You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

September 24, 2026

How Vietnam’s Regulatory Reforms Could Impact IP Owners

Subscribe to Updates

Vietnam is implementing and developing a broad package of regulatory reforms that could reshape how IP, data, digital platforms, and product authenticity are regulated and enforced. Several of the key measures have been led by the Ministry of Public Security in its legislative and administrative capacity, as part of a broader government effort.

The core reform package consists of four key legal instruments: proposed amendments to the Criminal Code, a proposed new Data Security Law, a draft Decree on Product Identification, Authentication and Traceability, and the newly enacted Decree No. 330/2026/ND-CP. These instruments include rules on criminal enforcement, data security, electronic identification, product identification and traceability, administrative violations, and cybersecurity sanctions. Combined, these measures will affect copyright enforcement, industrial property rights, trade secrets, AI training data, product provenance, online takedowns, valuation of counterfeit goods and electronic evidence.

It is worth noting that, in addition to strengthening criminal penalties for IP crimes, Vietnam’s emerging regulatory framework increasingly treats infringement, data misuse, product authentication, and platform-enabled violations as interconnected regulatory and enforcement challenges. For rights holders and foreign investors, this could mean stronger tools against counterfeiting and online infringement, but also more compliance obligations around data, traceability, AI, platform controls and government-facing reporting.

Expansion of Criminal IP Enforcement

Proposed amendments to Article 225 of the Criminal Code would expand criminal copyright exposure beyond reproduction and distribution to cover large-scale commercial public performance and online communication of works, phonograms and video recordings. This is important because piracy is increasingly about streaming, unauthorized communication, and platform access models rather than physical copying. Aggravated copyright infringement could be subject to up to 10 years in prison for individuals and fines of up to VND 6 billion (about USD 228,300) for commercial legal entities.

The amended Article 226 would expand criminal industrial property liability beyond trademarks and geographical indications to products or product parts infringing patents for inventions, utility solutions, or industrial designs. This goes beyond the TRIPS baseline requirement for criminal procedures for willful trademark counterfeiting and copyright piracy on a commercial scale. This expansion is notable because patent litigation in Vietnam can be lengthy, which may affect a rights holder’s ability to preserve exclusivity during the patent term, especially in sectors such as pharmaceuticals. Aggravated industrial property offenses could carry up to seven years in prison for individuals and corporate penalties of up to VND 10 billion (or about USD 380,600)

Trade Secrets, Data Assets, and AI

Trade secrets would also be covered under Article 226 of the draft Criminal Code. The impact assessment accompanying the draft states that CPTPP Article 18.78.2 requires criminal procedures and penalties for intentional and unlawful trade secret misappropriation, while Vietnam’s current Criminal Code does not directly criminalize such conduct. The draft would partially close the gap, although the relevant conduct still appears tied to production or trading of infringing products.

As a new standalone law, the draft Data Security Law would add a separate layer by recognizing lawfully created or collected data as capable of carrying ownership and exploitation rights protected under civil and IP law. The draft law also treats business secrets as internal data requiring safeguards against loss, leakage, unauthorized collection, sale or transfer.

The draft Data Security Law would require providers of AI services in Vietnam, in particular generative AI systems, to verify and clean training data to identify legally created data and protect against IP infringement, and to label AI-generated content. This would give rights holders and regulators a compliance hook where models are trained on unauthorized content or where AI output creates infringement risks.

Product Identification and Traceability as an Anti-Counterfeiting Tool

A draft decree on product identification, authentication and traceability may be highly relevant for brand owners and foreign investors. It would establish a national platform and national database for product identification, authentication, and traceability, administered by the Ministry of Public Security in its capacity as the designated government authority, and would apply to producers, processors, traders, distributors, exporters, importers, transporters, and warehouse operators for products and goods within scope. Products manufactured abroad but not consumed or traded in Vietnam would not be covered under the decree, but imported goods sold in Vietnam would be within the practical compliance area.

The platform would generate unique and decentralized identifiers (DIDs) on the national blockchain platform, enabling the creation of digital certificates and digital evidence for decentralized identification, authentication, and product traceability. Product master data would include product name, image, manufacturer or trader, address, origin, key supply-chain events, brand, trademark, batch or serial number (if any), expiry date (if any) and applicable standards. This could help brand owners build evidence against counterfeits by linking product identity, origin, logistics history, certificates and market events in one traceable system.

The compliance requirements are substantial. Producers and importers would need to create product master data, batch and packaging data, and digital-certificate-linked updates. Distributors, retailers and logistics providers would need to update circulation, storage, transportation, and delivery data. E-commerce platforms would need to provide seller identification and traceability data when requested by competent authorities. For foreign investors, this could support anti-counterfeiting, recalls, warranty management, and consumer trust, but might also require integration of product data, warehouse, logistics, invoicing, and product registration systems with a government-administered platform. Data might need to be updated in real time or within 24 hours from the occurrence of a relevant event, and investors will want strong safeguards for confidential product, logistics and technical data.

