You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

August 15, 2025

Vietnam’s E-Commerce Legal Framework: A Deep Dive into the Draft E-Commerce Law

More than a decade after the issuance of Decree No. 52/2013/ND-CP (as amended by Decree No. 85/2021/ND-CP; collectively, “Decree 52”), Vietnam’s legal framework for e-commerce is under growing pressure to keep pace with the evolving digital economy. While Decree 52 has provided a foundational framework, it has shown certain limitations in keeping up with issues such as counterfeit goods, intellectual property enforcement, unqualified products, and emerging models like livestream selling and affiliate marketing.

To address these regulatory gaps, the Ministry of Industry and Trade (MOIT) has released the 2025 Draft E-Commerce Law (“Draft Law”) for public consultation. The Draft Law is intended to supersede the current framework under Decree 52 and establish a more detailed and comprehensive legal foundation for the regulations of e-commerce activities in Vietnam. It is currently expected to be submitted to the National Assembly for review and potential adoption during its 10th session in October 2025.

In this article, we discuss the Draft Law’s most significant updates and legal developments in comparison to existing regulations, and assess the practical challenges that businesses may face in preparing for implementation in the near future.

Platform Classification: Toward a More Nuanced Framework

Unlike Decree 52’s simpler structure, which broadly categorized platforms into either (i) websites selling goods and services or (ii) websites providing e-commerce services, the Draft Law introduces a more detailed framework that aims to classify platforms based on their technical functions and business models. Specifically, the Draft Law introduces a four-tier classification system for e-commerce platforms, consisting of: (i) Direct Business Platforms, (ii) Intermediary Platforms, (iii) Social Networks with E-Commerce Functions, and (iv) Multi-Service Integrated Platforms. This approach reflects an effort to more accurately capture the complexity of today’s e-commerce landscape, including hybrid platforms such as TikTok Shop.

While this approach reflects the growing complexity of the digital/e-commerce landscape, it currently lacks clear criteria or thresholds for distinguishing between categories. This ambiguity may create uncertainty for platforms that operate across multiple functions, such as combining direct sales, third-party marketplaces, and social commerce features. While such models may potentially fall under the “Multi-Service Integrated Platforms” category, the Draft Law does not currently provide clear criteria to distinguish between overlapping platform types. As a result, it remains unclear how these platforms should be classified and which set of compliance obligations would apply.

Operator Responsibilities: Broader Scope and Heightened Compliance Burden

While Decree 52 required platform registration and basic post-facto monitoring, the Draft Law significantly expands the scope of responsibilities imposed on platform operators. Under the Draft Law, platforms must conduct identity verification for all sellers, including foreign sellers; however, the types of documents deemed legally sufficient for verifying foreign entities have not yet been clarified.

Furthermore, the Draft Law introduces the implementation of automated content moderation tools to screen seller-generated content prior to display, marking a notable advancement beyond the requirements of Decree 52. While the obligation to remove unlawful content within 24 hours upon request from competent authorities remains consistent with Decree 52, the Draft Law imposes additional responsibilities for proactive monitoring and enhanced compliance, particularly in light of heightened regulatory concerns regarding counterfeit goods and consumer protection.

Livestream and Affiliate Regulation: New Obligations to Fill Regulatory Gaps

Previously unregulated under Decree 52, livestream selling and affiliate marketing are now expressly addressed under the Draft Law. These provisions reflect growing regulatory concern over KOLs and influencers promoting products without clear origin and/supporting documentation.

While the new requirements are intended to improve transparency and strengthen consumer protection, they also introduce additional compliance burdens, not only for individual marketers, but also for platform operators. In particular, platforms must implement mechanisms to (i) warn users/viewers of content that is unsuitable for children and (ii) monitor livestream content in real time, enabling the removal of prohibited information and the termination of livestreams containing violating content.

Cross-Border Rules: From Local Presence to Legal Accountability

Under Decree 52, foreign e-commerce platforms targeting Vietnam via Vietnamese domain names, language interfaces, or a high volume of domestic transactions are required to register with the authorities and either establish a representative office or appoint an authorized local representative. While the existing regulations do not fully ensure enforcement against violating foreign platforms, this requirement ensured that authorities had a local point of contact.

