Self-certification is allowed in the country for radio transmission, electromagnetic interference (EMI) or electromagnetic compatibility (EMC). Vietnam allows foreign companies to self-certify that they comply with these standards, through a Supplier Declaration of Conformity (SDoC). The National technical regulation QCVN 118:2018/BTTTT requires conformity testing and conformity declaration. The supplier or manufacturer of the equipment declares the equipment meets the technical and administrative requirements. A testing laboratory recognized by the regulator tests the equipment, and the supplier registers this equipment with the regulator. These procedures are based on ISO/IEC 17050, with some modifications and requirements to be in line with the legislation framework of goods and products quality control of Vietnam.

Art. 9 of the Law on Cybersecurity provides that national security information systems must undergo cybersecurity appraisal and certification of compliance prior to their deployment and operation, be subject to periodic inspection and continuous cybersecurity supervision during use, and ensure the prompt detection, response to, and remediation of cybersecurity incidents. Such systems are defined as those information systems of strategic and particular importance in the fields of politics, national defence, security, diplomacy, the economy, and broader social activities, where cybersecurity incidents or legal breaches may adversely affect national security or seriously disrupt social order and public safety, and which are included in a list promulgated by the Prime Minister of Vietnam. These encompass, inter alia, systems relating to military, security, diplomatic, and cryptographic functions; systems for the storage and processing of state secrets; systems preserving artefacts and documents of exceptional importance; systems safeguarding hazardous materials; systems supporting the preservation, manufacture, and management of critical infrastructure associated with national security; key systems serving central governmental bodies and organisations; national information systems in sectors such as energy, finance, banking, telecommunications, transport, agriculture, natural resources and the environment, chemicals, healthcare, and culture; and automated control and monitoring systems at critical works and national security sites. Furthermore, Art. 15.4.b assigns to the Ministry of Public Security responsibility for conducting cybersecurity inspections of equipment, products, telecommunications services, and digital and electronic devices prior to their deployment within such national security information systems. Similar requirements were also contained in the previous Law on Cybersecurity.

Art. 36 of Law No. 86/2015/QH13 states that the responsibilities of users of cryptographic products and services include providing the necessary information on cryptographic keys to the competent state authorities upon request. The Law also introduces licensing requirements for tools that offer encryption as a primary function.

Sections 35 and 60 of Decree No. 52/2013/ND-CP provide that certain E-commerce services need to be licensed by the Ministry of Industry and Trade: E-commerce websites that permit participants to sell and purchase goods according to the method of goods exchange; evaluation and certification of personal data protection policies of traders, organisations and individuals participating in e-commerce activities; and certification of e-contracts.
In addition, Art. 44 states that traders and organisations providing online auction services must register the provision of auction services, and under Art. 52, traders, organisations or individuals may set up sales e-commerce websites if, among other conditions, they have notified the Ministry of Industry and Trade. Also, pursuant to the provisions of Art. 61, one of the conditions for conducting credit rating of e-commerce websites is being a trader or an organisation established under Vietnamese law.

The Ministry of Industry and Trade (MOIT) issued Circular No.59/2015/TT-BCT to regulate the management of e-commerce activities via mobile applications. The circular strictly regulates the operation of e-commerce on mobile applications, which requires registration to MOIT. The circular applies to all Vietnamese individuals and organisations, foreigners who reside in Vietnam, and foreigners and organisations who have a presence in Vietnam through investment, setting up branches, or representative offices.

In July 2012, the Vietnamese Ministry of Information and Communications introduced Circular No.11/2012/TT-BTTTT, which amended the list of prohibited imported IT products, with some exceptions. This was further extended and detailed by Circular 31/2015/TT-BTTTT, effective from December 15, 2015. This extension included additional guidelines for implementing the ban. Subsequently, on October 15, 2018, following Decree 69/2018/ND-CP, the Vietnamese Ministry of Information and Communications issued Circular No. 11/2018/TT-BTTTT, providing a comprehensive list of banned imported IT products. This new circular replaced Annex 1 of Circular 31/2015/TT-BTTTT and prohibited the import of the following items:
- HS8443: Printing machinery used for printing using plates, cylinders, and other printing components, excluding certain machines.
- HS8470: Calculating machines, pocket-size data recording and reproducing machines with calculating functions, and similar machines, excluding specific categories.
- HS8471: Automatic data processing machines, magnetic or optical readers, machines for transcribing data, and machines for processing data.
- HS8517: Telephone sets, wireless communication apparatus, and other transmission or reception devices, excluding specific categories.
- HS8518: Microphones, loudspeakers, headphones, amplifiers, and related devices.
- HS8525: Transmission apparatus for radio and television, as well as radar and radio remote control apparatus.
- HS8526: Radar apparatus, radio navigational aid apparatus, and radio remote control apparatus.
- HS8527: Reception apparatus for radio and broadcasting, with or without sound recording apparatus.
- HS8528: Reception apparatus for television and related devices.
- HS8534: Printed circuits.
- HS8540: Thermionic, cold cathode, or photocathode valves and tubes, including cathode-ray television picture tubes.
- HS8544: Insulated wires, cables, and other electric conductors, including optical fibre cables.