Cybersecurity Sanctions and Their Intersection with IP Enforcement

Decree No. 330/2026/ND-CP on administrative sanctions in the fields of cybersecurity and personal data protection (Decree 330), which was recently issued with immediate effectiveness on August 19, 2026, also contains IP-adjacent provisions. It refers to copyright, related rights and IP infringements in cyberspace. Relevant acts include sharing digital content that does not comply with copyright, related rights, or IP requirements; livestreaming or sharing protected content from unauthorized sources; and distributing software or mobile applications in breach of IP laws. The decree also covers AI-generated content that exploits original works without complying with IP requirements, as well as software, tools, services and platforms that facilitate IP infringement.

Decree 330 may provide an additional administrative enforcement route against piracy websites, livestreaming piracy, unauthorized software distribution, and other forms of online IP infringement. The risk, however, is possibly overlapping with existing IP sanctions. Decree No. 131/2013 already regulates copyright and related-rights sanctions, including derivative works, public performance, distribution, communication to the public, copying, internet takedown, and anti-circumvention. Decree No. 99/2013 regulates industrial property sanctions, and its 2026 amendments already add blocking access to domain names infringing industrial property rights. However, Decree 330 lacks explicit cross-references to these specialized IP regimes, raising the possibility of overlapping sanctions or inconsistent infringement assessments

Practical Impacts for Rights Holders and Foreign Investors

For rights holders, the direction is encouraging. Copyright owners may gain a stronger route for serious online piracy, brand owners may gain better tools against platform-based counterfeiting, patent owners may gain an additional enforcement avenue where civil proceedings have proven lengthy, and technology companies may see stronger protection for technical data and trade secrets.

For foreign investors, the reforms are also a compliance story. Depending on how the remaining draft instruments develop, companies selling goods in Vietnam may need to prepare for enhanced product traceability requirements, seller identification obligations, AI-related compliance measures, increased scrutiny of online content, and broader regulatory and enforcement activity in the digital environment.

The main implementation considerations include coordination among overlapping authorities, defining clear thresholds for large-scale online conduct, ensuring adequate protection of trade secrets in centralized databases, and reconciling cybersecurity sanctions with specialized IP decrees.

Outlook

Vietnam’s evolving regulatory landscape reflects a move toward a more modern and integrated framework for IP, data, and digital markets. The reform package could make enforcement faster and more evidence-driven, especially for online piracy, counterfeiting, technical data misuse, and product provenance. However, it could also introduce new compliance requirements for foreign investors and rights holders who may need to integrate internal systems with government-administered platforms and manage sensitive product and supply-chain data.

The practical value will depend on clear thresholds, proportionate platform remedies, protection of confidential business data, and effective coordination among the relevant government authorities.

