You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

January 12, 2023

Vietnam 2022 ICT Legislation Year in Review

Subscribe to Updates

The year 2022 witnessed a dynamic environment in the development of information and communications technology (ICT) policy in Vietnam. The following are some highlights of remarkable legislative developments in the ICT space from the past year, and some notes on key draft laws and regulations that are in the pipeline for 2023.

1. Telecommunications

Although it has helped Vietnam develop modern telecommunications network infrastructure and a diversified and competitive telecom market with a variety of services, Vietnam’s Telecom Law, which has been in effect since 2010, has posed problems and inadequacies in meeting today’s more complex evolution of new service types and new business models as well as the trend of convergence of telecom, information technology, and automation.

Accordingly, the Ministry of Information and Communications (MIC) has been working to replace the existing Telecom Law, with a Draft Telecom Law made available for public consultation from October 27 to December 27, 2022 (the Vietnamese version can be accessed here).

The primary amendment of the Telecom Law focuses on widening the scope of application to regulate data center and cloud computing services. Data center services include data center space rental services, server rental services, and data storage space rental services. Cloud computing services include services providing server resources, storage capacity, and networks (IaaS services); services that provide the ability to create, develop, manage, and operate software, including applications (PaaS services); and software delivery services, including applications (SaaS services).

According to the Draft Telecom Law, it could be interpreted that all providers of data center services and IaaS cloud computing services, whether onshore or offshore, must obtain a permit to provide the services by registration with the MIC via its online portal; while PaaS and SaaS cloud computing services are exempted from this requirement.

In addition, the Draft Telecom Law adds new content related to the management of OTT telecom services, or “information communication service without using telecom number storage” according to the language of the Draft Telecom Law (for example, WhatsApp, Zalo, Viber, Line, etc.). These services have not been regulated before and for a long time the MIC has attempted to regulate these services via a draft Circular on OTT telecom services, without success. This content is now put into the Draft Telecom Law but with much lighter requirements compared to the previous draft Circular. The Draft Telecom Law allows cross-border provision of OTT telecom services to Vietnam with regulations on service providers’ responsibilities in service provision as well as requirements for notification to the MIC. The content for notification includes representative name and contact information (phone, email). Forms and procedures for notification must comply with the government’s regulations.

Another new area contemplated in the Draft Telecom Law which is worthy of mention is telecom wholesale and retail services. The Draft Telecom Law supplements obligations of telecom companies with a dominant position in the market for important retail services that require state management of competition, as well as obligations of telecom enterprises providing telecom wholesale services with the aim of creating favorable conditions for enterprises to negotiate and buy telecom traffic, and to promote the wholesale market and contribute to promoting competition in the retail market through the wholesale market.

The Draft Telecom Law is scheduled to be discussed by the National Assembly in May 2023 and submitted for approval in October 2023.

2. Cybersecurity

The long-awaited Decree 53 on the implementation of the Cybersecurity Law (which took effect in 2019) was issued on August 15, 2022, with an effective date of October 1, 2022. Decree 53 provides further guidance on a number of key issues, including:

  • Data localization requirements which may create potential troubles for not only overseas enterprises but also domestic enterprises;
  • Takedown of illegal online content with corresponding responsibilities of the Ministry of Public Security (MPS), the Ministry of Defense, and the MIC;
  • Collection of electronic data relating to illegal activities in cyberspace to serve the purposes of investigation and handling of such activities according to stipulated conditions and procedures;
  • Suspension or stoppage of information system operation, and/or revocation of domain names when the operation of the information system violates the laws on national security and cybersecurity, or when the information system is being used for the purpose of infringing upon national security or social order and safety; and
  • Responsibilities of relevant stakeholders in coordinating and assisting the authorities in preventing and handling the violations, including cross-border violations.

Regarding the controversial issue of data localization requirements, it is worth noting that domestic enterprises may be impacted more than overseas enterprises.

