You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

August 15, 2025

Vietnam’s E-Commerce Legal Framework: A Deep Dive into the Draft E-Commerce Law

More than a decade after the issuance of Decree No. 52/2013/ND-CP (as amended by Decree No. 85/2021/ND-CP; collectively, “Decree 52”), Vietnam’s legal framework for e-commerce is under growing pressure to keep pace with the evolving digital economy. While Decree 52 has provided a foundational framework, it has shown certain limitations in keeping up with issues such as counterfeit goods, intellectual property enforcement, unqualified products, and emerging models like livestream selling and affiliate marketing.

To address these regulatory gaps, the Ministry of Industry and Trade (MOIT) has released the 2025 Draft E-Commerce Law (“Draft Law”) for public consultation. The Draft Law is intended to supersede the current framework under Decree 52 and establish a more detailed and comprehensive legal foundation for the regulations of e-commerce activities in Vietnam. It is currently expected to be submitted to the National Assembly for review and potential adoption during its 10th session in October 2025.

In this article, we discuss the Draft Law’s most significant updates and legal developments in comparison to existing regulations, and assess the practical challenges that businesses may face in preparing for implementation in the near future.

Platform Classification: Toward a More Nuanced Framework

Unlike Decree 52’s simpler structure, which broadly categorized platforms into either (i) websites selling goods and services or (ii) websites providing e-commerce services, the Draft Law introduces a more detailed framework that aims to classify platforms based on their technical functions and business models. Specifically, the Draft Law introduces a four-tier classification system for e-commerce platforms, consisting of: (i) Direct Business Platforms, (ii) Intermediary Platforms, (iii) Social Networks with E-Commerce Functions, and (iv) Multi-Service Integrated Platforms. This approach reflects an effort to more accurately capture the complexity of today’s e-commerce landscape, including hybrid platforms such as TikTok Shop.

While this approach reflects the growing complexity of the digital/e-commerce landscape, it currently lacks clear criteria or thresholds for distinguishing between categories. This ambiguity may create uncertainty for platforms that operate across multiple functions, such as combining direct sales, third-party marketplaces, and social commerce features. While such models may potentially fall under the “Multi-Service Integrated Platforms” category, the Draft Law does not currently provide clear criteria to distinguish between overlapping platform types. As a result, it remains unclear how these platforms should be classified and which set of compliance obligations would apply.

Operator Responsibilities: Broader Scope and Heightened Compliance Burden

While Decree 52 required platform registration and basic post-facto monitoring, the Draft Law significantly expands the scope of responsibilities imposed on platform operators. Under the Draft Law, platforms must conduct identity verification for all sellers, including foreign sellers; however, the types of documents deemed legally sufficient for verifying foreign entities have not yet been clarified.

Furthermore, the Draft Law introduces the implementation of automated content moderation tools to screen seller-generated content prior to display, marking a notable advancement beyond the requirements of Decree 52. While the obligation to remove unlawful content within 24 hours upon request from competent authorities remains consistent with Decree 52, the Draft Law imposes additional responsibilities for proactive monitoring and enhanced compliance, particularly in light of heightened regulatory concerns regarding counterfeit goods and consumer protection.

Livestream and Affiliate Regulation: New Obligations to Fill Regulatory Gaps

Previously unregulated under Decree 52, livestream selling and affiliate marketing are now expressly addressed under the Draft Law. These provisions reflect growing regulatory concern over KOLs and influencers promoting products without clear origin and/supporting documentation.

While the new requirements are intended to improve transparency and strengthen consumer protection, they also introduce additional compliance burdens, not only for individual marketers, but also for platform operators. In particular, platforms must implement mechanisms to (i) warn users/viewers of content that is unsuitable for children and (ii) monitor livestream content in real time, enabling the removal of prohibited information and the termination of livestreams containing violating content.

Cross-Border Rules: From Local Presence to Legal Accountability

Under Decree 52, foreign e-commerce platforms targeting Vietnam via Vietnamese domain names, language interfaces, or a high volume of domestic transactions are required to register with the authorities and either establish a representative office or appoint an authorized local representative. While the existing regulations do not fully ensure enforcement against violating foreign platforms, this requirement ensured that authorities had a local point of contact.

