You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

October 17, 2023

Two New Laws Will Impact E-Commerce Activities in Vietnam

Subscribe to Updates

On June 20, 2023, Vietnam’s new Law on Protection of Consumers’ Rights (“CPL 2023”) was officially promulgated, followed two days later by a new Law on E-Transactions (“LOET 2023”). The new laws, which will both take effect from July 1, 2024, replacing the CPL 2010 and the LOET 2005, respectively, provide new regulations for e-commerce platforms and will impact e-commerce activities in Vietnam. Some of the more significant changes are outlined below.

Law on Protection of Consumers’ Rights

Regulation of offshore entities: Previously, the CPL 2010 regulated only organizations and individuals in the territory of Vietnam. Under the CPL 2023, both onshore and offshore agencies, organizations, and individuals related to protecting consumers’ rights are regulated. In other words, Vietnam intends to monitor and manage activities of platforms with no legal presence in Vietnam.

Remote transactions: Previously, the laws on consumer protection regulated “remote contracts.” The CPL 2023 introduces and defines “remote transactions” as transactions made online, by electronic means or by other means wherein consumers cannot check or have direct contact with products, goods or services before participating in the transaction. In addition, the CPL 2023 also provides for additional responsibilities of business entities offering remote transactions such as adequately and precisely providing consumers with information when entering into these remote transactions, including the rights of consumers in case of incomplete or inaccurate provision of information and complaint handling mechanisms.

Online businesses: The CPL 2023 introduces “online businesses,” which are defined as (i) those trading products, goods, and services via their self-established platforms or digital platforms or (ii) those establishing or operating intermediary digital platforms. According to the Vietnam Competition Commission in a recent workshop, the definitions of “digital platforms” and “intermediary digital platforms” can be referred to in the LOET 2023 (see below).

Under this new category, online businesses which provide services for three months or more (defined as “continuous supply of services”) will have responsibilities similar to those engaging in remote transactions. Further, additional responsibilities apply, depending on the category:

  • Intermediary digital platforms are required to, among other things,have a mechanism to store information about their products, goods, and services and related transactions; allow consumers to access documents related to their transactions; report content censorship activities; and be responsible to consumers in Vietnam according to the law.
  • Large digital platforms are required to, among other things, monitor advertisements that use algorithms to target specific consumers and consumer groups and assess the handling of fake accounts and application of technology to the platform (such as the use of algorithmic and advertising systems and AI). A new government decree guiding the CPL 2023, currently in the draft stage, will provide the criteria for “large digital platforms.”

Law on E-Transactions 2023

Information systems serving e-transactions: An information system serving e-transactions is a combination of hardware, software, and databases established with the main purpose of serving e-transactions and ensuring the authenticity and reliability of e-transactions.

Administrators of these information systems, which are defined to capture e-commerce platforms, are responsible for, among other things, (i) complying with the provisions of the LOET 2023 and laws on network information security, cybersecurity, personal information protection, personal data protection, and other relevant laws and (ii) monitoring the safety of the information system according to the provisions of the laws on network information security.

Online businesses: The LOET 2023 provides some new definitions. In particular, a “digital platform serving e-transactions” is an information system that creates an electronic environment allowing parties to conduct transactions, provide and use products and services, or develop products and services. An “intermediary digital platform serving e-transactions” is a digital platform whose administrator is independent of the parties performing the transaction.

The LOET 2023 regulates the responsibilities of administrators of large and extremely large intermediary digital platforms.

  • Large intermediary digital platforms are required to, among other things, publish the mechanism to handle problems or content violating Vietnamese law arising in e-transactions and annually report to the Ministry of Information and Communications on incidents of taking advantage of the information system to violate Vietnamese law.
  • Extremely large intermediary digital platforms are required to, among other things, publish the basis used to make recommendations to users and allow users to opt out of such recommendations and uninstall any applications without affecting basic technical features of the system.

A new government decree guiding the LOET 2023 will detail the responsibilities of administrators of large and extremely large intermediary digital platforms based on the scale, number of users in Vietnam, or number of accesses from users in Vietnam of such platforms.

Outlook

E-commerce undoubtedly has helped consumers buy goods and services faster and more easily. However, it also poses many risks, such as the risks of having personal information taken advantage of, being scammed, or buying fake or counterfeit goods. The CPL 2023 is expected to improve the legal framework for consumer protection, especially in e-commerce and cyberspace, and the LOET 2023 will provide a complete legal environment for converting traditional transactions to the digital environment in all industries and fields, promoting efficient, safe, and reliable transactions in cyberspace. However, these laws will also create some new burdens for online businesses, who would be well advised be aware of these new requirements to prepare for them, and ensure ongoing compliance.

