You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

June 26, 2023

Vietnam Signals Intent to Loosen Control Over OTT Telecom and Cloud Services

Vietnam’s Ministry of Information and Communications (MIC) organized a workshop with industry representatives on June 19, 2023, to discuss its future policy direction for over-the-top (OTT) telecom services and internet data center (IDC) and cloud computing services. OTT telecom services, in the MIC’s interpretation, are communication services such as text messages or voice calls provided over the internet—for example, the services of Zalo, WhatsApp, WeChat, etc.

The workshop, the first in an expected series, focused only on the discussion of policy on how to regulate these services.

Light-Touch Management Approach

A very positive signal of the MIC in the workshop was its clear intention to apply a “light-touch” approach to management. For cross-border provision of OTT telecom services and IDC/cloud computing services, the MIC intends to require notification and a post-check mechanism, instead of a heavy licensing or commercial arrangement regime like the one applicable to traditional telecom services. In addition, there is no limitation on foreign investment if foreigners would like to provide these services in Vietnam.

With regard to domestic service providers, the MIC proposes a registration regime with a similar post-check mechanism. The MIC’s reason for registration instead of notification is because the provision of these services by domestic companies may involve setting up data center/cloud systems which require consideration of various issues including location, electricity sources, and connection with telecom infrastructure such as marine cable. However, the MIC is also hoping to make the registration process as light as possible for enterprises (for example, using online registration) to provide a favorable environment and conditions to facilitate development of the industry without obstacles or cumbersome administrative procedures for companies’ operations.

For providers of these services, the MIC is also considering an exemption from the responsibility to pay fees for telecommunications activities rights, and from payment to the Telecom Universal Service Fund, which traditional telecom companies are subject to. However, the provision of these services still needs to comply with relevant regulations on consumer protection, data protection, cybersecurity, network information security, national security, and service quality.

The MIC is contemplating the requirement of a service quality announcement. If the OTT telecom or IDC/cloud computing service providers can assure the quality of their services, they should let users know. If they cannot assure the quality of their service—for example, if they have no commercial arrangement with telecom service providers for the provision of their services or their service quality depends entirely on the service quality of the telecom carriers—this also needs to be publicly announced.

Regulated Under the Telecom Law?

Whether these OTT telecom services and IDC/cloud computing services should be regulated under the Telecom Law was a key issue discussed in the workshop. The MIC explained that the WTO defines value-added telecom services as services for storing and retrieving information through telecom networks, and Vietnam’s schedule of commitments on telecom services in the WTO also mentions information storage and information retrieval services. As IDC/cloud computing services involve storing and retrieving information through telecom networks, they should be considered telecom services. Countries such as China, Thailand, Korea have set a precedent by regulating IDC/cloud computing services as telecom services under their telecom laws. Currently, there are no regulations on conditions for market access and business conditions for providing these types of services, while Vietnam’s Investment Law clearly stipulates that data center services are conditional services. Thus, there is a need to regulate these services under the Telecom Law to overcome legal gaps and create facilitation and transparency for enterprises investing in and providing these services.

With regard to OTT communication services, 27 countries of the EU, China, and Korea are considering these services as telecom services and regulating them under their telecom laws. These OTT services are used more and more frequently and potentially will replace traditional telecom services, while the existing Telecom Law does not regulate these services, leading to the rights of users and information security not being ensured. Therefore, according to the MIC, it is appropriate to regulate these OTT services under the Telecom Law. However, according to the MIC, the Telecom Law will only provide a framework and will leave all the details to be regulated by a decree.

It is worth noting that the MIC only intends to regulate the provision of OTT telecom services when such services are the primary business of a company. When communication functions are merely add-ons and the company’s main business is not telecom services—for example, the chat/call functions of transportation services like Grab or social networks like YouTube—the MIC will consider exempting these add-on services from the scope of application of OTT telecom services.

While the industry representatives in the meeting were highly appreciative of the MIC’s approach and its openness and willingness to work closely with businesses and take their input into account, they expressed a strong sentiment for not including these services under the Draft Telecom Law. Rather, if these services need to be regulated, they should be regulated in a separate legal document.