For overseas enterprises, only those fulfilling all the following conditions are subject to the MPS’s decision to store regulated data and establish a branch or representative office in Vietnam within a grace period of 12 months:

  1. Providing services falling within 10 enumerated types of regulated services;
  2. Collecting, exploiting, analyzing, and/or processing regulated data; and
  3. Have received a warning from the Department for Cybersecurity and Prevention of High-Tech Crime (A05) under the MPS but have not taken any measures for avoiding, dealing with, fighting against, or preventing the breach mentioned in the notification, or have resisted, obstructed, or ignored requests from the relevant authorities.

For domestic enterprises, the requirements are more stringent. Without further clarification of the MPS, nearly all online domestic service providers which collect, use, analyze, and/or process regulated data are required to store the regulated data in Vietnam without triggering conditions and without a grace period. For more information of the Decree 53, please refer to our previous articles here and here.

3. Data Privacy

The government recently released Resolution 156/NQ-CP on December 6, 2022, which requires the MPS to quickly finalize the draft Decree on Personal Data Protection (draft PDPD) and submit it to the government for submission to the National Assembly Standing Committee for comments before the government promulgates it. Therefore, it is expected that the PDPD could be issued in 2023. Within 2022, there was no official updated version of the draft PDPD available for public assessment of the major changes from the previous publicly accessible version. For more information of the main content of the draft PDPD, please see our previous articles here, here, and here.

4. OTT TV Services & VOD Films

Decree 71 was issued on October 1, 2022, with an effective date of January 1, 2023, to amend the prior Decree 06 on the Management, Provision, and Use of Radio and Television Services. The new decree will have a major impact on over-the-top (OTT) television services and on-demand content (VOD) in Vietnam. Although there are still ambiguities in the wording of Decree 71, the government has expressed a clear intention to regulate the cross-border provision of foreign OTT TV services, including provision via Internet applications. Accordingly, overseas companies might no longer be eligible to provide OTT pay TV services to users in Vietnam on a cross-border basis as they are currently doing with regard to OTT VOD, but may now have to establish a company in Vietnam or cooperate with a licensed Vietnamese pay TV service provider to provide such services.

The MIC has recently taken their first moves to enforce the new requirements under Decree 71. The Authority of Broadcasting and Electronic Information (ABEI) under the MIC has announced the enforcement actions via two official letters on their website, whose main points are summarized as follows:

  • On January 5, 2023, the MIC sent an official letter to a number of foreign OTT service enterprises, requesting a report by January 15, 2023, on the plan to carry out the procedures for applying for a license to provide pay radio and television services The official letter clearly states that if the enterprises continue to maintain the current service provision and do not comply with the provisions of Decree 71 (i.e., do not establish an enterprise in Vietnam to apply for the pay TV license or do not comply with other obligations of local service providers), they will be administratively sanctioned according to the provisions of Decree No. 119/2020/ND-CP dated October 7, 2020.
  • Via official letter No. 6272/BTTTT-PTTH&TTDT dated December 31, 2022, the ABEI has also requested businesses importing, manufacturing, and distributing smart TVs in Vietnam to review the legality of pre-installing unlicensed OTT apps in smart TVs and/or including shortcut buttons on remote controls of smart TVs allowing users to easily access to unlicensed OTT apps, to ensure that they do not violate the provisions of Decree 71.

Interestingly, Decree 71 does not differentiate between provision of film-only VOD from the provision of other types of VOD, which leads to a potential inconsistency between the state management of film-only versus other types of VOD, i.e., more specifically, there may be a potential inconsistency between Decree 71 and the Cinema Law and its guiding decree, Decree No. 131/2022/ND-CP promulgated by the government on December 31, 2022 (“Cinema Decree”). We discuss the new Cinema Decree in more detail in this article.

According to Decree 71, films are specified as a type of “on-demand radio and television content,” and the provision of “on-demand radio and television content” via the internet/internet applications falls within the definition of “TV services,” which are subject to the same requirements imposed on other types of TV services, including local establishment and licensing requirements.

Under the Cinema Law and the Cinema Decree, however, there is no such requirement for foreign providers of VOD films. According to the Cinema Decree, offshore enterprises are allowed to disseminate their films in Vietnam’s cyberspace without having to establish a company in Vietnam and to obtain a license. The film disseminators must only comply with the obligation to self-rate their films according to the government’s guidance.