In November 2013, the Government of Vietnam issued Decree No. 187/2013/ND-CP on the implementation of Commercial Law regarding international trade in goods and activities of international agents relating to buying, selling, outsourcing, and transiting of goods. The Decree detailed a list of products to be banned from importation or to be required with an import license. Annex 2 of Decree 187/2013/ND-CP listed goods that require an import license. These include (i) Goods that need import control according to the provisions of international treaties to which Vietnam is a member; (ii) Radio transmitting and receiving equipment with a frequency band from 9 KHz to 400 GHz, with a capacity of 60 mW or more. In May 2018, the Government of Vietnam issued Decree No. 69/2018/ND-CP on Detailed provisions on a number of articles of the Commercial Law. The Decree replaced Decree No. 187. However, the list of import licensing requirements is reallocated to Annex 3 of the Decree 69/2018/ND-CP.

Vietnam's Law on Network Information Security (Law 86/2015/QH13), effective from July 1, 2016, places restrictions and conditions on entities involved in the import, export, and trade of network information security products with encryption capabilities. This law requires importers to navigate a complex process for obtaining import permits involving licenses, certificates of conformity, product specifications, commercial invoices, and contracts.

Decree No.108/2016/ND-CP further outlines the conditions for trading network information security products and services in accordance with Law No. 86/2015/QH13. Art. 4.2 designates the Vietnamese Ministry of Information and Communications (MIC) to compile a list of network information security products requiring import licenses. Following the issuance of the decree, MIC introduced Circular No.13/2018/TT-BTTTT, which details the list of network information security products necessitating import licenses and outlines the associated procedures and required documentation. The specific network information security products subject to import licensing include (i) HS847130 (portable digital automatic data processing machines); (ii) HS847141 (automatic data processing machines and units); (iii) HS847149 (digital automatic data processing machines and units)

A basic legal framework on intermediary liability beyond copyright infringement is absent in Vietnam's law and jurisprudence.

Art. 25.2.a of the Law on Cybersecurity stipulates that domestic and foreign enterprises providing services on telecommunications networks, the Internet, and value‑added services in cyberspace in Vietnam are required to verify user information at the time of registration of digital accounts. Under Art. 2.19, a “digital account” is defined as information employed for the purposes of authentication, verification, and authorisation in relation to the use of applications and services in cyberspace. A comparable obligation is also provided for in Art. 26.2.a of the previous Law on Cybersecurity.

Art. 23.3.e of Decree No. 147/2024/ND-CP provides that only foreign organisations, enterprises, and individuals engaged in the provision of cross-border information services to entities in Vietnam, either through the leasing of data storage services within Vietnam or by attaining a total of 100,000 or more regular monthly visits from Vietnam, calculated as an average over six consecutive months, are subject to specific obligations, namely that they must verify user accounts using Vietnamese telephone numbers. Foreign providers of social networking services may alternatively verify accounts through personal identification numbers, where users declare, in accordance with the law on electronic identification and authentication, that they do not possess a Vietnamese telephone number. Such providers are further required to verify accounts through personal identification numbers where users employ livestream features for commercial purposes under the same legal framework; and, in all cases, only duly verified accounts are permitted to post content, including articles, comments, and livestream sessions, or otherwise share information on social networking platforms.

Pursuant to Art. 15.1 of Decree No. 25/2011/ND-CP, individuals subscribing to telecommunications services are required to provide telecommunication enterprises with specific information. This includes the subscriber's full name, date of birth, and, for Vietnamese citizens, the identity card number, along with the date and place of issuance. For foreign citizens, passport details must be provided.

Art. 14 of the Law on Cybersecurity provides that administrators of information systems, defined in Art. 2.8 as agencies, organisations, or individuals with direct management authority over an information system, together with domestic and foreign enterprises offering services on telecommunications networks, the Internet, and value added services in cyberspace, are required to implement managerial and technical measures to prevent, detect, block, and remove information containing the forms of content specified in Art. 13, whether on systems under their control or upon the request of specialised cybersecurity protection authorities; such content includes material propagandising against the State, inciting unrest, undermining security, or disrupting public order, as well as content that seeks to sabotage policies on national unity and socio economic development, or that infringes upon the lawful rights and interests of organisations and individuals.

Art. 79.2 of Decree No. 147/2024/ND-CP stipulates that telecommunications enterprises providing Internet services, as well as Internet service providers, are required to implement measures to monitor, collect, and identify information that contravenes the law within their technical infrastructures and applications. Such measures must be undertaken in accordance with the guidance and directives issued by the Ministry of Information and Communications and the Ministry of Public Security of Vietnam. In relation to infringements of copyright and intellectual property, these obligations must be fulfilled in compliance with the Law on Intellectual Property and other relevant legal provisions.

It is reported that Telegram was blocked in Vietnam between 25 May and 10 July 2025. The government is reported to have instructed internet service providers on 21 May to block the application, citing Telegram’s alleged failure to cooperate with state authorities in efforts to combat criminal activity on the platform. The ban is understood to have followed cybersecurity legislation enacted in 2018 and 2024, under which technology companies are reportedly required to register with local authorities, cooperate with government requests, store user data domestically, and provide such data to the authorities upon request.