The Draft Law retains these jurisdictional thresholds but introduces a significant shift. Accordingly, the appointed local entity is now subject to joint liability for the platform’s compliance with Vietnamese law. This change reflects the MOIT’s efforts to close enforcement loopholes, particularly in relation to counterfeit goods, consumer protection, and cross-border tax compliance.

Supporting Services: Strengthening Oversight Across the E-commerce Chain

Decree 52 made only general references to supporting services such as logistics and payment, without defining their legal responsibilities or integrating them into the compliance framework. The Draft Law takes a more structured approach by explicitly identifying four categories of supporting services: technical infrastructure, logistics, payment, and electronic contract authentication. Providers of these services are now subject to specific obligations, including coordination with platforms and regulators, and implementation of internal inspection and monitoring mechanisms.

This shift seems to reflect the MOIT’s growing concern that the lack of regulation over third-party service providers has contributed to the circulation of counterfeit goods and tax evasion. By formally incorporating these service providers into the compliance framework, the Draft Law aims to close enforcement gaps and strengthen accountability across the digital supply chain.

Algorithm Disclosure: A New Compliance Burden for Platforms

For the first time, the Draft Law introduces provisions requiring e-commerce platforms to disclose information about their algorithms, such as logic, design, and modeling, upon request by competent authorities during violation inspections. While intended to enhance transparency and prevent abuse, this requirement would raise significant concerns for platform operators. Specifically, algorithms are often a company’s core intellectual property developed through substantial investment, and the Draft Law has not yet addressed the scope, format, or confidentiality protections surrounding such disclosures.

Outlook

Compared to the current regime, the Draft Law reflects a more structured and expansive approach, touching not only on core platform activities but also on affiliated functions such as payment, logistics, livestreaming, and data handling. While several provisions await further clarification, the direction of the government is clear: Vietnam is moving toward a more comprehensive, compliance-driven model of digital commerce regulation. Businesses are thus recommended to proactively review how the new obligations may impact their structures, operations, and risk exposure. Companies that adapt early will be best positioned to navigate the transition smoothly and maintain regulatory confidence in an increasingly complex e-commerce environment.