The industry argument was that with the convergence of technology and the integration of many sectors and services, the differences between value-added telecom services and IT services have become very blurred and many countries have started deviating from this distinction. Data center/cloud computing services are more of the nature of IT services instead of telecom services. Also, OTT communication services do not use telecom resources such as frequency or numbering, they do not own telecom infrastructure to provide services, and they do not require interconnection to the public telecom network; they are essentially just applications and, like any application, they use the internet for service provision. Therefore, they should not be considered telecom services.

If the MIC still considers them telecom services and wishes to regulate them under the Telecom Law, the industry representatives strongly recommended that there should be separate chapters of the law and separate rules for these services, and the language of the law must clearly exempt these services from general rules governing traditional telecom services. In addition, the wording of the regulations should be straightforward and easy to understand, to avoid ambiguity and confusion in interpretation and implementation.

The MIC reassured the industry of their light-touch management approach and said this was just a matter of drafting techniques in putting those provisions under the Draft Telecom Law, and the MIC will involve the industry closely in the drafting process to ensure there is no confusion as to the policy intention in regulating these services.

 Moving Forward

The MIC appeared very open and willing to take input from the industry. It will continue holding workshops and dialogues and closely engage the industry in the drafting process, so that the Draft Telecom Law (amendment) which will be submitted to the National Assembly for a second reading and approval in November 2023 will achieve the purposes of creating transparency and facilitating an environment for business development and technology innovation.

It is therefore strongly recommended that businesses, associations, and experts should pay attention to the drafting process of this Draft Telecom Law and actively contribute opinions to the MIC.