Related Professionals

Industries

Consumer Products

Technology

Practices

Antitrust and Competition

Location

RELATED INSIGHTS​ 

April 30, 2026
Vietnam’s Decree No. 134/2026/ND‑CP, which took effect on 9 April 2026, plays an important role in detailing and implementing Vietnam’s Intellectual Property (IP) Law in the context of rapid digital transformation and the growing application of artificial intelligence (AI). The new decree provides comprehensive guidance on the application of copyright and related‑rights regulations, addressing key issues such as authorship, ownership, statutory exceptions and limitations, registration procedures, and enforcement mechanisms. Through these measures, Decree 134 seeks to achieve an appropriate balance between safeguarding the legitimate interests of rightsholders and fostering innovation, research, and technological advancement, thereby strengthening the state’s framework for the effective management, protection, and exploitation of intellectual property in the digital and AI‑driven environment. Some notable aspects of Decree 134 are discussed below. Copyright for AI-Created Works Decree 134 provides important guidance on the determination of copyright and related rights in works created with the assistance of AI. Article 5a reaffirms the principle that human creativity remains central to copyright protection, clarifying that copyright or related rights arise only where a human makes a substantial and decisive intellectual contribution, exercises effective control over the creative outcome, and assumes responsibility for the content and its legality. At the same time, the provision confirms that AI is regarded solely as a technological tool rather than a rights‑holding subject, thus ensuring consistency with the fundamental concepts of authorship and ownership under the IP Law. By introducing requirements on transparency, proof of human contribution, and compliance with AI‑specific labelling and technical marking obligations, Decree 134 establishes a clear and enforceable legal framework for the responsible use of AI in creative activities. Lawful Use of Copyrighted Texts and Data Article 37a of Decree 134 sets out the specific conditions under which copyrighted texts and data may be lawfully used for scientific research, experimentation,
Read More
April 23, 2026
Vietnam has progressively positioned blockchain as a strategic technology within its broader digital transformation agenda over the past decade. From early policy orientations to more recent legislative developments, the regulatory approach has gradually shifted from high-level recognition to more concrete legal integration. Against this backdrop, a new draft decree regulating activities relating to product and goods identification, authentication, and traceability (the “Draft Decree”) marks a notable turning point. Rather than merely referencing blockchain as a policy priority, the Draft Decree incorporates blockchain directly into a nationwide regulatory system, positioning it as part of the underlying infrastructure for data governance and public administration in relation to the management, verification, and traceability of product-related data. Evolution of Vietnam’s Blockchain Legal Framework: The Draft Decree in Context Vietnam’s blockchain legal framework has developed in several distinct phases. The first phase, beginning around 2019, was characterized by high-level policy recognition in several resolutions of the Party Central Committee. Particularly, blockchain was identified as part of the broader category of digital technologies critical to industrial modernization and participation in the Fourth Industrial Revolution. These resolutions did not regulate blockchain directly, but established its strategic importance at the national level. The second phase (2023 to 2025) saw the introduction of national strategies and technology policies that more explicitly recognized blockchain as a priority technology. Those policies collectively signaled a clear policy commitment to developing blockchain infrastructure and applications. However, these instruments remained largely at a policy-level and did not establish binding regulatory frameworks. The third phase (from 2025) involves the gradual integration of blockchain into sectoral legislation. Laws such as the Law on Digital Technology Industry (2025), the Law on Personal Data Protection (2025), and the Law on Science, Technology, and Innovation (2025) have introduced concepts such as digital assets, crypto assets, and even specific
Read More
April 22, 2026
A new decree in Vietnam brings significant implementation clarity to the country’s existing extended producer responsibility (EPR) legal framework. An EPR mechanism was first codified in Vietnam in the 2020 Law on Environmental Protection amid ongoing challenges surrounding the collection and treatment of product and packaging waste. The mechanism was progressively detailed through Decree No. 08/2022/ND‑CP and its successive amendments, but the regulatory framework remained insufficiently developed, notably in terms of support mechanisms for waste collection, recycling, and treatment. The newly launched regulations in Decree No. 110/2026/ND-CP (Decree 110), issued on April 1, 2026, and taking effect on May 25, 2026, stipulate fully and clearly the responsibility of manufacturers and importers to recycle products and packaging and to treat waste. Some key provisions of Decree 110 for manufacturers, importers, and related stakeholders are presented below. Subjects of EPR The Law on Environmental Protection assigns responsibility to manufacturers and importers for product and packaging recycling (under Article 54) or waste collection and treatment (under Article 55), depending on the type of products and packaging they produce or import. Decree 110 elaborates on these EPR provisions by specifying the responsible entities and listing out the types of products and packaging subject to recycling and waste treatment responsibilities. Decree 110 clarifies the responsible entities in special cases, such as when products under the same brand are made by multiple manufacturers, when there is a contract manufacturing or entrusted import relationship, and when the manufacturer or importer is part of a corporate group. Notably, exemptions may be applied in some scenarios, such as for manufacturers and importers of products and packaging exclusively for export, temporary import and re-export, or research and testing purposes, as well as for entities with annual revenue from related products not exceeding VND 30 billion. Recycling Responsibilities Decree 110
Read More
April 21, 2026
Thailand’s Personal Data Protection Committee (PDPC) has launched a public consultation period on a draft notification setting out criteria for data subject access requests (DSARs). The draft notification addresses practical uncertainties in handling DSARs by introducing standardized procedural requirements for data controllers. The consultation period runs from April 16 to May 15, 2026. The notification will enter into force 30 days from the date of its publication in the Government Gazette. Key Features of the Draft Notification The draft notification covers the following key areas: Scope of information subject to access. Data controllers must enable data subjects to access at least the following upon request: (1) personal data collected directly from them; (2) personal data obtained from other sources; and (3) the source of personal data obtained from other sources without consent. Information required under section 23 of the PDPA and information that must be recorded pursuant to section 39 of the PDPA—such as the categories of personal data collected and purposes of processing—must also be made available. Submission channels and formal requirements. Data controllers must provide at least in-person and postal channels for DSARs, while electronic or other channels are optional. Requests may be made either directly by the data subject or through an authorized representative, and must be signed and include sufficient identifying information, a preferred response method, and DSAR details. Identity verification documents (and proof of authority if the request is through a representative) are required, and additional documentation may be requested for verification or communication purposes. Data controllers may use different verification methods for DSARs submitted via electronic or other channels, provided this does not create undue obstacles to the exercise of data subject rights. Verification and response timelines. Data controllers must complete preliminary verification within seven business days of receiving a request. If a
Read More