applicable to sensitive personal data under section 26. The aim is to promote more consistent and accurate lawful-basis selection across public- and private-sector organizations. A recurring theme throughout the guidance is that organizations should select the lawful basis that most accurately reflects the actual purpose and circumstances of the processing activity. The guidance cautions against treating consent as a default or catch-all basis where another lawful basis is more appropriate. For processing based on legitimate interests, organizations should conduct and document an LIA. Processing involving sensitive personal data may require
July 14, 2026
Thailand’s National Broadcasting and Telecommunications Commission (NBTC) has published guidelines establishing a risk-based framework for the responsible use of artificial intelligence by telecom licensees. Released on July 2, 2026, the Guidelines on the Use of Artificial Intelligence for Telecommunications Services address governance structures, ethical principles, lifecycle management, and consumer protection obligations. Scope and Legal Context The nonbinding guidelines apply to holders of telecom business licenses under Thailand’s telecom licensing laws, but only with respect to the use of AI in providing licensed telecom services. Entities without such licenses are not directly subject to the guidelines, though they may be affected as third-party AI solution providers to licensees. The guidelines supplement and should be read alongside existing laws, including the Cybersecurity Act, the Personal Data Protection Act (PDPA), the Computer Crime Act, and the NBTC Notification regarding Measures to Protect Telecommunications Service Users’ Rights Regarding Personal Data, Privacy Rights, and Freedom of Telecommunications, as well as forthcoming AI governance legislation being drafted by the ETDA. AI Governance Structure Licensees are expected to establish committees, working groups, or designated officers at both policy and operational levels to set strategic direction for AI use, formulate governance policies and tools, and oversee risk management. Roles, responsibilities, and accountability should be clearly defined for all personnel across every stage of the AI lifecycle—including for third-party AI solution providers and outsourced service providers, whose obligations should be explicitly documented in service agreements. Core Principles The guidelines identify six core principles that licensees should adhere to when deploying AI: Compliance with laws, ethics, and international standards: AI should respect privacy, dignity, and human rights, and content filtering for inputs and outputs should be considered. For example, the AI should not be designed and developed to be used in generating false information, supporting illegal activities, or causing
July 10, 2026
Vietnam has taken a significant step in regulating its e-commerce sector with the issuance of a new decree guiding the country’s recently enacted Law on E-Commerce. Decree No. 248/2026/ND-CP, issued on June 30, 2026, and taking effect the following day, addresses mandatory platform policies, registration requirements for offshore platforms, additional obligations on platform operators, and market access conditions for foreign investors. Mandatory Policy Contents The decree sets out detailed guidance on the required contents of various platform policies, covering pricing, payment, display priority, livestream sales, delivery, returns, method of service provision, and service termination and refunds. Clarification of Obligations for Platform Operators The decree provides clarification of the obligations applicable to platform operators. Notably, intermediary e-commerce platform operators with online ordering functions must: Collect specific information to implement electronic identity verification of sellers; Cooperate with regulators by reporting online through the state e-commerce management system and by blocking, suspending, or removing content upon request of a competent authority; Maintain a mechanism to store contract data, including price, product or service information, and parties’ information, for at least three years from the date of contract conclusion; and If qualifying as a “large digital platform” under consumer protection law, maintain an online system for receiving and handling complaints and requests, and comply with enhanced content-removal requirements. Registration Requirements for Offshore Platforms Offshore e-commerce platforms, whether direct-sales, intermediary, social-network-based, or integrated, that conduct e-commerce activity in Vietnam must register with the Ministry of Industry and Trade if the platform: Allows Vietnamese-language selection; Uses a “.vn” domain; or Reaches 100,000 or more transactions with Vietnam-based buyers within a calendar year. Notably, the registration requirement now captures not only traditional intermediary platforms, but also direct-sales platforms. Foreign Investment Conditions Foreign investors holding a controlling interest in an intermediary e-commerce platform, a social media platform
July 8, 2026
On July 7, 2026, the Trade Competition Commission of Thailand (TCCT) issued a press release announcing the establishment of two new subcommittees designed to intensify oversight of digital platforms and modern trade businesses. The formation of the digital platform subcommittee marks a significant escalation in competition enforcement following the TCCT’s Guidelines on Multi-Sided Platforms and E-Commerce Businesses, which took effect on March 25, 2026. Platform operators, sellers, and related service providers should expect heightened regulatory scrutiny and potential investigations into practices already flagged under the March guidelines. Two Dedicated Enforcement Bodies The first new body is the digital platform subcommittee—formally the Subcommittee on Supervision, Monitoring, and Prevention of Trade Conduct in Digital Platform Business. It is tasked with driving intensive oversight of digital platform businesses. It will coordinate with government agencies, the private sector, business operators, and other relevant stakeholders to supervise and prevent trade conduct that may affect competition, and to promote free and fair competition in the digital platform sector. The subcommittee will be composed of TCCT members and representatives from the Department of Internal Trade. The second body—the Subcommittee on Determining Guidelines and Action Plans Concerning Competition Conditions in Modern Wholesale and Retail Business—will study, analyze, and monitor market structure in modern wholesale and retail businesses, compile databases to analyze retail business concentration, assess impacts on small-scale operators, and propose supervisory measures for the retail sector. TCCT members will serve on the subcommittee alongside experts from government and private organizations, including the Office of Industrial Economics, the Office of Small and Medium Enterprises Promotion, the Thai SME Federation, and the Thai SME Council. Operational Impact for Industry Participants These subcommittees provide the TCCT with a focused mechanism to investigate various trade practices deemed unfair, and the TCCT has authority under the Trade Competition Act to issue cease-and-desist