You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

January 12, 2023

Vietnam 2022 ICT Legislation Year in Review

Subscribe to Updates

The year 2022 witnessed a dynamic environment in the development of information and communications technology (ICT) policy in Vietnam. The following are some highlights of remarkable legislative developments in the ICT space from the past year, and some notes on key draft laws and regulations that are in the pipeline for 2023.

1. Telecommunications

Although it has helped Vietnam develop modern telecommunications network infrastructure and a diversified and competitive telecom market with a variety of services, Vietnam’s Telecom Law, which has been in effect since 2010, has posed problems and inadequacies in meeting today’s more complex evolution of new service types and new business models as well as the trend of convergence of telecom, information technology, and automation.

Accordingly, the Ministry of Information and Communications (MIC) has been working to replace the existing Telecom Law, with a Draft Telecom Law made available for public consultation from October 27 to December 27, 2022 (the Vietnamese version can be accessed here).

The primary amendment of the Telecom Law focuses on widening the scope of application to regulate data center and cloud computing services. Data center services include data center space rental services, server rental services, and data storage space rental services. Cloud computing services include services providing server resources, storage capacity, and networks (IaaS services); services that provide the ability to create, develop, manage, and operate software, including applications (PaaS services); and software delivery services, including applications (SaaS services).

According to the Draft Telecom Law, it could be interpreted that all providers of data center services and IaaS cloud computing services, whether onshore or offshore, must obtain a permit to provide the services by registration with the MIC via its online portal; while PaaS and SaaS cloud computing services are exempted from this requirement.

In addition, the Draft Telecom Law adds new content related to the management of OTT telecom services, or “information communication service without using telecom number storage” according to the language of the Draft Telecom Law (for example, WhatsApp, Zalo, Viber, Line, etc.). These services have not been regulated before and for a long time the MIC has attempted to regulate these services via a draft Circular on OTT telecom services, without success. This content is now put into the Draft Telecom Law but with much lighter requirements compared to the previous draft Circular. The Draft Telecom Law allows cross-border provision of OTT telecom services to Vietnam with regulations on service providers’ responsibilities in service provision as well as requirements for notification to the MIC. The content for notification includes representative name and contact information (phone, email). Forms and procedures for notification must comply with the government’s regulations.

Another new area contemplated in the Draft Telecom Law which is worthy of mention is telecom wholesale and retail services. The Draft Telecom Law supplements obligations of telecom companies with a dominant position in the market for important retail services that require state management of competition, as well as obligations of telecom enterprises providing telecom wholesale services with the aim of creating favorable conditions for enterprises to negotiate and buy telecom traffic, and to promote the wholesale market and contribute to promoting competition in the retail market through the wholesale market.

The Draft Telecom Law is scheduled to be discussed by the National Assembly in May 2023 and submitted for approval in October 2023.

2. Cybersecurity

The long-awaited Decree 53 on the implementation of the Cybersecurity Law (which took effect in 2019) was issued on August 15, 2022, with an effective date of October 1, 2022. Decree 53 provides further guidance on a number of key issues, including:

  • Data localization requirements which may create potential troubles for not only overseas enterprises but also domestic enterprises;
  • Takedown of illegal online content with corresponding responsibilities of the Ministry of Public Security (MPS), the Ministry of Defense, and the MIC;
  • Collection of electronic data relating to illegal activities in cyberspace to serve the purposes of investigation and handling of such activities according to stipulated conditions and procedures;
  • Suspension or stoppage of information system operation, and/or revocation of domain names when the operation of the information system violates the laws on national security and cybersecurity, or when the information system is being used for the purpose of infringing upon national security or social order and safety; and
  • Responsibilities of relevant stakeholders in coordinating and assisting the authorities in preventing and handling the violations, including cross-border violations.

Regarding the controversial issue of data localization requirements, it is worth noting that domestic enterprises may be impacted more than overseas enterprises.