Given the foregoing potential inconsistency in application of Decree 71 and the Cinema Law, it is strongly recommended that the government should clearly exempt the provision of films on demand in cyberspace from the governing scope of Decree 71 and clarify that such provision is subject to the requirements under the Cinema Law and the management of Ministry of Culture, Sports and Tourism. For further information on Decree 71, please refer to our previous article here.

5. E-Commerce

The government has entrusted the MIC to draft a new Law on E-Transactions, because after 17-years, the existing law has shown shortcomings in the new era of rapid technology and e-commerce development. The Minister of the MIC emphasized that the Law on E-Transactions should be amended to reflect and fully govern current industry technologies, including those relating to the digital environment’s traditional transactions, but with varying degrees of reliability, different costs, and different complexity. The revised law must ensure a wide scope of application and lower costs and less complexity of e-transactions compared to traditional transactions.

Accordingly, the Draft Law on E-Transactions (version 4 of which is publicly accessible) widens the scope of application to attempt to cover all areas of transactions. It retains key principles of the current law, but also provides more comprehensive regulations relating to e-contracts, e-signatures/digital signatures, and data messages. Furthermore, it provides new regulations on e-certificates, trust services and information systems serving e-transactions (digital platforms). For more information, please refer to our previous article here.

The Draft Law on E-Transactions was reviewed for the first reading by the National Assembly in November 2022; however, later draft versions are not available for public access. This draft law is scheduled for approval on the second reading by the National Assembly in May 2023.

