You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

January 6, 2025

New Decree Provides Guidance on Vietnam’s Telecom Law

Subscribe to Updates

On December 24, 2024, the government of Vietnam issued Decree No. 163/2024/ND-CP, providing guidelines for implementing the new Telecommunications Law that took effect on July 1, 2024 (“Decree 163”). This new decree replaces Decree No. 25/2011/ND-CP and its amendments (“Decree 25”) and took effect immediately upon issuance, with regulations on data center services, cloud computing services, and basic telecom services over the internet (“over-the-top” or OTT telecom services) having an official effective date of January 1, 2025.

Decree 163 introduces substantial changes across the telecom sector, covering various aspects including service provision, licensing, standards and technical regulations, quality, passive infrastructure planning, dispute resolution, and more. Hence, it is necessary for enterprises to conduct a compliance review to identify gaps between the new decree and their business models, and take necessary steps to ensure lawful business operations in Vietnam.

Below are some highlights of Decree 163.

Expanded Scope of Services

For basic telecom services, Decree 163 has introduced machine-to-machine (M2M) communication and classified it as a basic telecom service. This establishes a regulatory framework for IoT device communication, previously unregulated in Decree 25.

For value-added telecom services, in light of the new Telecommunications Law, Decree 163 provides more detailed regulations for new telecom services such as data center services, cloud computing services, and OTT telecom services, which were not addressed in Decree 25.

Regulation of Three New Telecom Services

Expanding on the Telecommunications Law’s definitions of data center services, cloud computing services, and OTT telecom services, Decree 163 applies a light-touch management approach to regulate these three new services, as follows:

  • Offshore providers: Cross-border service providers are exempt from signing commercial agreements with licensed local telecom companies. They only need to notify the Vietnam Telecommunications Authority (VNTA) using the prescribed procedures and forms before offering services.
  • Onshore providers: The foreign ownership cap is removed, allowing 100% foreign-owned enterprises in Vietnam. OTT telecom and cloud computing providers must notify the VNTA while data center providers must register with the VNTA before providing services.

Management of Subscriber Information

Decree 163 allows subscribers to register their information online via telecom providers’ applications and strengthens mobile subscriber information management to prevent fraud and ensure accuracy.

Telecom enterprises must comprehensively verify subscriber identities by:

  • Matching identity document details with the National Population Database.
  • Using a one-time authentication code (OTP) sent to a previously registered SIM for registering and activating additional SIMs.
  • Implementing video call verification to collect, verify, and confirm customer identification to ensure the same accuracy as in-person verification.

Outlook

Decree 163 tackles modern challenges, including emerging services, subscriber fraud, and cross-border service provision, offering clearer guidance compared to Decree 25. While the government aims to foster fair competition, efficient infrastructure, and consumer protection, Decree 163 also signals increased regulatory oversight in the telecom sector.

