You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

February 26, 2023

Key Changes in Vietnam’s Draft Telecom Law

Subscribe to Updates

Vietnam’s Ministry of Information and Communications (MIC) has been working to replace the outdated 2009 Telecom Law with a new version more suited to today’s digital economy. A draft Telecom Law was made available for public consultation from October 27 to December 27, 2022. On January 17, 2023, the MIC submitted an amended draft (the “Draft”) to the Ministry of Justice for appraisal (the Vietnamese version of the Draft and accompanying documents in the dossier can be accessed here). The Draft is scheduled to be discussed by the National Assembly in May 2023 and submitted for approval in October 2023.

The key content and changes of the Draft as compared to the existing law are set out below.

1. Licensing Telecom Services

For domestic enterprises, the 2009 Telecom Law only provides two types of licenses—telecom network establishment licenses and telecom service business licenses—without differentiating the conditions and licensing procedures for various types of telecom services. This no longer meets management requirements and does not encourage enterprises to participate in providing new services on already existing infrastructure.

Although the Draft retains the two main types of licenses—licenses to provide telecom services with network establishment for a term of not more than 15 years; and licenses to provide telecom services without network establishment with a term of no more than 10 years—it also provides different licensing conditions for different types of telecom service provision, with three kinds of licensing: (i) individual licenses for certain enterprises with specific conditions and obligations based on telecom management objectives at the time of licensing; (ii) class licenses for businesses that meet the prescribed licensing conditions; and (iii) registration, which requires businesses only to submit registration information according to the prescribed form to be licensed.

In addition, to avoid the situation of licensed telecom network enterprises delaying or not implementing telecom network establishment as licensed, the Draft regulates that enterprises providing telecom services with network establishment must meet conditions of charter capital, network deployment, and service quality.

2. Cross-Border Provision of Telecom Services

For overseas enterprises, the Draft regulates that the provision of cross-border telecom services to users in Vietnam:

  • Must comply with the provisions of Vietnamese law and international treaties to which Vietnam is a member;
  • Must be done through a commercial agreement with a Vietnamese telecom enterprise that has been licensed to provide telecom services;
  • Requires Vietnamese licensed telecom enterprises to register a sample commercial agreement [with the competent agency], to have necessary technical plans to perform the task of controlling and ensuring information security or perform emergency prevention and/or stop providing telecom services at the request of competent agencies;
  • Must ensure the requirements for safety, national security and defense, and legitimate public policy objectives;
  • Will be guided in detail by the government.

3. OTT Telecom Services

The Draft supplements the definition of OTT telecom services (for example, WhatsApp, Zalo, Viber, Line, etc.) which are called “internet application services in telecom.” Accordingly, these services are telecom services providing the main function of sending, transmitting, receiving, and processing information between two or more telecom service users via the internet. The Draft allows cross-border provision of OTT telecom services to Vietnam with regulations on service providers’ responsibilities in service provision as well as requirements for notification to the MIC of contact information and other content. Forms and procedures for notification must comply with the government’s regulations.

Some key responsibilities of OTT telecom service providers include:

  • If it is necessary to access information, data, or features on the user’s terminal to serve the provision of services, the service provider must notify the user of the need and obtain the user’s consent prior to performing access.
  • Service providers must be responsible for service quality according to registered or announced standards; ensuring the correct, sufficient, and accurate calculation of charges under the contract for using telecom services.
  • Service providers must report periodically or at the request of the specialized telecom management agency on the operation of the enterprise, and must be responsible for the accuracy and timeliness of the content and data of the report.

With “internet application services in telecom” defined as a type of telecom service, the question arises whether it is also subject to the general requirement of cross-border provision of telecom services—i.e., that it must be through a commercial agreement with a Vietnamese telecom enterprise that has been licensed to provide telecom services. It is recommended that this ambiguity should be clarified by the MIC to avoid uncertainty and difficult implementation in the future.

4. Telecom Wholesale and Retail Services

The regulations on wholesale management in the existing Telecom Law are incomplete, and only provide interconnection and common use of essential facilities without regulations on buying and selling of telecom traffic for resale. This leads to difficulties for businesses to cooperate and negotiate with each other, and for state agencies to intervene when there is a dispute. The Draft aims at supplementing provisions to ensure that both wholesale and retail telecom markets are regulated, promoting healthy competition, and facilitating businesses to enter the telecom market to develop new services and provide a variety of telecom services, telecom application services, and other new services.

The Draft provides definitions of telecom wholesale and retail services, the obligations of telecom enterprises providing wholesale services for telecom services that require state management, the obligations of telecom companies with a dominant market position, and acts that restrict competition in the telecom sector.

One act of unfair competition which is not permitted for telecom enterprises or groups of telecom enterprises having a dominant market position, or telecom enterprises holding essential facilities, is to cross-offset telecom services.

