You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

December 24, 2019

Update on the Implementation of Vietnam’s New Cybersecurity Law and Status of Implementing Decrees

Subscribe to Updates

Vietnam’s new Cybersecurity Law was promulgated on June 12, 2018 and came into effect on January 1, 2019, with a majority of its provisions enforceable from the effective date. However, there are still certain provisions of the law which need to be further guided by implementing regulations and guidelines. There are currently draft guidelines under consideration, including:

  • A decree to implement in detail some provisions of the law, which includes guidance on the important and controversial article 26 on data localization (to guide articles 10.4, 12.5, 23.1, 24.7, 26.4 and 36.5, among others);
  • A decree to regulate in detail the procedures for application of cybersecurity protection measures (to guide article 5.2 of the law); and
  • A decision of the prime minister on promulgation of the list of national security information systems (to guide articles 10.3 and 43.3 of the law)

As of the time of writing this update, none of the three proposed regulations has been promulgated. The draft decree that most concerns industry insiders is the first, which regulates data localization. The draft is now in the Office of the Government for consideration and approval but there has been no official news as to when it will be issued. Although there was some indication earlier in 2019 that the Government was expected to pass the decree by the end of the year, an unofficial source said that it appears to have now been delayed to Q1 of next year, 2020. The latest accessible version of the draft decree is the version dated August 21, 2019.

The Ministry of Public Security’s (MPS’s) process of drafting this decree has demonstrated the ministry’s willingness to be open to industry and public consultation, because the issues surrounding the data localization requirement have generated significant concerns and numerous comments from international organizations and companies. According to reports, up to September 2019, the MPS sent 216 letters to relevant ministries and agencies, both at the central and local levels, as well as organizations and experts for comments. Based on these consultations, the MPS has made some changes. For example, it made changes to the specifications of different types of data that needs to be stored in Vietnam and added more services which will give rise to a data localization requirement. In addition, the MPS reduced the number of conditions that trigger data localization from four to just three (in particular, leaving out the ambiguous condition of letting service users continue to carry out prohibited acts). However, it is still uncertain whether the final version the government will pass will be much different from or improve this version.

It is worth re-emphasizing that the most problematic provision of the Cybersecurity Law is article 26.3, which relates to the requirements of data localization. The article states:

“Domestic and foreign enterprises providing services on telecommunication networks or the internet or value-added services in cyberspace in Vietnam with activities of collecting, exploiting, analyzing, and processing personal information data, data on the relationships of service users, or data generated by service users in Vietnam must store such data in Vietnam for the period prescribed by the government. Foreign enterprises mentioned in this clause must open branches or representative offices in Vietnam.”

The draft decree has narrowed down this broad language. Based on the draft decree, storing data and/or having branches or representative offices in Vietnam is required for foreign service providers only for the protection of national security, social order and safety, social ethics and health of the community, and when there are legal bases for a full determination on the three following factors:

  • Such enterprise provides regulated services:
  • Such enterprise carries out activities of collecting, exploiting [using], analyzing and processing the regulated types of data; and
  • Such enterprise has been warned that the services it provides are used to commit a breach of the laws of Vietnam and it does not take any measures for avoiding, dealing with, fighting against or preventing such breach, or resisted, obstructed, or ignored requests from the relevant authorities.

Regulated services include: telecom services; services of data storage and sharing in cyberspace; supply of national or international domains to service users in Vietnam; e- commerce; online payment; intermediary payment; service of transport connection via cyberspace; social networking and social media; online electronic games; and services of providing, managing or operating other information in cyberspace in the form of a message, phone call, video call, email or online chat.

Regulated types of data include:

  • Data on personal information of service users in Vietnam, including data with information in the form of symbols, writing, numbers, images, sounds or similar forms in order to accurately determine the identity of any one person;
  • Data generated by service users in Vietnam, including account names for use of services, duration of use of services, credit card information, email addresses, IP addresses for the latest login and logout, and registered telephone numbers attached to the account or data relevant to the data on personal information of service users; and
  • Data on the relationships of service users in Vietnam, including friends, and groups with which the users connect or interact.