For overseas enterprises, only those fulfilling all the following conditions are subject to the MPS’s decision to store regulated data and establish a branch or representative office in Vietnam within a grace period of 12 months:

  1. Providing services falling within 10 enumerated types of regulated services;
  2. Collecting, exploiting, analyzing, and/or processing regulated data; and
  3. Have received a warning from the Department for Cybersecurity and Prevention of High-Tech Crime (A05) under the MPS but have not taken any measures for avoiding, dealing with, fighting against, or preventing the breach mentioned in the notification, or have resisted, obstructed, or ignored requests from the relevant authorities.

For domestic enterprises, the requirements are more stringent. Without further clarification of the MPS, nearly all online domestic service providers which collect, use, analyze, and/or process regulated data are required to store the regulated data in Vietnam without triggering conditions and without a grace period. For more information of the Decree 53, please refer to our previous articles here and here.

3. Data Privacy

The government recently released Resolution 156/NQ-CP on December 6, 2022, which requires the MPS to quickly finalize the draft Decree on Personal Data Protection (draft PDPD) and submit it to the government for submission to the National Assembly Standing Committee for comments before the government promulgates it. Therefore, it is expected that the PDPD could be issued in 2023. Within 2022, there was no official updated version of the draft PDPD available for public assessment of the major changes from the previous publicly accessible version. For more information of the main content of the draft PDPD, please see our previous articles here, here, and here.

4. OTT TV Services & VOD Films

Decree 71 was issued on October 1, 2022, with an effective date of January 1, 2023, to amend the prior Decree 06 on the Management, Provision, and Use of Radio and Television Services. The new decree will have a major impact on over-the-top (OTT) television services and on-demand content (VOD) in Vietnam. Although there are still ambiguities in the wording of Decree 71, the government has expressed a clear intention to regulate the cross-border provision of foreign OTT TV services, including provision via Internet applications. Accordingly, overseas companies might no longer be eligible to provide OTT pay TV services to users in Vietnam on a cross-border basis as they are currently doing with regard to OTT VOD, but may now have to establish a company in Vietnam or cooperate with a licensed Vietnamese pay TV service provider to provide such services.

The MIC has recently taken their first moves to enforce the new requirements under Decree 71. The Authority of Broadcasting and Electronic Information (ABEI) under the MIC has announced the enforcement actions via two official letters on their website, whose main points are summarized as follows:

  • On January 5, 2023, the MIC sent an official letter to a number of foreign OTT service enterprises, requesting a report by January 15, 2023, on the plan to carry out the procedures for applying for a license to provide pay radio and television services The official letter clearly states that if the enterprises continue to maintain the current service provision and do not comply with the provisions of Decree 71 (i.e., do not establish an enterprise in Vietnam to apply for the pay TV license or do not comply with other obligations of local service providers), they will be administratively sanctioned according to the provisions of Decree No. 119/2020/ND-CP dated October 7, 2020.
  • Via official letter No. 6272/BTTTT-PTTH&TTDT dated December 31, 2022, the ABEI has also requested businesses importing, manufacturing, and distributing smart TVs in Vietnam to review the legality of pre-installing unlicensed OTT apps in smart TVs and/or including shortcut buttons on remote controls of smart TVs allowing users to easily access to unlicensed OTT apps, to ensure that they do not violate the provisions of Decree 71.

Interestingly, Decree 71 does not differentiate between provision of film-only VOD from the provision of other types of VOD, which leads to a potential inconsistency between the state management of film-only versus other types of VOD, i.e., more specifically, there may be a potential inconsistency between Decree 71 and the Cinema Law and its guiding decree, Decree No. 131/2022/ND-CP promulgated by the government on December 31, 2022 (“Cinema Decree”). We discuss the new Cinema Decree in more detail in this article.

According to Decree 71, films are specified as a type of “on-demand radio and television content,” and the provision of “on-demand radio and television content” via the internet/internet applications falls within the definition of “TV services,” which are subject to the same requirements imposed on other types of TV services, including local establishment and licensing requirements.

Under the Cinema Law and the Cinema Decree, however, there is no such requirement for foreign providers of VOD films. According to the Cinema Decree, offshore enterprises are allowed to disseminate their films in Vietnam’s cyberspace without having to establish a company in Vietnam and to obtain a license. The film disseminators must only comply with the obligation to self-rate their films according to the government’s guidance.

