You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

January 12, 2023

Vietnam 2022 ICT Legislation Year in Review

Subscribe to Updates

The year 2022 witnessed a dynamic environment in the development of information and communications technology (ICT) policy in Vietnam. The following are some highlights of remarkable legislative developments in the ICT space from the past year, and some notes on key draft laws and regulations that are in the pipeline for 2023.

1. Telecommunications

Although it has helped Vietnam develop modern telecommunications network infrastructure and a diversified and competitive telecom market with a variety of services, Vietnam’s Telecom Law, which has been in effect since 2010, has posed problems and inadequacies in meeting today’s more complex evolution of new service types and new business models as well as the trend of convergence of telecom, information technology, and automation.

Accordingly, the Ministry of Information and Communications (MIC) has been working to replace the existing Telecom Law, with a Draft Telecom Law made available for public consultation from October 27 to December 27, 2022 (the Vietnamese version can be accessed here).

The primary amendment of the Telecom Law focuses on widening the scope of application to regulate data center and cloud computing services. Data center services include data center space rental services, server rental services, and data storage space rental services. Cloud computing services include services providing server resources, storage capacity, and networks (IaaS services); services that provide the ability to create, develop, manage, and operate software, including applications (PaaS services); and software delivery services, including applications (SaaS services).

According to the Draft Telecom Law, it could be interpreted that all providers of data center services and IaaS cloud computing services, whether onshore or offshore, must obtain a permit to provide the services by registration with the MIC via its online portal; while PaaS and SaaS cloud computing services are exempted from this requirement.

In addition, the Draft Telecom Law adds new content related to the management of OTT telecom services, or “information communication service without using telecom number storage” according to the language of the Draft Telecom Law (for example, WhatsApp, Zalo, Viber, Line, etc.). These services have not been regulated before and for a long time the MIC has attempted to regulate these services via a draft Circular on OTT telecom services, without success. This content is now put into the Draft Telecom Law but with much lighter requirements compared to the previous draft Circular. The Draft Telecom Law allows cross-border provision of OTT telecom services to Vietnam with regulations on service providers’ responsibilities in service provision as well as requirements for notification to the MIC. The content for notification includes representative name and contact information (phone, email). Forms and procedures for notification must comply with the government’s regulations.

Another new area contemplated in the Draft Telecom Law which is worthy of mention is telecom wholesale and retail services. The Draft Telecom Law supplements obligations of telecom companies with a dominant position in the market for important retail services that require state management of competition, as well as obligations of telecom enterprises providing telecom wholesale services with the aim of creating favorable conditions for enterprises to negotiate and buy telecom traffic, and to promote the wholesale market and contribute to promoting competition in the retail market through the wholesale market.

The Draft Telecom Law is scheduled to be discussed by the National Assembly in May 2023 and submitted for approval in October 2023.

2. Cybersecurity

The long-awaited Decree 53 on the implementation of the Cybersecurity Law (which took effect in 2019) was issued on August 15, 2022, with an effective date of October 1, 2022. Decree 53 provides further guidance on a number of key issues, including:

  • Data localization requirements which may create potential troubles for not only overseas enterprises but also domestic enterprises;
  • Takedown of illegal online content with corresponding responsibilities of the Ministry of Public Security (MPS), the Ministry of Defense, and the MIC;
  • Collection of electronic data relating to illegal activities in cyberspace to serve the purposes of investigation and handling of such activities according to stipulated conditions and procedures;
  • Suspension or stoppage of information system operation, and/or revocation of domain names when the operation of the information system violates the laws on national security and cybersecurity, or when the information system is being used for the purpose of infringing upon national security or social order and safety; and
  • Responsibilities of relevant stakeholders in coordinating and assisting the authorities in preventing and handling the violations, including cross-border violations.

Regarding the controversial issue of data localization requirements, it is worth noting that domestic enterprises may be impacted more than overseas enterprises.