Related Professionals

Industries

Technology

Location

RELATED INSIGHTS​ 

February 10, 2026
Data center and cloud investments are forming a major focus of private-sector investment in Thailand, with tech giants like Amazon, Google, Microsoft, and TikTok, as well as numerous telecom and data center companies, committing significant outlays to data center and cloud development. The country’s Board of Investment (BOI) approved projects worth THB 1.87 trillion in 2025, and THB 746 billion of this was from planned data center investments—by far the largest amount from any single industry. Thailand’s swift rise as a regional data center hub is fueled by surging demand for cloud, AI, and digital services, as well as large-scale investments from global tech firms. The country’s strategic location, competitive power costs, robust fiber infrastructure, expanding IT talent, and supportive government policies—including BOI incentives and streamlined approvals—have made it an attractive destination for scalable and sustainable digital infrastructure investments. The BOI’s proactive approach in updating promoted categories and providing both tax and non-tax incentives further ensures Thailand’s continued growth in this sector. 2025 BOI Changes for Data Centers In the middle of 2025, the BOI responded to the remarkable trend by updating investment‑promotion categories across various sectors (e.g., machinery and electrical equipment, public utilities, digital and innovative industries) to accommodate growing investment in data‑center projects. Before the change, which was detailed in a notification that has applied to investment promotion applications submitted from July 1, 2025, onward, data‑center projects under BOI promotion were granted a single A1 incentive (an eight‑year corporate income‑tax exemption) and subject to one uniform set of conditions. The July 2025 notification restructured promotion for data centers into two categories based on power‑usage efficiency: high‑efficiency data centers and other data centers. Under these rules, qualified high‑efficiency data centers are eligible for an eight‑year corporate income tax (CIT) exemption, while for other data centers this exemption is
Read More
February 4, 2026
On November 18, 2025, Vietnam’s Ministry of Finance released for public consultation a draft decree on administrative sanctions in the field of crypto assets and crypto asset markets (the “Draft Decree”), intended to implement Resolution No. 05/2025/NQ-CP dated September 9, 2025, on the pilot crypto asset market in Vietnam (“Resolution 05”). While Resolution 05 sets out who may participate and under what conditions, the Draft Decree addresses a more practical question for market participants, i.e., what happens if those conditions are not met. In doing so, the Draft Decree offers important insight into how Vietnamese regulators intend to supervise, discipline, and ultimately shape the crypto market during the pilot phase. Regulatory Scope and Overall Sanctions Architecture The Draft Decree applies to both domestic and foreign organizations and individuals engaging in crypto-related activities in Vietnam’s market. Covered entities include: (i) crypto asset issuers; (ii) crypto asset service providers, including trading platforms and market operators; (iii) Vietnamese and foreign investors participating in the pilot market; and (iv) other organizations involved in the offering, issuance, or provision of crypto-related services in Vietnam. The breadth of this scope is deliberate. It appears to reflect a regulatory view that cross-border structures, offshore platforms, and indirect participation may not necessarily insulate market actors from compliance obligations once they operate within the pilot framework. For the crypto industry, this may mark a shift from regulatory ambiguity toward a more explicit articulation of jurisdictional reach. At first glance, the Draft Decree’s monetary penalties appear restrained. The maximum fine per administrative violation is capped at VND 200 million (approx. USD 7,700) for organizations and VND 100 million (approx. USD 3,800) for individuals. However, focusing solely on fine levels risks missing the point. The Draft Decree also places great regulatory weight on supplementary sanctions and corrective measures, including: (i)
Read More
January 30, 2026
Thailand’s Data Privacy Day 2026, hosted by the Office of the Personal Data Protection Committee (PDPC), underscored the country’s commitment to strengthening personal data protection, advancing regulatory maturity, and preparing organizations for the next phase of PDPA enforcement. The event marked a clear shift from policy-level compliance toward “Privacy in Action,” signaling that operational readiness and real-world implementation are now priorities. The Office of the PDPC also emphasized that data protection is now a national economic enabler that supports digital trust, competitiveness, and sustainable growth, not just a compliance obligation. The following insights summarize the key takeaways from the Data Privacy Day 2026 event. PDPA in Real Life: What Happens to Your Data Today The Office of the PDPC provided concrete data on enforcement trends and real-world compliance issues facing organizations across Thailand. Complaints and trends. The Office of the PDPC’s Personal Data Protection Act (PDPA) Center recorded 2,672 PDPA-related complaints as of January 2026, with the highest volumes involving failure to comply with the data minimization principle, collection without lawful basis, and use and disclosure without lawful basis. Administrative penalties. Several administrative penalties have been imposed on data controllers and data processors across various sectors, including government, healthcare, retail, SMEs and e-commerce, ranging from tens of thousands to several million baht. Most violations stemmed from weak security measures, failure to notify data breaches within the required timeline, absence of a data protection officer (DPO) when required, and noncompliance with governance requirements such as the Record of Processing Activities (ROPA) and data processing agreements with data processors. Case studies. The Office of the PDPC highlighted specific examples of violations: Hospitals misused personal data for purposes beyond their intended scope (e.g., using personal data collected for providing medical services to send birthday cards) Vendors compromised systems due to inadequate password
Read More
January 29, 2026
Following the recent enactment of a comprehensive legal framework addressing sexual harassment, Thailand has launched a fast-track judicial process enabling victims of online sexual harassment to obtain court orders suspending and removing obscene content from the internet. On January 26, 2026, the Office of the Judiciary introduced the “Take It Down” procedure through the Court Integral Online Service (CIOS) platform, providing victims with their first direct, expedited pathway to halt the spread of online content that violates the new legal provisions against sexual harassment. This new remedy stems from section 284/4 of the Penal Code, introduced through the Act Amending the Penal Code (No. 30) B.E. 2568, which took effect on December 30, 2025. Under section 284/4, an injured person or a competent official may petition the court to suspend dissemination of violating data and remove the data from computer systems within a court-specified period. The court may also direct system controllers, service providers, or competent authorities to carry out the order and report back within 15 days. Filing through the CIOS Platform The CIOS platform serves as the primary electronic channel for these petitions. Key features include: Individuals can file online without appearing in person and may submit petitions at any time the system is available. Users must complete digital identity verification via the ThaID application to access the CIOS. Petitions under section 284/4 are limited to requests to suspend or remove violating content. Claims for monetary damages must be pursued separately, including via separate proceedings or prefiling mediation. Streamlined Review Process The submission workflow is end-to-end electronic, and the system provides step-by-step guidance. After submission, court staff review the petition before presenting it to a judge for consideration. The court may conduct an online inquiry to obtain additional information, and in-person attendance is required only if deemed
Read More