You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

July 27, 2026

Vietnam’s E-Commerce Law Reshapes Online IP Enforcement

Managing Intellectual Property

Vietnam’s new E-Commerce Law, which took effect on 1 July 2026 along with its implementing Decree No. 248/2026/ND-CP (Decree 248), marks a significant development in the country’s approach to online intellectual property (IP) enforcement, reflecting a clear shift from a reactive model of intermediary liability to one that expects platforms to play a more active role in preventing infringement.

From notice-and-takedown to platform responsibility

The most significant change introduced by the E-Commerce Law is the transformation of the legal role of e-commerce platforms. The existing safe harbor provisions under the IP Law and the copyright notice-and-takedown regime established by Decree 17/2023/ND-CP (Decree 17) largely required intermediaries to act only after receiving notice of infringement. Once infringing content had been removed, the platform’s legal obligation was generally considered fulfilled. The new legislation adopts a fundamentally different approach.

Article 17 of the E-Commerce Law requires intermediary platforms to screen information relating to goods and services before publication in order to prevent listings involving counterfeit or IP-infringing goods, and goods of unknown origin. Rather than relying exclusively on complaints from rights holders, platforms are now expected to implement preventive measures before infringing listings become publicly available.

Decree 248 further requires platforms to update keyword filters based on recommendations issued by competent authorities. These filtering mechanisms are intended to prevent prohibited listings from appearing on the platform and represent a further move away from a purely complaint-driven enforcement model.

The legislation also introduces Vietnam’s first statutory stay-down obligation. Under the E-Commerce Law and Decree 248, major digital platforms must maintain automated systems capable of reviewing, warning against, and removing unlawful listings while also implementing measures to prevent repeat violations, defined under Decree 248 as conduct that has previously been identified and handled by the platform, but continues to recur.

This obligation addresses one of the most persistent challenges in online brand protection. Under the previous framework, counterfeit listings frequently reappeared shortly after removal under different seller accounts or slightly modified product descriptions, forcing rights holders into an endless cycle of repeated takedown requests. The new legislation requires platforms not only to remove infringing listings but also to implement reasonable measures to reduce their reappearance.

Although the legislation does not prescribe any particular technology, compliance will likely require platforms to invest in tools such as image recognition, product fingerprinting, and seller behavior analysis. Whether implementation proves consistently effective remains to be seen, but it is clear that major platforms are expected to take active steps to prevent, rather than merely respond to, online infringement.

A unified enforcement framework for all IP rights

Another significant reform is the expansion of statutory online enforcement beyond copyright. Vietnam’s notice-and-takedown procedure under Decree 17 applies only to copyright and related rights. Trademark owners, patent holders and industrial design owners have traditionally relied on administrative enforcement or civil litigation, neither of which offers the speed or flexibility of platform-level enforcement.

The 2025 amendment to the IP Law and now the E-Commerce Law remove this distinction. These laws prohibit the trading of IP-infringing goods without limiting protection to any particular category of IP, while Decree 248 requires platforms to inspect, review, and promptly remove information relating to any IP-infringing goods upon requests from competent authorities.

The legislation also formalizes cooperation between e-commerce platforms and rights holders. Decree 248 requires platforms to establish publicly available complaint mechanisms through which IP owners may request the review, temporary removal, or blocking of listings showing indications of infringement. Although many major platforms had already introduced voluntary brand protection programs, the new legislation transforms this practice into a statutory obligation.

Notably, the E-Commerce Law does not establish a statutory counter-notice procedure comparable to that available under Decree 17 for copyright disputes. Government-directed removals remain subject to administrative review, while complaints submitted directly by rights holders are generally handled under each platform’s published complaint procedures. Compared with the copyright regime, this approach provides greater certainty for rights holders, although it also places greater responsibility on platforms to maintain fair and transparent complaint mechanisms.

For trademark owners, who account for the majority of online IP enforcement actions in Vietnam, the reforms provide the first dedicated statutory framework for platform-level enforcement.