RELATED INSIGHTS​ 

September 24, 2025
On September 12, 2025, the Bank of Thailand (BOT) officially released its AI Risk Management Guidelines for Financial Service Providers, building upon the draft guidelines issued in June 2025. The guidelines reflect a balanced approach, encouraging innovation while safeguarding financial stability and consumer protection. The guidelines are targeted at all financial service providers, including financial institutions and special financial institutions under the Financial Institution Business Act, as well as payment providers under the Payment Systems Act. The guidelines apply to both AI systems developed in-house and those developed by third parties that are adopted for use by financial service providers. AI Risk Management Guidelines The two main pillars in managing AI risk are (1) governance of AI system implementation and (2) AI system development and security controls, consisting of the following key elements: 1. Governance Stakeholder roles and responsibilities. Boards and senior management assume accountability for decisions and operations involving AI systems, and are responsible for defining roles and responsibilities for AI oversight. This includes establishing an AI system usage policy, designating personnel responsible for AI risk management, and building awareness of AI-related risk within the organization. Organizations are expected to foster internal capabilities to use AI securely and avoid overreliance that could compromise business continuity or customer service. AI system usage policy. Policies governing AI usage should align with organizational goals, regulatory obligations, and recognized responsible AI frameworks—such as the FEAT principles (fairness, ethics, accountability, and transparency). These policies should be reviewed regularly to respond to technological advancements and evolving risk profiles. Risk management throughout the AI lifecycle. Risk management should encompass the entire AI lifecycle, from establishing risk appetite to implementing continuous risk assessment and control measures tailored to specific use cases. Financial service providers should assess risks and impacts of AI usage on operations and customer services.
September 22, 2025
On September 15, 2025, Vietnam’s Ministry of Science and Technology announced that the country will issue an updated version of its National AI Strategy (first issued in 2021) and its first-ever AI Law by the end of this year. The ministry emphasized that the AI strategy is not just a legal framework, but a commitment to embracing AI to drive Vietnam into a new era. The AI adoption plan is set as a priority of the country, and marks a significant step in shaping Vietnam’s AI governance and innovation landscape. Highlights of the plan include the following: Strategic vision. Vietnam’s ambition is to leverage AI for economic growth, social development, and global competitiveness, under the guiding principle “AI for humans – safe, autonomous, cooperative, inclusive, and sustainable.” AI as national infrastructure. The updated strategy positions AI as core national infrastructure, comparable to electricity or the internet, aiming to provide every citizen with a “personal digital assistant.” Core principles for AI legislation. The AI Law will be built around the following six core principles: Risk-based regulation Transparency and accountability Human-centric development Domestic AI autonomy AI as a driver of sustainable growth Digital sovereignty, with data, infrastructure, and AI technology being three strategic pillars Ethics and openness. A National AI Ethics Code will accompany the upcoming law, aligned with international standards but tailored to the Vietnamese context. The government emphasizes open standards and open-source development. Market development and incentives. The government plans to expand domestic AI adoption, particularly in public services and key industries. The National Technology Innovation Fund (NATIF) will allocate at least 40% of its budget to AI projects, prioritizing SMEs through vouchers for locally developed AI solutions. Background on AI Law Development Regulations on AI are found in various Vietnamese laws and regulations, notably the recently adopted Law
September 16, 2025
Thailand has enacted amended alcohol control legislation that significantly tightens restrictions on marketing and advertising, strengthens enforcement, and creates mechanisms to support the country’s tourism objectives. The Alcoholic Beverage Control Act (No. 2) B.E. 2568 (2025), published in the Government Gazette on September 9, 2025, will take effect on November 8, 2025. Key aspects of the new law are outlined below. Continuation of Sales-Hour Restrictions Sales-hour restrictions remain in effect, though now under an updated regulatory pathway. Alcohol sales are permitted only between 11:00 a.m. and 2:00 p.m. and between 5:00 p.m. and midnight, with exceptions for airport terminals, entertainment venues under the Entertainment Place Act 1966, and hotels. Despite earlier discussions about relaxing these hours, no changes have been implemented under the new law. Enhanced Seller Responsibilities Sellers are now expressly permitted to check identification cards to verify purchaser age and may assess the condition of intoxicated customers. The assessment conditions will be announced in a forthcoming notification from the director of the Department of Disease Control. Sellers who willfully or negligently violate the law and cause damage to life, health, or property face possible penalties. Alcohol Vending Machines Permitted The law allows alcohol to be sold in vending machines that can verify buyer information and comply with rules, procedures, and conditions to be prescribed by the Alcoholic Beverage Control Committee. This means the industry must await the committee’s implementing regulations before deploying such machines. Expanded Marketing and Advertising Restrictions The amended law introduces a new suite of advertising restrictions, including more detailed and expansive definitions involving marketing and promotions. “Marketing communication” is broadly defined to include any direct or indirect act of publicizing, presenting, or disseminating information about alcoholic beverages through advertising, public relations, sales promotions, sponsorships, or any other means that may induce or encourage the
September 12, 2025
On September 10, 2025, Vietnam’s National Credit Information Center (CIC) reported to the Vietnam Cybersecurity Emergency Response Team (VNCERT) a suspected significant cybersecurity incident involving unauthorized access to the CIC’s credit information database. A hacker group has claimed responsibility and allegedly posted over 160 million records for sale, including sensitive personal and financial data. Implications for Banks and Financial Institutions Companies that share customers’ or potential customers’ personal data with the CIC for credit scoring or other purposes—and continue to act as a data controller for such data—may be obligated under Vietnam’s Personal Data Protection Decree (PDPD) and related regulations to: Notify A05 (Department of Cybersecurity and High-Tech Crime Prevention) and the State Bank of Vietnam without delay. Inform affected individuals if their personal data is at risk. Recommended Actions Companies that could be impacted by this data breach should take the following actions: Conduct an internal review of CIC-related data in their systems, and identify whether and how the systems have been affected by this incident. Assess whether to notify regulators and customers/potential customers. Enhance cybersecurity controls, monitor for suspicious activity, and implement additional safeguards to prevent secondary breaches.