You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

July 27, 2026

Vietnam’s E-Commerce Law Reshapes Online IP Enforcement

Managing Intellectual Property

Vietnam’s new E-Commerce Law, which took effect on 1 July 2026 along with its implementing Decree No. 248/2026/ND-CP (Decree 248), marks a significant development in the country’s approach to online intellectual property (IP) enforcement, reflecting a clear shift from a reactive model of intermediary liability to one that expects platforms to play a more active role in preventing infringement.

From notice-and-takedown to platform responsibility

The most significant change introduced by the E-Commerce Law is the transformation of the legal role of e-commerce platforms. The existing safe harbor provisions under the IP Law and the copyright notice-and-takedown regime established by Decree 17/2023/ND-CP (Decree 17) largely required intermediaries to act only after receiving notice of infringement. Once infringing content had been removed, the platform’s legal obligation was generally considered fulfilled. The new legislation adopts a fundamentally different approach.

Article 17 of the E-Commerce Law requires intermediary platforms to screen information relating to goods and services before publication in order to prevent listings involving counterfeit or IP-infringing goods, and goods of unknown origin. Rather than relying exclusively on complaints from rights holders, platforms are now expected to implement preventive measures before infringing listings become publicly available.

Decree 248 further requires platforms to update keyword filters based on recommendations issued by competent authorities. These filtering mechanisms are intended to prevent prohibited listings from appearing on the platform and represent a further move away from a purely complaint-driven enforcement model.

The legislation also introduces Vietnam’s first statutory stay-down obligation. Under the E-Commerce Law and Decree 248, major digital platforms must maintain automated systems capable of reviewing, warning against, and removing unlawful listings while also implementing measures to prevent repeat violations, defined under Decree 248 as conduct that has previously been identified and handled by the platform, but continues to recur.

This obligation addresses one of the most persistent challenges in online brand protection. Under the previous framework, counterfeit listings frequently reappeared shortly after removal under different seller accounts or slightly modified product descriptions, forcing rights holders into an endless cycle of repeated takedown requests. The new legislation requires platforms not only to remove infringing listings but also to implement reasonable measures to reduce their reappearance.

Although the legislation does not prescribe any particular technology, compliance will likely require platforms to invest in tools such as image recognition, product fingerprinting, and seller behavior analysis. Whether implementation proves consistently effective remains to be seen, but it is clear that major platforms are expected to take active steps to prevent, rather than merely respond to, online infringement.

A unified enforcement framework for all IP rights

Another significant reform is the expansion of statutory online enforcement beyond copyright. Vietnam’s notice-and-takedown procedure under Decree 17 applies only to copyright and related rights. Trademark owners, patent holders and industrial design owners have traditionally relied on administrative enforcement or civil litigation, neither of which offers the speed or flexibility of platform-level enforcement.

The 2025 amendment to the IP Law and now the E-Commerce Law remove this distinction. These laws prohibit the trading of IP-infringing goods without limiting protection to any particular category of IP, while Decree 248 requires platforms to inspect, review, and promptly remove information relating to any IP-infringing goods upon requests from competent authorities.

The legislation also formalizes cooperation between e-commerce platforms and rights holders. Decree 248 requires platforms to establish publicly available complaint mechanisms through which IP owners may request the review, temporary removal, or blocking of listings showing indications of infringement. Although many major platforms had already introduced voluntary brand protection programs, the new legislation transforms this practice into a statutory obligation.

Notably, the E-Commerce Law does not establish a statutory counter-notice procedure comparable to that available under Decree 17 for copyright disputes. Government-directed removals remain subject to administrative review, while complaints submitted directly by rights holders are generally handled under each platform’s published complaint procedures. Compared with the copyright regime, this approach provides greater certainty for rights holders, although it also places greater responsibility on platforms to maintain fair and transparent complaint mechanisms.

For trademark owners, who account for the majority of online IP enforcement actions in Vietnam, the reforms provide the first dedicated statutory framework for platform-level enforcement.