RELATED INSIGHTS​ 

August 15, 2025
More than a decade after the issuance of Decree No. 52/2013/ND-CP (as amended by Decree No. 85/2021/ND-CP; collectively, “Decree 52”), Vietnam’s legal framework for e-commerce is under growing pressure to keep pace with the evolving digital economy. While Decree 52 has provided a foundational framework, it has shown certain limitations in keeping up with issues such as counterfeit goods, intellectual property enforcement, unqualified products, and emerging models like livestream selling and affiliate marketing. To address these regulatory gaps, the Ministry of Industry and Trade (MOIT) has released the 2025 Draft E-Commerce Law (“Draft Law”) for public consultation. The Draft Law is intended to supersede the current framework under Decree 52 and establish a more detailed and comprehensive legal foundation for the regulations of e-commerce activities in Vietnam. It is currently expected to be submitted to the National Assembly for review and potential adoption during its 10th session in October 2025. In this article, we discuss the Draft Law’s most significant updates and legal developments in comparison to existing regulations, and assess the practical challenges that businesses may face in preparing for implementation in the near future. Platform Classification: Toward a More Nuanced Framework Unlike Decree 52’s simpler structure, which broadly categorized platforms into either (i) websites selling goods and services or (ii) websites providing e-commerce services, the Draft Law introduces a more detailed framework that aims to classify platforms based on their technical functions and business models. Specifically, the Draft Law introduces a four-tier classification system for e-commerce platforms, consisting of: (i) Direct Business Platforms, (ii) Intermediary Platforms, (iii) Social Networks with E-Commerce Functions, and (iv) Multi-Service Integrated Platforms. This approach reflects an effort to more accurately capture the complexity of today’s e-commerce landscape, including hybrid platforms such as TikTok Shop. While this approach reflects the growing complexity of
August 6, 2025
Thailand’s Digital Government Development Agency (DGA) has released drafts of two pivotal documents to guide Thai government agencies in adopting cloud technology and classifying data for cloud usage. These draft guidelines, open for public hearing through August 12, 2025, are part of the national “Go Cloud First” policy, which aims to accelerate digital transformation, improve efficiency, and ensure robust data security across the public sector. The new standards will have significant implications for both government agencies and cloud service providers operating in Thailand. Highlights of the draft guidelines are presented below. Government Cloud Usage Guidelines Cloud-first transformation: All government agencies are directed to prioritize cloud solutions for new IT projects, in line with the cabinet’s “Go Cloud First” policy. Cloud model selection: Agencies must assess their needs and select the most appropriate cloud deployment model—public, private, hybrid, or community cloud—based on the sensitivity of the data and operational requirements. Service types: The guidelines provide criteria for choosing between Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS), emphasizing the importance of using standard, non-customized services where possible. Cost management: Agencies are required to plan and separate cloud-related expenses, ensuring transparency and efficient budget allocation. Cloud migration: The guidelines outline the steps for migrating to the cloud and highlight the role of cloud service providers in facilitating the process, including supporting innovation and enabling smooth exit strategies. Procurement compliance: All cloud procurement must comply with public sector procurement laws and regulations. Only providers meeting government-mandated standards can be selected. Security and shared responsibility: The guidelines clarify the division of security responsibilities between cloud providers and government agencies. While providers manage infrastructure security, agencies remain responsible for data, application, and access controls. Legal framework: Agencies must comply with the Digital Government Administration Act, Cybersecurity
August 1, 2025
Thailand’s Personal Data Protection Committee (PDPC) announced to the press on August 1, 2025, that it had issued eight new administrative fines under Thailand’s Personal Data Protection Act B.E. 2562 (2019) (PDPA) in five cases of noncompliance by public and private entities. The enforcement actions reflect a growing commitment by the PDPC to penalize noncompliance across all sectors, regardless of organizational type or size. The total amount imposed to date was approximately THB 21.5 million (approx. USD 654,690), underscoring the financial risks tied to PDPA violations. The five cases—one involving a state agency and the remainder in the private sector—are summarized below. Case 1: State Agency Providing Online Services to the Public The order in this case stemmed from a cyberattack on a state agency’s web app, resulting in personal data of 200,000 data subjects being leaked to and sold on the dark web. The software developer was also found to have implemented no privacy by design, lacked an access control system, had no data breach prevention measures, and failed to conduct risk assessments or review existing security measures. Key noncompliance identified: Lack of appropriate security measures Weak password protection No risk assessment or ongoing review of security measures No data processing agreement with software developer that acted as data processor The state agency and the developer were each fined THB 153,120 (approx. USD 4,670). Case 2: Private Hospital This case involved a hospital that engaged an individual contractor to destroy patient medical record documents. However, the contractor stored the documents at their own premises, failed to follow the required destruction protocols, and ultimately used the medical records to wrap sweets, resulting in the leak of over 1,000 records during the destruction process. The contractor also failed to notify the hospital of the data breach. Although there was a
August 1, 2025
On July 30, 2025, Myanmar’s Cybersecurity Law No. 1/2025 came into effect with the State Administration Council’s issuance of Notification 113/2025. The law, which was enacted on January 1, 2025, aims to regulate various aspects of digital security and online activities. Below are some key provisions, implications, and penalties under the Cybersecurity Law. Extraterritorial penalties. The law contains an important provision that authorizes penalties against Myanmar citizens who are found guilty of violations, even if these occur outside the country’s borders. VPN definition and regulation. Virtual private networks (VPNs) are defined by this law as specific systems that function as backup networks by using technological means in order to ensure the safety of linking networks to each other. This definition sets the framework for subsequent regulations and penalties associated with VPN usage. The law does not restrict individuals or entities from using VPNs; it regulates VPN service providers. Penalties for unapproved VPN services. Establishing a VPN or providing VPN services without approval from the designated ministry (to be appointed later by the government) can result in significant penalties. For individuals, the punishment may be imprisonment for 1–6 months, a fine of MMK 1–10 million (approx. USD 476–4,760), or both, with the proceeds of the violation being confiscated. If the violator is a company or organization, the minimum fine will be MMK 10 million, and the proceeds will be confiscated. Government oversight. The ministry designated by the government is authorized to investigate and take control of cybersecurity services and digital platform services for national defense and security purposes, or upon request from a government department or organization in accordance with respective laws. Licensing requirements. The Cybersecurity Law introduces two types of licenses, valid for a period of 3–10 years, for (1) cybersecurity services and (2) digital platform providers. Digital platforms with