You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

July 26, 2021

Laos Issues E-commerce Regulations

Though online purchases of goods and services have been booming in Laos, the country’s laws and regulations have not kept pace. Providers of legal advice on these activities have therefore had to interpret laws and regulations on traditional physical retail activities instead, and apply them to online activities. However, Laos is making strides toward providing clear legal guidance for e-commerce operations by issuing legal measures to facilitate the regulation of online business activities.

For instance, on June 4, 2021, the new Decree on E-commerce No. 296/GOV (dated April 12, 2021, and published in the Lao Official Gazette on May 20) came into effect to clarify the regulatory framework for e-commerce in the country and to set requirements for electronic purchase contracts.

The decree, which applies only to operators residing or registered in Laos, regulates individuals and legal entities involved in the following activities:

  • Selling goods and services via their own electronic platform (website, program, or other instruction set);
  • Providing electronic marketplace services; and
  • Selling goods and services via electronic marketplaces.

Seller Notification Requirement

Business operators looking to sell goods or services via an electronic platform, either on their own website or application or via an electronic marketplace, must notify the relevant department of the Ministry of Industry and Commerce of their activity. (Existing operators must notify the ministry within 90 days from the decree’s effective date.) Although the chief concern of the decree is to target those whose regular activity is to sell goods and services online, the decree does not address whether those selling occasionally through an electronic marketplace still need to notify the ministry.

Documents for the notification consist primarily of the application form provided by the Ministry of Industry and Commerce, the enterprise registration certificate (i.e., proof of having registered a legal entity in Laos) or a simple ID card for individuals, a copy of the business operating license (for activities that require approval from a line ministry), and a copy of a contract with a payment service provider for payment via an electronic platform. Upon receipt of the necessary documentation, the ministry’s relevant departments or agencies will certify the notification within three working days. This certificate is valid for two years, and must be renewed thirty days before its expiry.

Electronic Marketplace Registration

Electronic marketplaces must be operated via an incorporated legal entity, which means an Enterprise Registration Certificate is a necessary prerequisite to operating an electronic marketplace in Laos. As for technical requirements, electronic marketplaces must obtain a Ministry of Technology and Communications certificate confirming their “technical conformity.” (The process and requirements for obtaining this certificate may be the subject of guidance that is yet to be issued.)

Similar to the grace period for the notification requirement mentioned above, existing electronic marketplace operators have 90 days (from June 4, 2021) to request authorization from the ministry. Upon receipt of the necessary documentation, the ministry’s relevant departments will consider and provide its authorization within five working days. This authorization is valid for three years, and must be renewed thirty days before its expiry.

Foreign Restrictions

Foreign shareholders cannot hold more than 90 percent of the shares of the legal entity operating an electronic marketplace, and the registered capital must be at least LAK 10 billion (approx. USD 1.05 million).

It is important to note that this decree does not replace existing laws and regulations that address certain types of goods or services sold, for which licensing, notification, minimum investment, and other requirements may apply. For instance, foreign participation in the provision of retail and wholesale services in Laos is limited under the Decision on Retail and Wholesale Business. Under this decision, a foreign shareholder who holds up to 50% of the shares in a retail or wholesale business must invest at least LAK 4 billion (approx. USD 423,350). Between LAK 10 billion (approx. USD 1.05 million) and less than LAK 20 billion (approx. USD 2.1 million) a foreign shareholder may hold 70% of the legal entity, while a foreign shareholder must invest at least LAK 20 billion to hold 100% of the shares of the marketplace’s legal entity conducting retail and wholesale services. Similar restrictions are likely to apply for online retail and wholesale businesses.

Transparency

The decree requires business operators of electronic platforms to disclose information on their platforms and activities, as well as on the goods and services sold. Accordingly, information on the business operator, such as its name, address, contact details, and Enterprise Registration Certificate or the relevant operating license, must be displayed on the electronic platform.

Descriptions of goods or services should note the product specifications (size, color, aspect, and so on) following the product labels as applicable, and product-related information such as origins, prices, return and warranty policies, related fees (e.g., shipment and payment methods), and terms and conditions. In addition, information on customers’ “satisfaction and opinion” concerning the goods and services must be displayed on the corresponding electronic platform. The decree also emphasizes that information on the goods or services offered must be realistic and portray products’ actual characteristics.

Product Liability

The decree also addresses liability for the goods and services sold, deeming electronic selling platforms and sellers on electronic marketplaces legally responsible for the goods and services they sell online.