Relevant authorities include the Department for Cybersecurity and Prevention of High-tech Crime under the Ministry of Public Security and/ or the Cyber Task Force, which comprises the Department for Cybersecurity and Prevention of High-tech Crime under the Ministry of Public Security and the Cyber Operations Command under the Ministry of National Defense.

If an enterprise were required to store data or have a branch or representative office in Vietnam, it would receive an MPS decision requiring it to store data and/or establish a branch or representative office in Vietnam. Within six months from the date of the MPS’s decision, the enterprise must complete the storing of data and/or establishing of a branch or representative office in Vietnam. Compared to the previous draft, this draft has significantly shortened this period from 12 months to six months, which is a disadvantage for enterprises. The period for storing data will start from the date on which the enterprise receives a request for storage of data until such request ends. The period for the storage of data will be at least 12 months. The period for having a branch or representative office in Vietnam will start from the date on which the enterprise receives a request until the enterprise no longer operates in Vietnam or provides regulated services in Vietnam.

How has the Cybersecurity Law affected foreign service providers since it came into effect nearly 12 months ago? Clearly, foreign service providers now face more risks if they do not take steps to restrict sensitive content or respond to takedown requests. According to reports, a senior official at the Ministry of Information and Communications recently commented that foreign companies’ compliance relating to content issues has greatly increased. For example, according to the official, cooperation with takedown requests in some areas related to content has increased from 20-30% to nearly 80-90%. In addition, the official added that it is also expected that the enforcement of the Cybersecurity Law will result in greater compliance among service providers when the authorities request them to provide service users’ identities if a violation of the law is detected.