Enforcement beyond the platform

The 2025 IP Law established a general framework governing intermediary service providers operating in cyberspace. Building on that foundation, the E-Commerce Law and Decree 248 prescribe how those principles apply in the e-commerce context through specific obligations for businesses supporting online transactions, giving practical effect to Vietnam’s broader intermediary liability reforms by extending compliance obligations across the e-commerce ecosystem.

Decree 248 extends these obligations beyond e-commerce platforms to technical infrastructure providers, logistics companies, and payment service providers. Upon requests from competent authorities, these entities may be required to block access to noncompliant platforms, suspend logistics services for infringing goods, or terminate payment services supporting infringing activities.

This significantly strengthens the enforcement framework against commercial-scale online infringement. Rather than focusing solely on individual listings, the legislation enables enforcement authorities to target the broader infrastructure supporting counterfeit operations. In many cases, disrupting payment, logistics, or technical services may prove more effective than repeatedly removing infringing listings.

The E-Commerce Law also strengthens Vietnam’s jurisdiction over foreign platforms. Overseas platforms exceeding specified transaction thresholds with Vietnamese consumers must register with the Ministry of Industry and Trade, establish a legal presence or appoint an authorized representative in Vietnam, and comply with the same obligations as domestic platforms. These localization requirements substantially improve the practical enforceability of Vietnamese law against cross-border platforms.

Looking ahead

Vietnam’s E-Commerce Law represents a significant evolution in the country’s online IP enforcement framework. Many aspects of implementation will continue to develop through regulatory guidance and enforcement practice. Nevertheless, it is clear that Vietnam has moved beyond a purely reactive model of intermediary liability toward one that expects major digital platforms to play an active role in preventing online infringement.

This article first appeared in Managing Intellectual Property.