Enforcement beyond the platform

The 2025 IP Law established a general framework governing intermediary service providers operating in cyberspace. Building on that foundation, the E-Commerce Law and Decree 248 prescribe how those principles apply in the e-commerce context through specific obligations for businesses supporting online transactions, giving practical effect to Vietnam’s broader intermediary liability reforms by extending compliance obligations across the e-commerce ecosystem.

Decree 248 extends these obligations beyond e-commerce platforms to technical infrastructure providers, logistics companies, and payment service providers. Upon requests from competent authorities, these entities may be required to block access to noncompliant platforms, suspend logistics services for infringing goods, or terminate payment services supporting infringing activities.

This significantly strengthens the enforcement framework against commercial-scale online infringement. Rather than focusing solely on individual listings, the legislation enables enforcement authorities to target the broader infrastructure supporting counterfeit operations. In many cases, disrupting payment, logistics, or technical services may prove more effective than repeatedly removing infringing listings.

The E-Commerce Law also strengthens Vietnam’s jurisdiction over foreign platforms. Overseas platforms exceeding specified transaction thresholds with Vietnamese consumers must register with the Ministry of Industry and Trade, establish a legal presence or appoint an authorized representative in Vietnam, and comply with the same obligations as domestic platforms. These localization requirements substantially improve the practical enforceability of Vietnamese law against cross-border platforms.

Looking ahead

Vietnam’s E-Commerce Law represents a significant evolution in the country’s online IP enforcement framework. Many aspects of implementation will continue to develop through regulatory guidance and enforcement practice. Nevertheless, it is clear that Vietnam has moved beyond a purely reactive model of intermediary liability toward one that expects major digital platforms to play an active role in preventing online infringement.

This article first appeared in Managing Intellectual Property.