Related Professionals

Industries

Technology

Location

RELATED INSIGHTS​ 

July 16, 2026
Thailand’s Office of the Personal Data Protection Committee (PDPC) published a series of draft guidance documents for public consultation on July 7, 2026. Issued under the Personal Data Protection Act B.E. 2562 (2019) (PDPA), the drafts address a range of compliance issues and offer insight into the regulator’s current enforcement priorities. This article examines two of those drafts: one on lawful bases for processing personal data, and another on marketing and direct marketing. Together, they reflect the Office of the PDPC’s evolving expectations on lawful-basis selection, accountability, and the use of personal data in marketing. Organizations operating in Thailand should assess the practical implications now, before the guidance is finalized. Lawful Bases: A Structured Selection Process The draft guidance on lawful bases introduces a systematic five-step process for selecting an appropriate lawful basis for each processing activity. Organizations are expected to: Identify the processing activity involved. Assess the appropriate lawful basis. Evaluate whether the data is necessary for the processing. Conduct a legitimate interest assessment (LIA) where applicable. Ensure transparency through privacy notices. The guidance provides practical explanations and examples for each lawful basis under section 24 of the PDPA—including archiving, research, statistics, vital interests, contractual necessity, legal obligation, public task, legitimate interests, and consent—as well as the bases applicable to sensitive personal data under section 26. The aim is to promote more consistent and accurate lawful-basis selection across public- and private-sector organizations. A recurring theme throughout the guidance is that organizations should select the lawful basis that most accurately reflects the actual purpose and circumstances of the processing activity. The guidance cautions against treating consent as a default or catch-all basis where another lawful basis is more appropriate. For processing based on legitimate interests, organizations should conduct and document an LIA. Processing involving sensitive personal data may require
Read More
July 14, 2026
Thailand’s National Broadcasting and Telecommunications Commission (NBTC) has published guidelines establishing a risk-based framework for the responsible use of artificial intelligence by telecom licensees. Released on July 2, 2026, the Guidelines on the Use of Artificial Intelligence for Telecommunications Services address governance structures, ethical principles, lifecycle management, and consumer protection obligations. Scope and Legal Context The nonbinding guidelines apply to holders of telecom business licenses under Thailand’s telecom licensing laws, but only with respect to the use of AI in providing licensed telecom services. Entities without such licenses are not directly subject to the guidelines, though they may be affected as third-party AI solution providers to licensees. The guidelines supplement and should be read alongside existing laws, including the Cybersecurity Act, the Personal Data Protection Act (PDPA), the Computer Crime Act, and the NBTC Notification regarding Measures to Protect Telecommunications Service Users’ Rights Regarding Personal Data, Privacy Rights, and Freedom of Telecommunications, as well as forthcoming AI governance legislation being drafted by the ETDA. AI Governance Structure Licensees are expected to establish committees, working groups, or designated officers at both policy and operational levels to set strategic direction for AI use, formulate governance policies and tools, and oversee risk management. Roles, responsibilities, and accountability should be clearly defined for all personnel across every stage of the AI lifecycle—including for third-party AI solution providers and outsourced service providers, whose obligations should be explicitly documented in service agreements. Core Principles The guidelines identify six core principles that licensees should adhere to when deploying AI: Compliance with laws, ethics, and international standards: AI should respect privacy, dignity, and human rights, and content filtering for inputs and outputs should be considered. For example, the AI should not be designed and developed to be used in generating false information, supporting illegal activities, or causing
Read More
July 10, 2026
Vietnam has taken a significant step in regulating its e-commerce sector with the issuance of a new decree guiding the country’s recently enacted Law on E-Commerce. Decree No. 248/2026/ND-CP, issued on June 30, 2026, and taking effect the following day, addresses mandatory platform policies, registration requirements for offshore platforms, additional obligations on platform operators, and market access conditions for foreign investors. Mandatory Policy Contents The decree sets out detailed guidance on the required contents of various platform policies, covering pricing, payment, display priority, livestream sales, delivery, returns, method of service provision, and service termination and refunds. Clarification of Obligations for Platform Operators The decree provides clarification of the obligations applicable to platform operators. Notably, intermediary e-commerce platform operators with online ordering functions must: Collect specific information to implement electronic identity verification of sellers; Cooperate with regulators by reporting online through the state e-commerce management system and by blocking, suspending, or removing content upon request of a competent authority; Maintain a mechanism to store contract data, including price, product or service information, and parties’ information, for at least three years from the date of contract conclusion; and If qualifying as a “large digital platform” under consumer protection law, maintain an online system for receiving and handling complaints and requests, and comply with enhanced content-removal requirements. Registration Requirements for Offshore Platforms Offshore e-commerce platforms, whether direct-sales, intermediary, social-network-based, or integrated, that conduct e-commerce activity in Vietnam must register with the Ministry of Industry and Trade if the platform: Allows Vietnamese-language selection; Uses a “.vn” domain; or Reaches 100,000 or more transactions with Vietnam-based buyers within a calendar year. Notably, the registration requirement now captures not only traditional intermediary platforms, but also direct-sales platforms. Foreign Investment Conditions Foreign investors holding a controlling interest in an intermediary e-commerce platform, a social media platform
Read More
July 8, 2026
On July 7, 2026, the Trade Competition Commission of Thailand (TCCT) issued a press release announcing the establishment of two new subcommittees designed to intensify oversight of digital platforms and modern trade businesses. The formation of the digital platform subcommittee marks a significant escalation in competition enforcement following the TCCT’s Guidelines on Multi-Sided Platforms and E-Commerce Businesses, which took effect on March 25, 2026. Platform operators, sellers, and related service providers should expect heightened regulatory scrutiny and potential investigations into practices already flagged under the March guidelines. Two Dedicated Enforcement Bodies The first new body is the digital platform subcommittee—formally the Subcommittee on Supervision, Monitoring, and Prevention of Trade Conduct in Digital Platform Business. It is tasked with driving intensive oversight of digital platform businesses. It will coordinate with government agencies, the private sector, business operators, and other relevant stakeholders to supervise and prevent trade conduct that may affect competition, and to promote free and fair competition in the digital platform sector. The subcommittee will be composed of TCCT members and representatives from the Department of Internal Trade. The second body—the Subcommittee on Determining Guidelines and Action Plans Concerning Competition Conditions in Modern Wholesale and Retail Business—will study, analyze, and monitor market structure in modern wholesale and retail businesses, compile databases to analyze retail business concentration, assess impacts on small-scale operators, and propose supervisory measures for the retail sector. TCCT members will serve on the subcommittee alongside experts from government and private organizations, including the Office of Industrial Economics, the Office of Small and Medium Enterprises Promotion, the Thai SME Federation, and the Thai SME Council. Operational Impact for Industry Participants These subcommittees provide the TCCT with a focused mechanism to investigate various trade practices deemed unfair, and the TCCT has authority under the Trade Competition Act to issue cease-and-desist
Read More