Related Professionals

Industries

Technology

Location

RELATED INSIGHTS​ 

May 22, 2026
On May 8, 2026, the Thai government held a press conference to announce a coordinated, multiagency initiative to strengthen oversight and enforcement over products sold on online platforms. The initiative involves the Office of the Consumer Protection Board, the Thai Industrial Standards Institute, the Electronic Transactions Development Agency, the Thailand Consumers Council, the Consumer Protection Police Division, and major online platform operators. With this appointment, the government has signaled a deliberate shift from a predominantly reactive enforcement framework toward a more proactive regulatory and monitoring approach for online commerce and digital platform services. Legal and Regulatory Reform The government is accelerating a proposed Product Liability Law that would introduce new statutory frameworks for defective or substandard products, along with amendments to food safety and consumer protection legislation. The draft law has already been approved by the cabinet; the Council of State and relevant authorities will further draft the law and subsequently issue it for public hearings prior to enactment. Authorities also plan to expand enforcement measures against noncompliant businesses and distributors. In particular: The implementation of stricter “know your merchant” (KYM) identity verification requirements for online sellers. Expanded mandatory standards and regulatory oversight for high-risk products, such as power banks, electrical appliances, food products, and household goods. Increased monitoring of online product listings, and coordination with platform operators to remove unsafe, counterfeit, misleading, or otherwise noncompliant products. Additional monitoring and enforcement measures targeting online scams and illegal goods distributed through digital platforms, including e-cigarettes, which authorities identified as a growing concern due to increasing online distribution channels and potential health impact on young consumers. Strengthening Consumer Complaint Mechanisms The government announced increased cooperation with the Thailand Consumers Council and other agencies to facilitate complaint handling, market monitoring, and policy recommendations. Enhanced interagency coordination will aim to ensure that consumer
Read More
May 19, 2026
Thailand’s telecommunications regulator has introduced a range of new compliance obligations for telecom licensees aimed at preventing and suppressing technology crime. On May 15, 2026, the National Broadcasting and Telecommunications Commission (NBTC) published in the Government Gazette Notification on Measures for Prevention and Suppression of Technology Crime No. 2, which amends the original NBTC notification dated August 24, 2025. The amendment derives its authority from the Emergency Decree on Measures for Prevention and Suppression of Technology Crime B.E. 2566 (2023), as amended in 2025, and took effect on May 16, 2026. SIM Card Registration Cap for Non-Thai Nationals Persons without Thai nationality are now limited to a maximum of three SIM cards per person per service provider. Identity verification must be done primarily via passport. For those without a passport, acceptable alternatives include travel documents or certificates of identity issued by foreign governments, accompanied by additional Thai government-issued documents, as well as pink ID cards (for persons without Thai nationality) and white ID cards (for persons without registration status). Registration must be done in person at a branch or authorized dealer. Service providers must develop their identity verification systems and obtain NBTC approval before deployment. SIM Activation Deadline and SIM Box Prohibition Both Thai and non-Thai service users must activate their registered SIM within 60 days of registration. If they fail to do so, they must re-verify their identity in person before activation, confirming they are the same person who originally registered. Service providers must prohibit SIM box and gateway devices capable of supporting four or more SIMs from connecting to their mobile networks unless the device has received a license under the Radio Communications Act. Blacklist Enforcement Service providers must refuse registration of additional mobile numbers for persons listed on a technology crime-related database maintained by the Royal
Read More
May 6, 2026
Thailand has introduced new requirements for online social media platforms to verify the identity of paying advertisers before publishing their advertisements. On May 5, 2026, the Electronic Transactions Commission published the Notification on Measures for Prevention of Technology Crime for Online Social Media (No. 2) in the Government Gazette. The notification, which aims to prevent technology crimes such as fraud and scams, takes effect 180 days after publication (i.e., on November 1, 2026). Mandatory Advertiser Identity Verification Online social media service providers must verify the identity of every advertiser before publishing an advertisement. Verification remains valid for up to one year from the most recent verification date. The notification requires social media providers to use either of the following methods when verifying advertisers: Document-based verification: Examine government-issued identity documents (e.g., national ID, passport, or juristic person registration certificate), cross-check the connection between the advertiser and the identity documents (e.g., facial comparison with photo ID), and ensure that the identity documents are verifiable against reliable sources. Digital identity verification: Use an identity verification system with a level of assurance no lower than that prescribed by the Electronic Transactions Commission. Advertiser Data Collection and Retention Service providers must collect and retain certain data—including name, identification number, and contact details—from the start of the advertising service and for a minimum of 90 days after the end of the advertising service relationship. The same requirements apply where there is a third-party payer, such as an ad agency. Implications for Affected Businesses The notification raises two key areas of concern for affected businesses: Social media platforms must implement know-your-advertiser (KYA) onboarding as described above, including document upload and identity matching processes. The 180-day implementation window requires immediate technical and operational planning. The collection and retention of national ID cards, passport copies, and other personal
Read More
April 30, 2026
Vietnam’s Decree No. 134/2026/ND‑CP, which took effect on 9 April 2026, plays an important role in detailing and implementing Vietnam’s Intellectual Property (IP) Law in the context of rapid digital transformation and the growing application of artificial intelligence (AI). The new decree provides comprehensive guidance on the application of copyright and related‑rights regulations, addressing key issues such as authorship, ownership, statutory exceptions and limitations, registration procedures, and enforcement mechanisms. Through these measures, Decree 134 seeks to achieve an appropriate balance between safeguarding the legitimate interests of rightsholders and fostering innovation, research, and technological advancement, thereby strengthening the state’s framework for the effective management, protection, and exploitation of intellectual property in the digital and AI‑driven environment. Some notable aspects of Decree 134 are discussed below. Copyright for AI-Created Works Decree 134 provides important guidance on the determination of copyright and related rights in works created with the assistance of AI. Article 5a reaffirms the principle that human creativity remains central to copyright protection, clarifying that copyright or related rights arise only where a human makes a substantial and decisive intellectual contribution, exercises effective control over the creative outcome, and assumes responsibility for the content and its legality. At the same time, the provision confirms that AI is regarded solely as a technological tool rather than a rights‑holding subject, thus ensuring consistency with the fundamental concepts of authorship and ownership under the IP Law. By introducing requirements on transparency, proof of human contribution, and compliance with AI‑specific labelling and technical marking obligations, Decree 134 establishes a clear and enforceable legal framework for the responsible use of AI in creative activities. Lawful Use of Copyrighted Texts and Data Article 37a of Decree 134 sets out the specific conditions under which copyrighted texts and data may be lawfully used for scientific research, experimentation,
Read More