The decree does not assign similar legal responsibility to entities operating electronic marketplaces on which the goods or services are sold. However, electronic marketplace operators are prohibited from authorizing or ignoring the sale of prohibited goods or services on their electronic marketplaces. Accordingly, they  must take a proactive role in the inspection of goods and services sold.

E-commerce Contracts

According to the decree, which endeavors to cover e-commerce contracts specifically (as opposed to electronic contracts more generally), there are two types of e-commerce contracts.

First, e-commerce contracts made via an “online ordering function” are defined as agreements between seller and client for the sale, purchase, or exchange of goods or services, made by electronic means via the online ordering function of an electronic platform created by the “owner of the electronic platform.” Essentially, this means e-commerce contracts that cover transactions made on electronic platforms (other than electronic marketplaces), and assumes that they use electronic means of payment.

The second type of e-commerce contract is one made “via social media,” which is a term in the decree that the regulator interprets as also covering electronic marketplace contracts for the sale, purchase, or exchange of goods or services.

The decree stipulates that the offering of either type of e-commerce contract is governed primarily by the rules provided in the electronic platform’s terms and conditions. Upon acceptance of the offer by the seller, the e-contract will be deemed formed. The offer will be nullified if the seller does not respond within 12 hours (unlike the 15 days for a traditional contract in writing), unless otherwise stipulated in the terms and conditions of the electronic platform. The client may also cancel its offer before receiving a response from the seller.

Both types of e-commerce contracts must remain accessible to clients after the transaction, (e.g. through archives and purchase histories).

For e-commerce contracts made via the online ordering function of an electronic platform (not on an electronic marketplace), the electronic platform must have a system that allows clients to review, add, amend, confirm, or cancel an offer before formally submitting it by means of the online ordering function. In case of cancellation by the client, electronic platforms must provide clients with evidence that the notification to cancel the contract was sent.

Conclusion

E-commerce activities in Laos have typically had to rely on extensive interpretation of laws that were not made to address e-commerce. The new e-commerce decree discussed in this article is an example of how the government is working to update the regulatory framework to sustain promising high-tech sectors such as e-commerce, fintech, and others. As Laos remains a relatively untapped market in these areas, the Decree on E-commerce eases both local and international investors’ concerns about launching operations by clarifying some key issues. The decree does not address sanctions for noncompliance, and questions remain regarding some of the mandatory requirements (such as the “technical requirements”) to register an electronic marketplace. Therefore, in its current state full implementation of the decree may require subsequent guidance from the authorities.