The Draft Law retains these jurisdictional thresholds but introduces a significant shift. Accordingly, the appointed local entity is now subject to joint liability for the platform’s compliance with Vietnamese law. This change reflects the MOIT’s efforts to close enforcement loopholes, particularly in relation to counterfeit goods, consumer protection, and cross-border tax compliance.

Supporting Services: Strengthening Oversight Across the E-commerce Chain

Decree 52 made only general references to supporting services such as logistics and payment, without defining their legal responsibilities or integrating them into the compliance framework. The Draft Law takes a more structured approach by explicitly identifying four categories of supporting services: technical infrastructure, logistics, payment, and electronic contract authentication. Providers of these services are now subject to specific obligations, including coordination with platforms and regulators, and implementation of internal inspection and monitoring mechanisms.

This shift seems to reflect the MOIT’s growing concern that the lack of regulation over third-party service providers has contributed to the circulation of counterfeit goods and tax evasion. By formally incorporating these service providers into the compliance framework, the Draft Law aims to close enforcement gaps and strengthen accountability across the digital supply chain.

Algorithm Disclosure: A New Compliance Burden for Platforms

For the first time, the Draft Law introduces provisions requiring e-commerce platforms to disclose information about their algorithms, such as logic, design, and modeling, upon request by competent authorities during violation inspections. While intended to enhance transparency and prevent abuse, this requirement would raise significant concerns for platform operators. Specifically, algorithms are often a company’s core intellectual property developed through substantial investment, and the Draft Law has not yet addressed the scope, format, or confidentiality protections surrounding such disclosures.

Outlook

Compared to the current regime, the Draft Law reflects a more structured and expansive approach, touching not only on core platform activities but also on affiliated functions such as payment, logistics, livestreaming, and data handling. While several provisions await further clarification, the direction of the government is clear: Vietnam is moving toward a more comprehensive, compliance-driven model of digital commerce regulation. Businesses are thus recommended to proactively review how the new obligations may impact their structures, operations, and risk exposure. Companies that adapt early will be best positioned to navigate the transition smoothly and maintain regulatory confidence in an increasingly complex e-commerce environment.