Given the foregoing potential inconsistency in application of Decree 71 and the Cinema Law, it is strongly recommended that the government should clearly exempt the provision of films on demand in cyberspace from the governing scope of Decree 71 and clarify that such provision is subject to the requirements under the Cinema Law and the management of Ministry of Culture, Sports and Tourism. For further information on Decree 71, please refer to our previous article here.

5. E-Commerce

The government has entrusted the MIC to draft a new Law on E-Transactions, because after 17-years, the existing law has shown shortcomings in the new era of rapid technology and e-commerce development. The Minister of the MIC emphasized that the Law on E-Transactions should be amended to reflect and fully govern current industry technologies, including those relating to the digital environment’s traditional transactions, but with varying degrees of reliability, different costs, and different complexity. The revised law must ensure a wide scope of application and lower costs and less complexity of e-transactions compared to traditional transactions.

Accordingly, the Draft Law on E-Transactions (version 4 of which is publicly accessible) widens the scope of application to attempt to cover all areas of transactions. It retains key principles of the current law, but also provides more comprehensive regulations relating to e-contracts, e-signatures/digital signatures, and data messages. Furthermore, it provides new regulations on e-certificates, trust services and information systems serving e-transactions (digital platforms). For more information, please refer to our previous article here.

The Draft Law on E-Transactions was reviewed for the first reading by the National Assembly in November 2022; however, later draft versions are not available for public access. This draft law is scheduled for approval on the second reading by the National Assembly in May 2023.