Some key obligations of telecom wholesale service providers include:

  • Providing services with fair and reasonable tariff charges and conditions, without discriminating between service-buying enterprises, or between the enterprise’s own retail unit and service-buying enterprises for resale under the same circumstances.
  • Transparency of tariff charges, telecom standards, and technical regulations; quality of telecom networks and services.
  • Implementing the principles of price management of telecom wholesale services set out by the specialized telecom management agency when determining and adjusting prices.

5. Satellite Telecom Services

According to the MIC, the development trend of LEO (low-earth orbit) satellite services with cross-border services having the nature of collecting data, is likely to affect national defense, network security, information security, and protection of users’ personal data and interests, and at the same time compete directly with the domestic terrestrial mobile and fixed broadband services.

Currently, regulations on licensing satellite telecom services are at the decree level and there is no specific provision on how to license a foreign enterprise providing cross-border satellite services via an agreement with licensed telecom Vietnamese enterprises. Therefore, having learned from international experience, the MIC aims to regulate satellite services by including in the Draft a provision on cross-border telecom service provision (item 2 above), together with licensing conditions of domestic telecom enterprises providing telecom services with network establishment.

6. Data Center Services and Cloud Computing Services

The Draft has a new chapter on data center services and cloud computing services. Data center services are services that provide computing capacity, storage, and technical infrastructure of a data center, which is a complex consisting of a system of technical infrastructure, information infrastructure and ancillary equipment installed into the system to perform storage, processing, exchange, and central management of data of one or more organizations and individuals. Cloud computing is a service model that allows people to easily access shared computing resources (networks, servers, storage, applications, services) through a network connection anytime, anywhere, and as required. Cloud computing services are services that provides cloud computing resources, including information infrastructure, platform, and software as a service (IaaS, PaaS, SaaS) on a network environment. The Draft does not classify data center services and cloud computing services, as the previous draft did, but leaves this classification to be further regulated by the government.

The Draft regulates that the business of data center services and cloud computing services is a conditional business. This new chapter also provides general conditions for service provision, and responsibilities and obligations of service providers in ensuring compliance with storage regulations, announcement of standards and technical regulations, responsibility for service quality, protection of personal information and interests of users, ensuring network information security, and handling content that violates copyright or intellectual property rights or violates the law at the request of a competent authority. In addition, this chapter also regulates the rights and obligations of service users and establishes policies to encourage investment and development of data center services.

Interestingly, unlike the earlier draft, this Draft does not clearly regulate how offshore service providers can provide data center services or cloud computing services to users in Vietnam. The previous Draft set out that all providers of data center services and IaaS cloud computing services, whether onshore or offshore, had to obtain a permit to provide the services by registration with the MIC via its online portal; while PaaS and SaaS cloud computing services were exempted from this requirement. The latest Draft, instead, simply provides that providers of these services must meet the conditions on investment and business before providing the services to users in Vietnam, leaving further guidance to the government.