For overseas enterprises, only those fulfilling all the following conditions are subject to the MPS’s decision to store regulated data and establish a branch or representative office in Vietnam within a grace period of 12 months:

  1. Providing services falling within 10 enumerated types of regulated services;
  2. Collecting, exploiting, analyzing, and/or processing regulated data; and
  3. Have received a warning from the Department for Cybersecurity and Prevention of High-Tech Crime (A05) under the MPS but have not taken any measures for avoiding, dealing with, fighting against, or preventing the breach mentioned in the notification, or have resisted, obstructed, or ignored requests from the relevant authorities.

For domestic enterprises, the requirements are more stringent. Without further clarification of the MPS, nearly all online domestic service providers which collect, use, analyze, and/or process regulated data are required to store the regulated data in Vietnam without triggering conditions and without a grace period. For more information of the Decree 53, please refer to our previous articles here and here.

3. Data Privacy

The government recently released Resolution 156/NQ-CP on December 6, 2022, which requires the MPS to quickly finalize the draft Decree on Personal Data Protection (draft PDPD) and submit it to the government for submission to the National Assembly Standing Committee for comments before the government promulgates it. Therefore, it is expected that the PDPD could be issued in 2023. Within 2022, there was no official updated version of the draft PDPD available for public assessment of the major changes from the previous publicly accessible version. For more information of the main content of the draft PDPD, please see our previous articles here, here, and here.

4. OTT TV Services & VOD Films

Decree 71 was issued on October 1, 2022, with an effective date of January 1, 2023, to amend the prior Decree 06 on the Management, Provision, and Use of Radio and Television Services. The new decree will have a major impact on over-the-top (OTT) television services and on-demand content (VOD) in Vietnam. Although there are still ambiguities in the wording of Decree 71, the government has expressed a clear intention to regulate the cross-border provision of foreign OTT TV services, including provision via Internet applications. Accordingly, overseas companies might no longer be eligible to provide OTT pay TV services to users in Vietnam on a cross-border basis as they are currently doing with regard to OTT VOD, but may now have to establish a company in Vietnam or cooperate with a licensed Vietnamese pay TV service provider to provide such services.

The MIC has recently taken their first moves to enforce the new requirements under Decree 71. The Authority of Broadcasting and Electronic Information (ABEI) under the MIC has announced the enforcement actions via two official letters on their website, whose main points are summarized as follows:

  • On January 5, 2023, the MIC sent an official letter to a number of foreign OTT service enterprises, requesting a report by January 15, 2023, on the plan to carry out the procedures for applying for a license to provide pay radio and television services The official letter clearly states that if the enterprises continue to maintain the current service provision and do not comply with the provisions of Decree 71 (i.e., do not establish an enterprise in Vietnam to apply for the pay TV license or do not comply with other obligations of local service providers), they will be administratively sanctioned according to the provisions of Decree No. 119/2020/ND-CP dated October 7, 2020.
  • Via official letter No. 6272/BTTTT-PTTH&TTDT dated December 31, 2022, the ABEI has also requested businesses importing, manufacturing, and distributing smart TVs in Vietnam to review the legality of pre-installing unlicensed OTT apps in smart TVs and/or including shortcut buttons on remote controls of smart TVs allowing users to easily access to unlicensed OTT apps, to ensure that they do not violate the provisions of Decree 71.

Interestingly, Decree 71 does not differentiate between provision of film-only VOD from the provision of other types of VOD, which leads to a potential inconsistency between the state management of film-only versus other types of VOD, i.e., more specifically, there may be a potential inconsistency between Decree 71 and the Cinema Law and its guiding decree, Decree No. 131/2022/ND-CP promulgated by the government on December 31, 2022 (“Cinema Decree”). We discuss the new Cinema Decree in more detail in this article.

According to Decree 71, films are specified as a type of “on-demand radio and television content,” and the provision of “on-demand radio and television content” via the internet/internet applications falls within the definition of “TV services,” which are subject to the same requirements imposed on other types of TV services, including local establishment and licensing requirements.

Under the Cinema Law and the Cinema Decree, however, there is no such requirement for foreign providers of VOD films. According to the Cinema Decree, offshore enterprises are allowed to disseminate their films in Vietnam’s cyberspace without having to establish a company in Vietnam and to obtain a license. The film disseminators must only comply with the obligation to self-rate their films according to the government’s guidance.