RELATED INSIGHTS​ 

June 19, 2025
The Bank of Thailand (BOT) has released draft guidelines establishing principles for managing artificial intelligence (AI) risks in the financial sector. The draft guidelines provide a structured framework for the responsible adoption of AI technologies. Financial service providers will be able to use the guidelines as a reference to appropriately manage their risks in a manner that aligns with internationally recognized best practices. The BOT is accepting public comments on the draft guidelines until June 30, 2025. Scope and Application The draft guidelines apply to all financial service providers, including financial institutions and special financial institutions under the Financial Institution Business Act, as well as payment providers under the Payment Systems Act. These guidelines supplement existing BOT risk management guidelines covering IT risk management, third-party risk management, data governance, and market conduct. The guidelines define AI systems as systems that mimic human intelligence, including machine learning, deep learning, generative AI (such as large language models), and agentic AI. This definition specifically excludes rule-based automation systems like robotic process automation and condition matching. Key Risk Management Principles The guidelines lay out two main principles in managing AI risk. Governance: Financial service providers should define and establish clear roles and responsibilities for their personnel and AI system supervision structures to uphold FEAT (fairness, ethics, accountability, and transparency) principles as follows: Stakeholder roles and responsibilities. Financial service providers should define roles and responsibilities for boards and executives on AI risk oversight. Responsibilities include establishing an AI system usage policy, designating personnel responsible for AI risk management, and building awareness of AI-related risk within the organization. AI system usage policy. The AI system usage policy should be aligned with organizational objectives, regulatory requirements, and FEAT principles. These policies should be reviewed regularly to respond to technological advancements and evolving risk profiles. Risk management
June 19, 2025
Thailand’s Electronic Transactions Development Agency (ETDA) has announced plans for increased enforcement of the Royal Decree on the Operation of Digital Platform Service Businesses That Are Subject to Prior Notification B.E. 2565 (2022). The ETDA outlined a comprehensive enforcement framework and review process during an online meeting with digital platform service operators on June 11, 2025. The ETDA’s enhanced enforcement approach includes systematic reviews of notification submissions, formal correction orders, and potential criminal penalties for noncompliance. Digital platform operators should immediately assess their current notification status and prepare for increased regulatory scrutiny. Review and Amendment of Previously Submitted Notification Data The ETDA will begin reviewing operation notification forms and annual reports submitted by digital platform service operators to assess each platform’s risk level and develop tailored regulatory obligations. In this comprehensive review process, the ETDA will: Examine the accuracy and completeness of submitted notification data; Request additional information as needed by phone or email; and Issue formal orders as needed requiring operators to correct or complete missing information. Operators who fail to comply with ETDA orders may face suspension of operations, revocation of their notification receipt, and public disclosure of their noncompliant status on the ETDA’s website. The ETDA will conduct follow-up workshops in July 2025 for operators whose data remains unclear or incomplete. Enforcement Framework and Penalties The ETDA outlined a three-tiered enforcement framework with escalating consequences for different types of violations, as follows: Failure to notify before commencing operations: Operators who begin services without proper notification may face criminal penalties under the Electronic Transactions Act, including up to one year of imprisonment, fines of up to THB 100,000 (approx. USD 3,070), or both. Additional consequences include suspension of operations and potential liability for company directors. Failure to correct or comply with official orders: Noncompliance with ETDA correction
June 13, 2025
In today’s digital age, cyberattacks have become a real threat to organizations worldwide. These attacks can range from phishing and malware to ransomware and distributed denial of service (DDoS) attacks. As the frequency and sophistication of these attacks increase, so does the importance of cybersecurity compliance. In the corporate world, compliance refers to the process of ensuring that a company and its employees adhere to all relevant laws, regulations, standards, and ethical practices—but it should not stop there. Compliance should also encompass asset recovery and disciplinary measures, which can both help organizations address incidents effectively and promote good governance. Cyberattacks are malicious attempts to access or damage a computer system or network, often carried out for financial gain, for political activism, or simply to cause disruption. For instance, a successful attack might involve an attacker creating an email address that closely resembles a legitimate one, perhaps by changing only one or two characters. That email address is then inserted into an existing conversation thread, making it appear as if the user with this email address was already part of the discussion. This tactic can easily deceive a recipient into believing the email was sent from a trusted source, thereby leading them to click on malicious links, provide sensitive information, or even make payments in accordance with the attacker’s request or instructions. Phishing attacks like these are particularly dangerous and can have a serious impact on the ongoing business of a corporation because they exploit the trust and familiarity established in the original email chain. Effective Mitigation Approaches Mechanisms for addressing the aftermath of a crisis provide important recourse to affected organizations, but effective compliance mechanisms can minimize the risk of such crises ever occurring. Companies should therefore prioritize preventative measures and implementation of effective crisis management schemes. Various legal
May 28, 2025
Tilleke & Gibbins attorneys in Vietnam have contributed the 2025 edition of Doing Business in Vietnam, a comprehensive Q&A-style resource from Thomson Reuters Practical Law that provides essential insights for companies navigating business operations in Vietnam. The guide presents a detailed overview of the country’s legal framework and regulatory environment, reflecting recent updates in Vietnamese legislation and practice. This annually updated guide offers key information on the following areas: Legal system: Structure of the Vietnamese judiciary and the role of codified law. Foreign investment: Conditions for market access, licensing requirements, foreign ownership restrictions, and investment incentives. Business vehicles: Formation and operation of legal entities, including limited liability companies, joint-stock companies, and representative offices. Employment: Employment contracts, social insurance, labor rights, and procedures for hiring foreign nationals. Tax: Overview of corporate income tax, personal income tax, value-added tax, and other tax obligations. Intellectual property: Procedures for protecting and enforcing patents, trademarks, copyrights, and other IP rights. Data protection: Compliance requirements under Vietnam’s data privacy laws, including the Personal Data Protection Decree. Competition law: Antitrust rules and regulatory oversight under the Law on Competition. Anti-bribery and corruption: Legal framework and enforcement practices aimed at curbing corrupt activities. E-commerce and digital business: Regulations governing online platforms, digital content, and cross-border services. Marketing and advertising: Laws and guidelines on advertising standards and consumer protection. Product regulation and liability: Safety requirements, product liability issues, and roles of relevant authorities. Doing Business in Vietnam is part of Practical Law’s global series of legal guides designed to support international practitioners and businesses. To access the most recent edition of the Vietnam guide, visit the Practical Law website and sign up for a free trial.