RELATED INSIGHTS​ 

February 26, 2026
Thailand is preparing to offer new tools for intellectual property enforcement as the Electronic Transactions Development Agency (ETDA) recently released for public consultation a draft notification requiring social media platforms to verify user identities and conduct know-your-customer (KYC) checks on advertisers. The draft Notification of the Electronic Transactions Commission on Measures to Prevent Technological Crimes for Social Media Service Providers, which is to be issued under the Emergency Decree on Measures for the Prevention and Suppression of Technological Crimes B.E. 2566 (2023), as amended in 2025, primarily aims to combat online fraud and technology-related crimes. However, its new obligations also provide IP owners with valuable tools to identify anonymous infringers. Key Regulatory Mandates The draft notification imposes several verification requirements on social media platforms operating in Thailand. These requirements also strengthen IP rights holders’ ability to identify anonymous infringers, as platforms must: Verify user identities through registered phone numbers and link all accounts to verifiable identities. Conduct KYC checks on advertisers, including individuals, companies, and any third-party payers. Perform heightened identity checks for high-risk or repeat offenders before publishing advertisements. Promptly remove content flagged by the Anti-Technology Crime Division and prescreen advertisements for prohibited or high-risk content. How IP Owners Can Use This Notification for Enforcement The phone number–based verification requirement enables IP owners to work more effectively with enforcement authorities in tracing individuals or entities responsible for infringing content. The comprehensive advertiser KYC obligations, including mandatory disclosure of third-party payment sources, create a clear audit trail even when bad actors attempt to obscure their identity through intermediaries or shell accounts. This traceability is essential for pursuing damages and dismantling organized counterfeit operations. The ETDA is now considering adjustments to the draft notification after receiving comments during the public consultation period, which ended on February 2, 2026. Following finalization
February 23, 2026
On February 17, 2026, Thailand’s Personal Data Protection Committee (PDPC) released its draft Guidelines on Personal Data Protection in the Development and Use of Artificial Intelligence. The draft guidelines, which translate data controller and data processor compliance obligations under the Personal Data Protection Act (PDPA) into measures tailored to AI development and deployment, are open for public comment until February 25, 2026. At a public hearing session on the draft guidelines held on February 19, the PDPC emphasized that its approach to AI is not to hinder innovation but to develop practical guidance supporting safe deployment while ensuring data protection. Although the guidelines are not legally binding, they indicate the regulator’s expectations and the likely direction of interpretation and enforcement. Scope of Application and Role of Stakeholders The guidelines will apply to all data controllers and data processors in Thailand, and to overseas data controllers and data processors whose data processing falls within the extraterritorial scope of the PDPA. The draft guidelines distinguish the roles of parties involved in AI deployment. Users of AI who determine the purpose of use and designate the input data, and retain outputs generated by the AI, are considered data controllers. In contrast, AI model providers or system integrators that process personal data under the instructions of the data controller are generally regarded as data processors. However, if an AI model provider utilizes user data for its own purposes, such as model fine-tuning or training, it may instead be classified as a data controller. Key Obligations for AI Data Collection and Use The basic principles of data processing under the PDPA must be maintained throughout the AI implementation lifecycle, from design to decommissioning, emphasizing accountability and privacy-by-design principles. The draft guidelines also stipulate the following: Data processing agreements (DPAs) should include model training prohibitions,
February 10, 2026
Data center and cloud investments are forming a major focus of private-sector investment in Thailand, with tech giants like Amazon, Google, Microsoft, and TikTok, as well as numerous telecom and data center companies, committing significant outlays to data center and cloud development. The country’s Board of Investment (BOI) approved projects worth THB 1.87 trillion in 2025, and THB 746 billion of this was from planned data center investments—by far the largest amount from any single industry. Thailand’s swift rise as a regional data center hub is fueled by surging demand for cloud, AI, and digital services, as well as large-scale investments from global tech firms. The country’s strategic location, competitive power costs, robust fiber infrastructure, expanding IT talent, and supportive government policies—including BOI incentives and streamlined approvals—have made it an attractive destination for scalable and sustainable digital infrastructure investments. The BOI’s proactive approach in updating promoted categories and providing both tax and non-tax incentives further ensures Thailand’s continued growth in this sector. 2025 BOI Changes for Data Centers In the middle of 2025, the BOI responded to the remarkable trend by updating investment‑promotion categories across various sectors (e.g., machinery and electrical equipment, public utilities, digital and innovative industries) to accommodate growing investment in data‑center projects. Before the change, which was detailed in a notification that has applied to investment promotion applications submitted from July 1, 2025, onward, data‑center projects under BOI promotion were granted a single A1 incentive (an eight‑year corporate income‑tax exemption) and subject to one uniform set of conditions. The July 2025 notification restructured promotion for data centers into two categories based on power‑usage efficiency: high‑efficiency data centers and other data centers. Under these rules, qualified high‑efficiency data centers are eligible for an eight‑year corporate income tax (CIT) exemption, while for other data centers this exemption is
February 4, 2026
On November 18, 2025, Vietnam’s Ministry of Finance released for public consultation a draft decree on administrative sanctions in the field of crypto assets and crypto asset markets (the “Draft Decree”), intended to implement Resolution No. 05/2025/NQ-CP dated September 9, 2025, on the pilot crypto asset market in Vietnam (“Resolution 05”). While Resolution 05 sets out who may participate and under what conditions, the Draft Decree addresses a more practical question for market participants, i.e., what happens if those conditions are not met. In doing so, the Draft Decree offers important insight into how Vietnamese regulators intend to supervise, discipline, and ultimately shape the crypto market during the pilot phase. Regulatory Scope and Overall Sanctions Architecture The Draft Decree applies to both domestic and foreign organizations and individuals engaging in crypto-related activities in Vietnam’s market. Covered entities include: (i) crypto asset issuers; (ii) crypto asset service providers, including trading platforms and market operators; (iii) Vietnamese and foreign investors participating in the pilot market; and (iv) other organizations involved in the offering, issuance, or provision of crypto-related services in Vietnam. The breadth of this scope is deliberate. It appears to reflect a regulatory view that cross-border structures, offshore platforms, and indirect participation may not necessarily insulate market actors from compliance obligations once they operate within the pilot framework. For the crypto industry, this may mark a shift from regulatory ambiguity toward a more explicit articulation of jurisdictional reach. At first glance, the Draft Decree’s monetary penalties appear restrained. The maximum fine per administrative violation is capped at VND 200 million (approx. USD 7,700) for organizations and VND 100 million (approx. USD 3,800) for individuals. However, focusing solely on fine levels risks missing the point. The Draft Decree also places great regulatory weight on supplementary sanctions and corrective measures, including: (i)