Given the foregoing potential inconsistency in application of Decree 71 and the Cinema Law, it is strongly recommended that the government should clearly exempt the provision of films on demand in cyberspace from the governing scope of Decree 71 and clarify that such provision is subject to the requirements under the Cinema Law and the management of Ministry of Culture, Sports and Tourism. For further information on Decree 71, please refer to our previous article here.

5. E-Commerce

The government has entrusted the MIC to draft a new Law on E-Transactions, because after 17-years, the existing law has shown shortcomings in the new era of rapid technology and e-commerce development. The Minister of the MIC emphasized that the Law on E-Transactions should be amended to reflect and fully govern current industry technologies, including those relating to the digital environment’s traditional transactions, but with varying degrees of reliability, different costs, and different complexity. The revised law must ensure a wide scope of application and lower costs and less complexity of e-transactions compared to traditional transactions.

Accordingly, the Draft Law on E-Transactions (version 4 of which is publicly accessible) widens the scope of application to attempt to cover all areas of transactions. It retains key principles of the current law, but also provides more comprehensive regulations relating to e-contracts, e-signatures/digital signatures, and data messages. Furthermore, it provides new regulations on e-certificates, trust services and information systems serving e-transactions (digital platforms). For more information, please refer to our previous article here.

The Draft Law on E-Transactions was reviewed for the first reading by the National Assembly in November 2022; however, later draft versions are not available for public access. This draft law is scheduled for approval on the second reading by the National Assembly in May 2023.

