You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

October 17, 2023

Two New Laws Will Impact E-Commerce Activities in Vietnam

Subscribe to Updates

On June 20, 2023, Vietnam’s new Law on Protection of Consumers’ Rights (“CPL 2023”) was officially promulgated, followed two days later by a new Law on E-Transactions (“LOET 2023”). The new laws, which will both take effect from July 1, 2024, replacing the CPL 2010 and the LOET 2005, respectively, provide new regulations for e-commerce platforms and will impact e-commerce activities in Vietnam. Some of the more significant changes are outlined below.

Law on Protection of Consumers’ Rights

Regulation of offshore entities: Previously, the CPL 2010 regulated only organizations and individuals in the territory of Vietnam. Under the CPL 2023, both onshore and offshore agencies, organizations, and individuals related to protecting consumers’ rights are regulated. In other words, Vietnam intends to monitor and manage activities of platforms with no legal presence in Vietnam.

Remote transactions: Previously, the laws on consumer protection regulated “remote contracts.” The CPL 2023 introduces and defines “remote transactions” as transactions made online, by electronic means or by other means wherein consumers cannot check or have direct contact with products, goods or services before participating in the transaction. In addition, the CPL 2023 also provides for additional responsibilities of business entities offering remote transactions such as adequately and precisely providing consumers with information when entering into these remote transactions, including the rights of consumers in case of incomplete or inaccurate provision of information and complaint handling mechanisms.

Online businesses: The CPL 2023 introduces “online businesses,” which are defined as (i) those trading products, goods, and services via their self-established platforms or digital platforms or (ii) those establishing or operating intermediary digital platforms. According to the Vietnam Competition Commission in a recent workshop, the definitions of “digital platforms” and “intermediary digital platforms” can be referred to in the LOET 2023 (see below).

Under this new category, online businesses which provide services for three months or more (defined as “continuous supply of services”) will have responsibilities similar to those engaging in remote transactions. Further, additional responsibilities apply, depending on the category:

  • Intermediary digital platforms are required to, among other things,have a mechanism to store information about their products, goods, and services and related transactions; allow consumers to access documents related to their transactions; report content censorship activities; and be responsible to consumers in Vietnam according to the law.
  • Large digital platforms are required to, among other things, monitor advertisements that use algorithms to target specific consumers and consumer groups and assess the handling of fake accounts and application of technology to the platform (such as the use of algorithmic and advertising systems and AI). A new government decree guiding the CPL 2023, currently in the draft stage, will provide the criteria for “large digital platforms.”

Law on E-Transactions 2023

Information systems serving e-transactions: An information system serving e-transactions is a combination of hardware, software, and databases established with the main purpose of serving e-transactions and ensuring the authenticity and reliability of e-transactions.

Administrators of these information systems, which are defined to capture e-commerce platforms, are responsible for, among other things, (i) complying with the provisions of the LOET 2023 and laws on network information security, cybersecurity, personal information protection, personal data protection, and other relevant laws and (ii) monitoring the safety of the information system according to the provisions of the laws on network information security.

Online businesses: The LOET 2023 provides some new definitions. In particular, a “digital platform serving e-transactions” is an information system that creates an electronic environment allowing parties to conduct transactions, provide and use products and services, or develop products and services. An “intermediary digital platform serving e-transactions” is a digital platform whose administrator is independent of the parties performing the transaction.

The LOET 2023 regulates the responsibilities of administrators of large and extremely large intermediary digital platforms.

  • Large intermediary digital platforms are required to, among other things, publish the mechanism to handle problems or content violating Vietnamese law arising in e-transactions and annually report to the Ministry of Information and Communications on incidents of taking advantage of the information system to violate Vietnamese law.
  • Extremely large intermediary digital platforms are required to, among other things, publish the basis used to make recommendations to users and allow users to opt out of such recommendations and uninstall any applications without affecting basic technical features of the system.

A new government decree guiding the LOET 2023 will detail the responsibilities of administrators of large and extremely large intermediary digital platforms based on the scale, number of users in Vietnam, or number of accesses from users in Vietnam of such platforms.

Outlook

E-commerce undoubtedly has helped consumers buy goods and services faster and more easily. However, it also poses many risks, such as the risks of having personal information taken advantage of, being scammed, or buying fake or counterfeit goods. The CPL 2023 is expected to improve the legal framework for consumer protection, especially in e-commerce and cyberspace, and the LOET 2023 will provide a complete legal environment for converting traditional transactions to the digital environment in all industries and fields, promoting efficient, safe, and reliable transactions in cyberspace. However, these laws will also create some new burdens for online businesses, who would be well advised be aware of these new requirements to prepare for them, and ensure ongoing compliance.