Related Professionals

Industries

Consumer Products

Technology

Practices

Intellectual Property

Location

RELATED INSIGHTS​ 

September 17, 2026
Thailand’s Office of the Consumer Protection Board (OCPB) has released for public comment a draft bill to amend the Consumer Protection Act B.E. 2522 (1979), the country’s foundational consumer protection legislation. The draft amendment aims to modernize the nearly five-decade-old framework to address the rapid growth of digital commerce, online advertising, influencer marketing, and new business models. The public consultation period is open until October 10, 2026. Expanded Definitions Covering Digital Commerce The draft significantly broadens several core definitions to capture modern commercial activities: “Consumer” is expanded to include natural persons and nonprofit juristic persons who purchase or receive services, including those solicited by businesses and end users who do not directly pay for the goods or services. “Business operator” now explicitly covers advertising business operators and hired advertising persons, such as influencers and content creators. “Advertising media” is expanded to include digital platforms, social media, and social media user accounts. “Label” now encompasses electronic labels—symbols, codes, or other electronic formats displaying product information. Influencer and Advertising Disclosure Requirements In addition to these expanded definitions, “hired advertising person for selling goods or services” is a new definition covering influencers, content creators, live streamers, affiliate marketers, and virtual online media operators who receive monetary compensation or other benefits for advertising goods or services. Hired advertising persons—including influencers and content creators—must disclose to consumers that content is advertising and reveal their relationship with the business owner. Disclosure is required when the business owner employs the advertiser, pays or provides other benefits for the advertisement, or provides free or discounted products or services. These requirements apply where consumers would not otherwise know that the business has a connection to the person presenting the content. Labeling Requirements for Importers The draft introduces a clearer labeling obligation for importers of label-controlled goods, who must
Read More
September 11, 2026
Thailand’s National Broadcasting and Telecommunications Commission (NBTC) has published a new five-year master plan that will bring significant regulatory changes to the broadcasting and digital media sectors, including formal licensing requirements for internet-based audiovisual services. The Master Plan for Broadcasting and Television, 3rd Edition (B.E. 2569–2573/2026–2030) was published in the Government Gazette on September 1, 2026, and will affect OTT platforms, internet-based audiovisual service providers, and traditional broadcasters. Licensing Reform The NBTC will develop new licensing frameworks ahead of existing digital television license expirations, which are slated to occur between 2028 and 2030. This creates both uncertainty and opportunity for incumbents and new market entrants. New licensing criteria will also be developed for audiovisual services delivered over the internet, meaning previously unregulated internet-based providers may face licensing, fee, and content obligations for the first time. The plan also calls for a new law to govern converged communications services. OTT Regulation and Content Oversight The plan explicitly acknowledges and aims to lessen the regulatory asymmetry between traditional broadcasters—which are subject to licensing, fees, and content regulation—and internet-based services that currently face fewer obligations. The NBTC intends to develop regulatory frameworks to bring internet-based audiovisual services, including OTT platforms, streaming services, and user-generated content platforms, under content, consumer protection, and licensing requirements. Consumer Protection and Digital Rights The NBTC will strengthen its oversight of broadcasting, television, and telecommunications operators to ensure compliance with consumer protection and personal data protection requirements. This includes updating relevant notifications and orders and more strictly enforcing rules against practices that unfairly exploit consumers. These measures may layer NBTC-specific requirements on top of Thailand’s existing Personal Data Protection Act obligations. Stricter enforcement against practices that exploit consumers is a priority, with particular scrutiny on advertising practices. The NBTC will modernize complaint resolution processes, meaning service providers should
Read More
September 7, 2026
On September 4, 2026, Thailand’s prime minister convened the first meeting of the Data Center Business Policy Committee. The committee endorsed a draft policy framework for the data center industry and tasked four subcommittees with developing the standards that would sit beneath it, shifting away from fragmented, agency-by-agency approvals toward a unified national strategy aiming to maximize economic value while managing environmental and infrastructure concerns. Proposed Scope and Pillars of the National Data Center Policy Framework The proposed framework would cover all types of data centers, including internal or captive facilities operated within a company or its affiliates, rather than only commercial third-party providers. If adopted in this form, companies running private data centers purely for internal purposes would also become subject to regulatory oversight. Minimum safety and operational standards would be established, with uniform enforcement across all categories. The committee endorsed a draft policy framework with four key pillars: Industrial classification: Data centers exceeding 2 MW would be classified as industrial operations, which may require factory licenses and environmental impact assessments under the Factory Act. Resource pricing: Utility rates would be structured to reflect both direct and indirect costs, supporting green energy and green data center standards. Centralized screening: A centralized review would evaluate project suitability and resource allocation. Operators may be required to submit proposals through periodic “pitching” rounds, where projects are competitively assessed on their potential economic and strategic benefits to Thailand. Digital ecosystem: The framework would prioritize data sovereignty, tax incentives, and conditions promoting domestic digital businesses, AI, and cloud infrastructure. Multidimensional Evaluation Criteria and Subcommittees Four subcommittees will be established to develop standards responsible for the following dimensions: Economic: Criteria for assessing the economic viability of data center projects, for use in prioritizing data centers based on infrastructure readiness, demand type (including AI factories),
Read More
September 4, 2026
Foreign business restrictions on telecommunications, treasury center businesses, and intragroup support services were eased when Thailand published the Ministerial Regulation Prescribing Service Businesses Not Requiring Permission for Foreign Business Operations (No. 5) B.E. 2569 (2026) in the Government Gazette on August 28, 2026. The ministerial regulation expands the categories of service businesses that foreign investors may operate without a foreign business license (FBL) under the Foreign Business Act B.E. 2542 (1999) (FBA). Of particular relevance to the telecommunications, fintech, and technology sectors, the ministerial regulation exempts: Type 1 telecommunications licensees, which do not have their own networks; Treasury center businesses operated in accordance with Thailand’s exchange control regulations; and Certain intragroup administrative, human resources, and information technology management services. Telecommunications Services Foreign-owned businesses providing telecommunications services under a type 1 telecommunications license may now operate without obtaining an FBL. This may streamline market entry for qualifying telecommunications and digital infrastructure businesses. The exemption applies only to the FBA licensing requirement. Operators must continue to comply with applicable requirements under the Telecommunications Business Act and the regulations of the National Broadcasting and Telecommunications Commission, and the change does not affect foreign ownership restrictions applicable to type 2 or type 3 telecommunications businesses. Treasury Center Businesses The ministerial regulation also exempts qualifying treasury center businesses from the FBL requirement. This may facilitate centralized treasury functions in Thailand, including liquidity management, foreign exchange management, and intragroup funding arrangements. Treasury center operations remain subject to applicable requirements of the Bank of Thailand and other competent authorities. Intragroup Administrative, HR, and IT Services Certain administrative, human resources, and information technology management services provided between affiliated entities are also exempt, provided the relevant entities satisfy prescribed ownership or management criteria. The exemption is available where the service provider and recipient are related through specified ownership
Read More