Related Professionals

Industries

Technology

Location

RELATED INSIGHTS​ 

July 6, 2026
Indonesia’s regulation on reporting online intellectual property (IP) infringement provides comprehensive procedural guidance for IP rights holders and their licensees in reporting online infringement complaints. Issued in December 2025 by the Ministry of Law as Regulation No. 47 of 2025 regarding Handling of Intellectual Property Infringement Reports in Electronic Systems, this regulation covers all types of IP rights. It also specifies documentation when reporting infringement, and lays out the procedures for examination, verification, and enforcement actions. Submission of Complaints Complainants may submit reports through the online system of the Directorate General of Intellectual Property (DGIP) or in person at the DGIP office. Complaints may also be filed through an authorized proxy. Under the regulation, complainants are required to provide the following information and documents: Personal details of the complainant; Brief description of the protected work or subject matter (i.e., type of IP and name or address of the infringing website, portal, account, or application, or a link to the location of the infringing content); Complete description of the alleged infringement; Certificate of registration or recordal of the relevant IP; Recordal of IP license agreement, if any; and Other supporting evidence. Verification and Examination Process Upon receiving a complaint, the responsible formality officer may request clarification or additional supporting documents. In the latter case, the complainant must then submit the necessary administrative documents within 14 days of the notification date. Once the documentation is deemed complete and sufficient, the case will be formally registered. Subsequently, the DGIP will establish a verification team to handle online IP violations, which will include the Civil Servant Investigator (PPNS), the Ministry of Communication and Digital Affairs, experts with relevant expertise in IP, and representatives from related associations such as AVISI (Indonesian Video Streaming Association). After examining the report, the team will prepare the Minutes
Read More
July 6, 2026
Tilleke & Gibbins has contributed the Vietnam chapter to Data Protection & Privacy 2027, a global guide published by Lexology Panoramic that provides comparative insights into data protection and privacy regimes across multiple jurisdictions. The Vietnam chapter offers a comprehensive overview of the country’s data protection framework, addressing both regulatory structure and practical compliance considerations for businesses operating in or engaging with Vietnam. Topics covered include: Law and the regulatory authority: Legislative framework; data protection authority; cooperation with other data protection authorities; breaches of data protection law; judicial review of data protection authority orders Scope: Exempt sectors and institutions; interception of communications and surveillance laws; other laws; personal information formats; extraterritoriality; covered uses of personal information Legitimate processing of personal information: Lawful bases for processing; grounds for legitimate processing; types of personal information Data handling responsibilities of owners of personal information: Transparency; exemptions from transparency obligations; data accuracy; data minimization; data retention; purpose limitation; automated decision-making Security: Security obligations; notification of data breaches; internal controls Accountability: Data protection officer requirements; record-keeping; risk assessment; design of personal information processing systems Registration and notification: Registration requirements; other transparency duties Sharing and cross-border transfers of personal information: Sharing with processors and service providers; restrictions on third-party disclosures; cross-border transfers; further transfers; localization requirements Rights of individuals: Right of access; other statutory rights; compensation Enforcement: Enforcement mechanisms; exemptions, derogations, and restrictions; further exemptions and restrictions Specific data processing: Cookies and similar technologies; electronic communications marketing; targeted advertising; sensitive personal information; profiling; cloud services The chapter concludes with an update on key legal and regulatory developments over the past year and emerging trends in Vietnam’s data protection landscape. The full Vietnam chapter is available as a PDF through the button below. Readers can also gain 30 days of complementary access to the full Data
Read More
July 2, 2026
Thailand’s Electronic Transactions Development Agency (ETDA) released a new version of the draft Act on Artificial Intelligence on July 2, 2026, for a public hearing period expected to be approximately 30 days. The draft act adopts a risk-based regulatory approach modeled in part on international frameworks—particularly the EU’s AI Act—while incorporating provisions tailored to Thailand’s regulatory landscape and digital economy objectives. If enacted in its current form, the law would introduce extraterritorial obligations, a tiered risk classification system, strict liability for AI-related damages, and new transparency requirements for AI-generated content. Scope and Extraterritorial Application The draft act applies to AI development, deployment, or any other action affecting people in Thailand, even if the action occurs outside the country. Of note: This extraterritorial reach creates compliance obligations for global AI companies whose systems impact Thai residents or consumers, even if the provider has no physical presence in Thailand. Foreign AI providers serving Thai deployers or users must appoint a local coordinator or authorized representative. Depending on the type of AI system, the representative may need full authority to act on behalf of the provider without any limitation of liability. Certain activities are exempt from the draft act’s oversight, including AI used by natural persons solely for personal or household activities, AI for educational research conducted by higher education institutions with ethics committee approval, research and development activities conducted prior to distribution or service provision, and other AI systems prescribed by royal decree. Risk-Based Classification Framework The draft act establishes a tiered risk classification system with three main categories: Prohibited AI. The act outright prohibits AI systems employing cognitive-behavioral manipulation using subliminal techniques, AI systems causing unfair broad-scale discrimination from processing irrelevant data, and other categories of serious risk as determined by announcement of a forthcoming committee that will be responsible
Read More
June 25, 2026
On June 18, 2026, Thailand’s Office of the Personal Data Protection Committee (PDPC) published two notifications in the Government Gazette establishing Thailand’s first formal certification framework for personal data protection standards under the Personal Data Protection Act B.E. 2562 (2019) (PDPA). The notifications, which took immediate effect, introduce a voluntary certification framework aimed at promoting accountability, strengthening organizational data protection governance, and aligning Thailand more closely with international frameworks that recognize certification as a key compliance tool. Certification Criteria The first notification sets out the assessment criteria for organizations seeking certification. Applicants must undergo an evaluation against a framework comprising four assessment categories, 10 focus areas, and 128 assessment criteria covering key elements of a privacy management program. These include: Organizational oversight and internal policies and procedures. Human resource development, including staff training and awareness programs. Clearly defined operational processes and procedures covering data subject rights, transparency obligations, records of processing activities, and lawful basis management, as well as contractual safeguards such as data-processing and data-sharing agreements and risk assessments, including Data Protection Impact Assessments. Technical measures encompassing data security controls and breach response capabilities Based on the assessment results, organizations may be awarded either a PDPA Compliance Certificate or a higher-level PDPA Certificate accompanied by a certification mark. Application and Assessment Process The second notification establishes the application and assessment process for obtaining certification. Eligible applicants include government agencies and private-sector entities that demonstrate sufficient privacy governance maturity and meet the prescribed eligibility requirements. Applicants must submit their applications along with supporting documentation for review. Upon receiving an application, the Office of the PDPC will conduct a detailed evaluation, which may include both documentary review and on-site inspections. Incomplete applications may be rejected, though applicants are typically given a limited period to correct deficiencies before a final decision
Read More