RELATED INSIGHTS​ 

May 13, 2024
On May 2, 2024, Vietnam’s Ministry of Justice published on its online platform the most recent version of the draft decree on administrative sanctions for violations in the field of cybersecurity (“Draft Sanction Decree”) to gather feedback and contributions from the community and stakeholders. After receiving the Ministry of Justice’s assessment, the Ministry of Public Security (“MPS”), in charge of drafting the Draft Sanction Decree, may make further revisions before submitting it to the government for review and final decision on enactment. The decree is expected to have an effective date of June 1, 2024. The stringent penalties for infringements involving personal data of the previous draft version remain in this Draft Sanction Decree—a sign of the proactive stance of the MPS in enforcing the Personal Data Protection Decree (“PDPD”). Effective Date and Transitional Provisions It is important to note that the Draft Sanction Decree does not impose any new obligations on organizations or individuals, and only sets out the administrative sanctions that could be imposed on violators as soon as June 1, 2024, which is indicated as the effective date in Article 49. This signals the MPS’s eagerness to begin taking enforcement actions against recalcitrant organizations and individuals that have not complied with the various obligations imposed on them under the Law on Network Information Security (enacted in 2015), the Law on Cybersecurity (enacted in 2018) and its guiding decree (Decree 53 – enacted in 2022), and the most recent PDPD (enacted in 2023). Article 50.1 of the Draft Sanction Decree outlines the transitional provisions regarding administrative violations in the cybersecurity field. It clarifies that the decree does not have retroactive effect, by stating that violations occurring before its effective date, but discovered or under review after such effective date will be subject to the regulations on administrative
May 9, 2024
As non-cash payments continue to surge in Vietnam, the requirement for strong security standards and a clear legislative framework for intermediary payment services (“IPS”) is becoming more and more critical. Recognizing this, the State Bank of Vietnam (“SBV”) has been working on a draft decree to supersede the outdated Decree No. 101/2012/ND-CP dated November 22, 2012, on non-cash payments (“Draft Non-Cash Payment Decree”), which will lay the groundwork for non-cash payments in general and the provision of IPS in particular. Building upon this, the SBV recently issued a draft circular to replace Circular No. 39/2014/TT-NHNN dated December 11, 2014, on IPS (“Circular 39”) (“Draft IPS Circular”), which will offer more detailed guidance on the provision of IPS in Vietnam on top of the Draft Non-Cash Payment Decree. The Draft IPS Circular will be applicable to (i) IPS providers; (ii) foreign organizations providing IPS in Vietnam; and (iii) organizations and individuals involved in the provision of IPS. Some key updates regarding the Draft IPS Circular are as follows: Scope of Application The Draft IPS Circular sets out further guidance for the provision of IPS as listed under the Draft Non-Cash Payment Decree, including: (i) electronic clearing services; (ii) electronic wallet (“e-wallet”) services; (iii) collection and payment support services; (iv) financial switching services; (v) international financial switching services; and (vi) electronic payment gateway services. Notably, the Draft IPS Circular has explicitly excluded from its scope of application the provision of accounts by goods/service providers to their customers solely for the purpose of payment within the systems of such providers (e.g., cards/coupons or service/transaction accounts of online game service providers, transportation service providers, or securities companies, etc.). Requirements on the Provision of IPS Electronic Clearing Services: The Draft IPS Circular introduces regulations to cover certain elements of electronic clearing services that have
May 9, 2024
On April 29, 2024, Thailand’s Office of the Personal Data Protection Committee (PDPC) issued the master plan for personal data protection, which outlines the PDPC’s strategies for developing and enhancing the data protection framework in Thailand from 2024 to 2027. A draft of this four-year plan had previously been released for a public hearing on November 27, 2023. Overview The master plan sets out the long-term direction for the protection of personal data in Thailand, analyzing the current landscape, challenges, and obstacles encountered since the full enactment of the Personal Data Protection Act B.E. 2562 (2019) (PDPA). It aims to align with Thailand’s National Security Policy and Plan for 2024–2027 and focuses on key sectors in its initial two years. These sectors are: Public security and key government services; Retail and e-commerce; Information and communication technology and telecommunications; Finance, investment, and insurance; Public health; Tourism; and Education. Objectives The master plan’s goals include increasing organizational compliance with the PDPA, reducing data breaches, updating the PDPA to reflect current circumstances, introducing various PDPC e-services, and enhancing Thailand’s global competitiveness in data privacy and personal data protection. It sets targets and indicators of the plan’s success, such as achieving a 100% PDPA compliance rate across all sectors in Thailand and raising Thailand’s digital competitiveness to at least 30th in the World Digital Competitiveness Rankings from the IMD World Competitiveness Center. Strategic Initiatives To achieve these objectives, the master plan introduces four strategic initiatives: Effective and balanced PDPA enforcement: Develop standards, principles, criteria, tools, indicators, and data privacy governance, including law enhancements. A recent example of this is the PDPC’s launch of the Personal Data Protection Surveillance Centre (PDPC Eagle Eye) to monitor data breaches. Knowledge and trust enhancement: Build human capacity and trust by enhancing knowledge through initiatives like the forthcoming
May 3, 2024
Vietnam’s Ministry of Public Security (MPS) recently published on its website a dossier of the Draft Law on Data (the “Draft Law”) for public feedback, initiating a consultation period from February 26 to March 26, 2024. The dossier comprises a Policy Impact Assessment Report and a Summary Report on the implementation of existing legal documents governing data. An outline of the Draft Law was later circulated to relevant organizations for their input and commentary. The MPS drafted this legislation with several objectives, including bolstering national data infrastructure, advancing digital government while streamlining administrative procedures, fostering growth in the digital economy and building a digital society, and establishing a National Data Center. Comprising 65 articles across 6 chapters, the Draft Law is slated for implementation on January 1, 2026. The Draft Law currently is very preliminary, resembling a framework document. It features numerous provisions akin to policy mandates, yet only presents introductory concepts without further elaboration. Scope of Application The Draft Law applies to agencies, organizations, and individuals involved in data activities in Vietnam. This scope of application appears excessively broad and ambiguous, without a clear definition of “data activities”, leaving uncertainty regarding the breadth of this term’s coverage. Key Policy Groups The Draft Law focuses on four key policy groups: 1. Regulations on development, processing, and management of data This policy group focuses on matters relating to the collection, digitalization, and creation of data; assurance of data quality; data classification; data storage; data combination, adjustment, and updating; data strategy; data management; data sharing; provision of data to state agencies; data analysis and synthesis; data verification and authentication; data disclosure; access and retrieval of data; data encryption and decryption; data copying, transmission, and transfer; data revocation, deletion, and destruction; application of science and technology in data processing; identification and management