Related Professionals

Industries

Technology

Location

RELATED INSIGHTS​ 

August 15, 2025
More than a decade after the issuance of Decree No. 52/2013/ND-CP (as amended by Decree No. 85/2021/ND-CP; collectively, “Decree 52”), Vietnam’s legal framework for e-commerce is under growing pressure to keep pace with the evolving digital economy. While Decree 52 has provided a foundational framework, it has shown certain limitations in keeping up with issues such as counterfeit goods, intellectual property enforcement, unqualified products, and emerging models like livestream selling and affiliate marketing. To address these regulatory gaps, the Ministry of Industry and Trade (MOIT) has released the 2025 Draft E-Commerce Law (“Draft Law”) for public consultation. The Draft Law is intended to supersede the current framework under Decree 52 and establish a more detailed and comprehensive legal foundation for the regulations of e-commerce activities in Vietnam. It is currently expected to be submitted to the National Assembly for review and potential adoption during its 10th session in October 2025. In this article, we discuss the Draft Law’s most significant updates and legal developments in comparison to existing regulations, and assess the practical challenges that businesses may face in preparing for implementation in the near future. Platform Classification: Toward a More Nuanced Framework Unlike Decree 52’s simpler structure, which broadly categorized platforms into either (i) websites selling goods and services or (ii) websites providing e-commerce services, the Draft Law introduces a more detailed framework that aims to classify platforms based on their technical functions and business models. Specifically, the Draft Law introduces a four-tier classification system for e-commerce platforms, consisting of: (i) Direct Business Platforms, (ii) Intermediary Platforms, (iii) Social Networks with E-Commerce Functions, and (iv) Multi-Service Integrated Platforms. This approach reflects an effort to more accurately capture the complexity of today’s e-commerce landscape, including hybrid platforms such as TikTok Shop. While this approach reflects the growing complexity of
Read More
August 6, 2025
Thailand’s Digital Government Development Agency (DGA) has released drafts of two pivotal documents to guide Thai government agencies in adopting cloud technology and classifying data for cloud usage. These draft guidelines, open for public hearing through August 12, 2025, are part of the national “Go Cloud First” policy, which aims to accelerate digital transformation, improve efficiency, and ensure robust data security across the public sector. The new standards will have significant implications for both government agencies and cloud service providers operating in Thailand. Highlights of the draft guidelines are presented below. Government Cloud Usage Guidelines Cloud-first transformation: All government agencies are directed to prioritize cloud solutions for new IT projects, in line with the cabinet’s “Go Cloud First” policy. Cloud model selection: Agencies must assess their needs and select the most appropriate cloud deployment model—public, private, hybrid, or community cloud—based on the sensitivity of the data and operational requirements. Service types: The guidelines provide criteria for choosing between Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS), emphasizing the importance of using standard, non-customized services where possible. Cost management: Agencies are required to plan and separate cloud-related expenses, ensuring transparency and efficient budget allocation. Cloud migration: The guidelines outline the steps for migrating to the cloud and highlight the role of cloud service providers in facilitating the process, including supporting innovation and enabling smooth exit strategies. Procurement compliance: All cloud procurement must comply with public sector procurement laws and regulations. Only providers meeting government-mandated standards can be selected. Security and shared responsibility: The guidelines clarify the division of security responsibilities between cloud providers and government agencies. While providers manage infrastructure security, agencies remain responsible for data, application, and access controls. Legal framework: Agencies must comply with the Digital Government Administration Act, Cybersecurity
Read More
August 1, 2025
Thailand’s Personal Data Protection Committee (PDPC) announced to the press on August 1, 2025, that it had issued eight new administrative fines under Thailand’s Personal Data Protection Act B.E. 2562 (2019) (PDPA) in five cases of noncompliance by public and private entities. The enforcement actions reflect a growing commitment by the PDPC to penalize noncompliance across all sectors, regardless of organizational type or size. The total amount imposed to date was approximately THB 21.5 million (approx. USD 654,690), underscoring the financial risks tied to PDPA violations. The five cases—one involving a state agency and the remainder in the private sector—are summarized below. Case 1: State Agency Providing Online Services to the Public The order in this case stemmed from a cyberattack on a state agency’s web app, resulting in personal data of 200,000 data subjects being leaked to and sold on the dark web. The software developer was also found to have implemented no privacy by design, lacked an access control system, had no data breach prevention measures, and failed to conduct risk assessments or review existing security measures. Key noncompliance identified: Lack of appropriate security measures Weak password protection No risk assessment or ongoing review of security measures No data processing agreement with software developer that acted as data processor The state agency and the developer were each fined THB 153,120 (approx. USD 4,670). Case 2: Private Hospital This case involved a hospital that engaged an individual contractor to destroy patient medical record documents. However, the contractor stored the documents at their own premises, failed to follow the required destruction protocols, and ultimately used the medical records to wrap sweets, resulting in the leak of over 1,000 records during the destruction process. The contractor also failed to notify the hospital of the data breach. Although there was a
Read More
August 1, 2025
On July 30, 2025, Myanmar’s Cybersecurity Law No. 1/2025 came into effect with the State Administration Council’s issuance of Notification 113/2025. The law, which was enacted on January 1, 2025, aims to regulate various aspects of digital security and online activities. Below are some key provisions, implications, and penalties under the Cybersecurity Law. Extraterritorial penalties. The law contains an important provision that authorizes penalties against Myanmar citizens who are found guilty of violations, even if these occur outside the country’s borders. VPN definition and regulation. Virtual private networks (VPNs) are defined by this law as specific systems that function as backup networks by using technological means in order to ensure the safety of linking networks to each other. This definition sets the framework for subsequent regulations and penalties associated with VPN usage. The law does not restrict individuals or entities from using VPNs; it regulates VPN service providers. Penalties for unapproved VPN services. Establishing a VPN or providing VPN services without approval from the designated ministry (to be appointed later by the government) can result in significant penalties. For individuals, the punishment may be imprisonment for 1–6 months, a fine of MMK 1–10 million (approx. USD 476–4,760), or both, with the proceeds of the violation being confiscated. If the violator is a company or organization, the minimum fine will be MMK 10 million, and the proceeds will be confiscated. Government oversight. The ministry designated by the government is authorized to investigate and take control of cybersecurity services and digital platform services for national defense and security purposes, or upon request from a government department or organization in accordance with respective laws. Licensing requirements. The Cybersecurity Law introduces two types of licenses, valid for a period of 3–10 years, for (1) cybersecurity services and (2) digital platform providers. Digital platforms with
Read More