Related Professionals

Industries

Consumer Products

Technology

Practices

Antitrust and Competition

Location

RELATED INSIGHTS​ 

September 24, 2025
On September 12, 2025, the Bank of Thailand (BOT) officially released its AI Risk Management Guidelines for Financial Service Providers, building upon the draft guidelines issued in June 2025. The guidelines reflect a balanced approach, encouraging innovation while safeguarding financial stability and consumer protection. The guidelines are targeted at all financial service providers, including financial institutions and special financial institutions under the Financial Institution Business Act, as well as payment providers under the Payment Systems Act. The guidelines apply to both AI systems developed in-house and those developed by third parties that are adopted for use by financial service providers. AI Risk Management Guidelines The two main pillars in managing AI risk are (1) governance of AI system implementation and (2) AI system development and security controls, consisting of the following key elements: 1. Governance Stakeholder roles and responsibilities. Boards and senior management assume accountability for decisions and operations involving AI systems, and are responsible for defining roles and responsibilities for AI oversight. This includes establishing an AI system usage policy, designating personnel responsible for AI risk management, and building awareness of AI-related risk within the organization. Organizations are expected to foster internal capabilities to use AI securely and avoid overreliance that could compromise business continuity or customer service. AI system usage policy. Policies governing AI usage should align with organizational goals, regulatory obligations, and recognized responsible AI frameworks—such as the FEAT principles (fairness, ethics, accountability, and transparency). These policies should be reviewed regularly to respond to technological advancements and evolving risk profiles. Risk management throughout the AI lifecycle. Risk management should encompass the entire AI lifecycle, from establishing risk appetite to implementing continuous risk assessment and control measures tailored to specific use cases. Financial service providers should assess risks and impacts of AI usage on operations and customer services.
Read More
September 22, 2025
On September 15, 2025, Vietnam’s Ministry of Science and Technology announced that the country will issue an updated version of its National AI Strategy (first issued in 2021) and its first-ever AI Law by the end of this year. The ministry emphasized that the AI strategy is not just a legal framework, but a commitment to embracing AI to drive Vietnam into a new era. The AI adoption plan is set as a priority of the country, and marks a significant step in shaping Vietnam’s AI governance and innovation landscape. Highlights of the plan include the following: Strategic vision. Vietnam’s ambition is to leverage AI for economic growth, social development, and global competitiveness, under the guiding principle “AI for humans – safe, autonomous, cooperative, inclusive, and sustainable.” AI as national infrastructure. The updated strategy positions AI as core national infrastructure, comparable to electricity or the internet, aiming to provide every citizen with a “personal digital assistant.” Core principles for AI legislation. The AI Law will be built around the following six core principles: Risk-based regulation Transparency and accountability Human-centric development Domestic AI autonomy AI as a driver of sustainable growth Digital sovereignty, with data, infrastructure, and AI technology being three strategic pillars Ethics and openness. A National AI Ethics Code will accompany the upcoming law, aligned with international standards but tailored to the Vietnamese context. The government emphasizes open standards and open-source development. Market development and incentives. The government plans to expand domestic AI adoption, particularly in public services and key industries. The National Technology Innovation Fund (NATIF) will allocate at least 40% of its budget to AI projects, prioritizing SMEs through vouchers for locally developed AI solutions. Background on AI Law Development Regulations on AI are found in various Vietnamese laws and regulations, notably the recently adopted Law
Read More
September 16, 2025
Thailand has enacted amended alcohol control legislation that significantly tightens restrictions on marketing and advertising, strengthens enforcement, and creates mechanisms to support the country’s tourism objectives. The Alcoholic Beverage Control Act (No. 2) B.E. 2568 (2025), published in the Government Gazette on September 9, 2025, will take effect on November 8, 2025. Key aspects of the new law are outlined below. Continuation of Sales-Hour Restrictions Sales-hour restrictions remain in effect, though now under an updated regulatory pathway. Alcohol sales are permitted only between 11:00 a.m. and 2:00 p.m. and between 5:00 p.m. and midnight, with exceptions for airport terminals, entertainment venues under the Entertainment Place Act 1966, and hotels. Despite earlier discussions about relaxing these hours, no changes have been implemented under the new law. Enhanced Seller Responsibilities Sellers are now expressly permitted to check identification cards to verify purchaser age and may assess the condition of intoxicated customers. The assessment conditions will be announced in a forthcoming notification from the director of the Department of Disease Control. Sellers who willfully or negligently violate the law and cause damage to life, health, or property face possible penalties. Alcohol Vending Machines Permitted The law allows alcohol to be sold in vending machines that can verify buyer information and comply with rules, procedures, and conditions to be prescribed by the Alcoholic Beverage Control Committee. This means the industry must await the committee’s implementing regulations before deploying such machines. Expanded Marketing and Advertising Restrictions The amended law introduces a new suite of advertising restrictions, including more detailed and expansive definitions involving marketing and promotions. “Marketing communication” is broadly defined to include any direct or indirect act of publicizing, presenting, or disseminating information about alcoholic beverages through advertising, public relations, sales promotions, sponsorships, or any other means that may induce or encourage the
Read More
September 12, 2025
On September 10, 2025, Vietnam’s National Credit Information Center (CIC) reported to the Vietnam Cybersecurity Emergency Response Team (VNCERT) a suspected significant cybersecurity incident involving unauthorized access to the CIC’s credit information database. A hacker group has claimed responsibility and allegedly posted over 160 million records for sale, including sensitive personal and financial data. Implications for Banks and Financial Institutions Companies that share customers’ or potential customers’ personal data with the CIC for credit scoring or other purposes—and continue to act as a data controller for such data—may be obligated under Vietnam’s Personal Data Protection Decree (PDPD) and related regulations to: Notify A05 (Department of Cybersecurity and High-Tech Crime Prevention) and the State Bank of Vietnam without delay. Inform affected individuals if their personal data is at risk. Recommended Actions Companies that could be impacted by this data breach should take the following actions: Conduct an internal review of CIC-related data in their systems, and identify whether and how the systems have been affected by this incident. Assess whether to notify regulators and customers/potential customers. Enhance cybersecurity controls, monitor for suspicious activity, and implement additional safeguards to prevent secondary breaches.
Read More