RELATED INSIGHTS​ 

February 23, 2026
On February 17, 2026, Thailand’s Personal Data Protection Committee (PDPC) released its draft Guidelines on Personal Data Protection in the Development and Use of Artificial Intelligence. The draft guidelines, which translate data controller and data processor compliance obligations under the Personal Data Protection Act (PDPA) into measures tailored to AI development and deployment, are open for public comment until February 25, 2026. At a public hearing session on the draft guidelines held on February 19, the PDPC emphasized that its approach to AI is not to hinder innovation but to develop practical guidance supporting safe deployment while ensuring data protection. Although the guidelines are not legally binding, they indicate the regulator’s expectations and the likely direction of interpretation and enforcement. Scope of Application and Role of Stakeholders The guidelines will apply to all data controllers and data processors in Thailand, and to overseas data controllers and data processors whose data processing falls within the extraterritorial scope of the PDPA. The draft guidelines distinguish the roles of parties involved in AI deployment. Users of AI who determine the purpose of use and designate the input data, and retain outputs generated by the AI, are considered data controllers. In contrast, AI model providers or system integrators that process personal data under the instructions of the data controller are generally regarded as data processors. However, if an AI model provider utilizes user data for its own purposes, such as model fine-tuning or training, it may instead be classified as a data controller. Key Obligations for AI Data Collection and Use The basic principles of data processing under the PDPA must be maintained throughout the AI implementation lifecycle, from design to decommissioning, emphasizing accountability and privacy-by-design principles. The draft guidelines also stipulate the following: Data processing agreements (DPAs) should include model training prohibitions,
February 10, 2026
Data center and cloud investments are forming a major focus of private-sector investment in Thailand, with tech giants like Amazon, Google, Microsoft, and TikTok, as well as numerous telecom and data center companies, committing significant outlays to data center and cloud development. The country’s Board of Investment (BOI) approved projects worth THB 1.87 trillion in 2025, and THB 746 billion of this was from planned data center investments—by far the largest amount from any single industry. Thailand’s swift rise as a regional data center hub is fueled by surging demand for cloud, AI, and digital services, as well as large-scale investments from global tech firms. The country’s strategic location, competitive power costs, robust fiber infrastructure, expanding IT talent, and supportive government policies—including BOI incentives and streamlined approvals—have made it an attractive destination for scalable and sustainable digital infrastructure investments. The BOI’s proactive approach in updating promoted categories and providing both tax and non-tax incentives further ensures Thailand’s continued growth in this sector. 2025 BOI Changes for Data Centers In the middle of 2025, the BOI responded to the remarkable trend by updating investment‑promotion categories across various sectors (e.g., machinery and electrical equipment, public utilities, digital and innovative industries) to accommodate growing investment in data‑center projects. Before the change, which was detailed in a notification that has applied to investment promotion applications submitted from July 1, 2025, onward, data‑center projects under BOI promotion were granted a single A1 incentive (an eight‑year corporate income‑tax exemption) and subject to one uniform set of conditions. The July 2025 notification restructured promotion for data centers into two categories based on power‑usage efficiency: high‑efficiency data centers and other data centers. Under these rules, qualified high‑efficiency data centers are eligible for an eight‑year corporate income tax (CIT) exemption, while for other data centers this exemption is
February 4, 2026
On November 18, 2025, Vietnam’s Ministry of Finance released for public consultation a draft decree on administrative sanctions in the field of crypto assets and crypto asset markets (the “Draft Decree”), intended to implement Resolution No. 05/2025/NQ-CP dated September 9, 2025, on the pilot crypto asset market in Vietnam (“Resolution 05”). While Resolution 05 sets out who may participate and under what conditions, the Draft Decree addresses a more practical question for market participants, i.e., what happens if those conditions are not met. In doing so, the Draft Decree offers important insight into how Vietnamese regulators intend to supervise, discipline, and ultimately shape the crypto market during the pilot phase. Regulatory Scope and Overall Sanctions Architecture The Draft Decree applies to both domestic and foreign organizations and individuals engaging in crypto-related activities in Vietnam’s market. Covered entities include: (i) crypto asset issuers; (ii) crypto asset service providers, including trading platforms and market operators; (iii) Vietnamese and foreign investors participating in the pilot market; and (iv) other organizations involved in the offering, issuance, or provision of crypto-related services in Vietnam. The breadth of this scope is deliberate. It appears to reflect a regulatory view that cross-border structures, offshore platforms, and indirect participation may not necessarily insulate market actors from compliance obligations once they operate within the pilot framework. For the crypto industry, this may mark a shift from regulatory ambiguity toward a more explicit articulation of jurisdictional reach. At first glance, the Draft Decree’s monetary penalties appear restrained. The maximum fine per administrative violation is capped at VND 200 million (approx. USD 7,700) for organizations and VND 100 million (approx. USD 3,800) for individuals. However, focusing solely on fine levels risks missing the point. The Draft Decree also places great regulatory weight on supplementary sanctions and corrective measures, including: (i)
January 30, 2026
Thailand’s Data Privacy Day 2026, hosted by the Office of the Personal Data Protection Committee (PDPC), underscored the country’s commitment to strengthening personal data protection, advancing regulatory maturity, and preparing organizations for the next phase of PDPA enforcement. The event marked a clear shift from policy-level compliance toward “Privacy in Action,” signaling that operational readiness and real-world implementation are now priorities. The Office of the PDPC also emphasized that data protection is now a national economic enabler that supports digital trust, competitiveness, and sustainable growth, not just a compliance obligation. The following insights summarize the key takeaways from the Data Privacy Day 2026 event. PDPA in Real Life: What Happens to Your Data Today The Office of the PDPC provided concrete data on enforcement trends and real-world compliance issues facing organizations across Thailand. Complaints and trends. The Office of the PDPC’s Personal Data Protection Act (PDPA) Center recorded 2,672 PDPA-related complaints as of January 2026, with the highest volumes involving failure to comply with the data minimization principle, collection without lawful basis, and use and disclosure without lawful basis. Administrative penalties. Several administrative penalties have been imposed on data controllers and data processors across various sectors, including government, healthcare, retail, SMEs and e-commerce, ranging from tens of thousands to several million baht. Most violations stemmed from weak security measures, failure to notify data breaches within the required timeline, absence of a data protection officer (DPO) when required, and noncompliance with governance requirements such as the Record of Processing Activities (ROPA) and data processing agreements with data processors. Case studies. The Office of the PDPC highlighted specific examples of violations: Hospitals misused personal data for purposes beyond their intended scope (e.g., using personal data collected for providing medical services to send birthday cards) Vendors compromised systems due to inadequate password