Related Professionals

Industries

Technology

Location

RELATED INSIGHTS​ 

June 23, 2026
On May 26, 2026, Thailand’s Department of Land Transport (DLT) published for public consultation a draft amendment to the Ministerial Regulation on Electronic Ride-Hailing Vehicles that would, for the first time, allow juristic persons (legal entities) to register vehicles as electronic ride-hailing cars—a right that currently belongs exclusively to natural persons, limited to one person per one vehicle. If finalized in its current form, the regulation would significantly expand the supply side of Thailand’s ride-hailing market by enabling corporate fleet operators to enter the space. The public comment period is open through June 24, 2026. Key Principles Under the Draft Regulation Under the proposed amendment, juristic persons that maintain a fleet of at least 50 vehicles will be permitted to register vehicles as electronic ride-hailing cars. This represents a fundamental shift from the current framework, which restricts registration to individual natural persons on a one-person-one-car basis. Vehicle Specifications Corporate-owned ride-hailing vehicles must meet the following requirements: Be brand new from the factory, or no more than two years old from first registration with no more than 20,000 km of use. Not be a vehicle that has been reconstructed or repaired after involvement in a serious accident affecting safety—a standard consistent with public transport vehicles (RorYor. 6). Be classified as small, medium, or large in accordance with ministerial or director-general specifications. The vehicles may be equipped with safety devices such as interior or exterior cameras (video/photo recording) and can retain the original factory color of the vehicle body (no mandatory color change is required). License Plates Corporate ride-hailing vehicles will use license plates of the same size, characteristics, and color as those for private passenger vehicles not exceeding seven seats (RorYor. 1), rather than public transport plates. Potential Impact The government has stated that the regulation is intended to: Promote
Read More
June 23, 2026
On May 14, 2026, Thailand published a ministerial regulation in the Government Gazette to prescribe measures for prevention and suppression of technology crimes. The regulation creates a comprehensive procedural framework for returning money and digital assets to victims of technology crimes. It will take effect 90 days after publication (in mid-August 2026), giving affected entities a limited window to prepare. Mandatory Reporting Obligations for Financial Institutions When a deposit account, e-money account, or digital asset wallet is frozen in connection with a technology crime, the relevant financial institution or business operator must report transaction data to the Anti-Money Laundering Office (AMLO) via AMLO’s designated electronic system. Required data elements include account numbers (sender and receiver), names, identification or passport numbers, legal entity registration numbers, phone numbers, remaining balance, damage amount, transaction reference numbers, and the bank case ID. Institutions that already share data through the information-sharing system under the emergency decree are deemed to have satisfied this reporting obligation, creating an incentive for platform participation. When the Royal Thai Police or the Department of Special Investigation seize or freeze assets related to technology crimes, they must provide AMLO with investigation reports, complaint evidence, money-trail data, and account statements. Notification and Claims Process Once the AMLO secretary-general approves verified reports of a technology crime, the account information of persons connected to the crime will be published in the Government Gazette, triggering a 90-day window for victims to file claims and for related persons to file objections. Officers will also publish details on AMLO’s electronic media and send registered mail to identified victims, which will be deemed received after 7 days domestically or 15 days internationally. Victims have 90 days from the date the crime is published in the Government Gazette to file claims through AMLO’s electronic system. Claims must include
Read More
June 15, 2026
The surge in AI development has led to a desperate demand for large, high-quality training data. However, real-world data can be expensive to collect, difficult to access, and often subject to strict privacy and regulatory constraints. Synthetic data, which consists of artificially generated records that replicate the statistical properties of real-world data without reproducing specific individuals’ information, provides an appealing solution by generating artificial datasets at scale without relying on identifiable personal information. It combines speed, cost efficiency, and regulatory compliance, making it a sensible alternative for organizations seeking to reduce risks while maintaining data utility. When properly anonymized, synthetic datasets may fall outside the scope of laws such as the EU’s General Data Protection Regulation (GDPR) or Thailand’s Personal Data Protection Act (PDPA), reducing compliance burdens while still supporting high-quality model training. However, relying on synthetic data without rigorous legal due diligence could be a strategic mistake. It replaces one set of known risks (scraping, direct privacy liability) with a new set of complex liabilities. The narrative that synthetic data is a “silver bullet” for privacy and IP compliance is dangerous and could be misleading. While synthetic data addresses data scarcity, it also introduces new legal uncertainties. Legal counsel should anticipate downstream risks arising from compromised data sources. Models trained on unlawfully obtained data may need to be decommissioned, even if their outputs appear lawful. What is synthetic data? Synthetic data refers to artificially generated information created using AI techniques such as deep learning and generative models. Instead of copying real records, it reproduces the statistical patterns and relationships found in the original dataset. Synthetic data generally falls into three categories: Fully synthetic data – Entirely new data points generated from learned patterns. The model studies the structure of the original data and produces records that resemble real-world
Read More
June 11, 2026
Thailand’s Electronic Transactions Development Agency (ETDA) has released a revised draft Electronic Transactions Act (ETA) for public hearing from May 12, 2026, to June 15, 2026. This is not merely an amendment to certain provisions of the current ETA, but a comprehensive redrafting of the entire act. The revised draft ETA introduces several significant changes from the current framework, with practical implications for businesses operating in Thailand. Unified Coverage of Public and Private Sectors The current law segregates government transactions into a separate chapter with distinct rules. The draft ETA eliminates this division, defining “transaction” to encompass civil and commercial juristic acts as well as administrative procedures, administrative contracts, and other acts of government agencies. Enhanced E-Signature Definition The definition of “electronic signature” is broadened to expressly include biometric data and refocused on identifying the signatory and demonstrating intent regarding the content of the electronic data. Shift in Burden of Proof When a party challenges the reliability of electronic data created using a “trusted electronic method” or a method prescribed by the ETDA, the burden of proof and the cost of proving unreliability shifts to the challenger. Introduction of New Digital Method Concepts The draft ETA introduces several new digital method concepts that are not currently recognized under the existing ETA framework. These include: Electronic timestamping (e-timestamp) Electronic registered delivery Electronic company seals Electronic stamp duty compliance Electronic identity authentication and verification Electronic transferable records (electronic bills of lading, promissory notes, and similar negotiable instruments) Recognition of Automated Systems and Electronic Contracting The draft ETA expressly recognizes the legal validity and enforceability of contracts formed through automated systems, including contracts concluded entirely between automated systems or between an automated system and a person. A party may not deny the binding effect of such contracts solely because no human review
Read More