Art. 25.2.a of the Law on Cybersecurity stipulates that domestic and foreign enterprises providing services on telecommunications networks, the Internet, and value‑added services in cyberspace in Vietnam are required to verify user information at the time of registration of digital accounts. Under Art. 2.19, a “digital account” is defined as information employed for the purposes of authentication, verification, and authorisation in relation to the use of applications and services in cyberspace. A comparable obligation is also provided for in Art. 26.2.a of the previous Law on Cybersecurity.

Art. 23.3.e of Decree No. 147/2024/ND-CP provides that only foreign organisations, enterprises, and individuals engaged in the provision of cross-border information services to entities in Vietnam, either through the leasing of data storage services within Vietnam or by attaining a total of 100,000 or more regular monthly visits from Vietnam, calculated as an average over six consecutive months, are subject to specific obligations, namely that they must verify user accounts using Vietnamese telephone numbers. Foreign providers of social networking services may alternatively verify accounts through personal identification numbers, where users declare, in accordance with the law on electronic identification and authentication, that they do not possess a Vietnamese telephone number. Such providers are further required to verify accounts through personal identification numbers where users employ livestream features for commercial purposes under the same legal framework; and, in all cases, only duly verified accounts are permitted to post content, including articles, comments, and livestream sessions, or otherwise share information on social networking platforms.

Pursuant to Art. 15.1 of Decree No. 25/2011/ND-CP, individuals subscribing to telecommunications services are required to provide telecommunication enterprises with specific information. This includes the subscriber's full name, date of birth, and, for Vietnamese citizens, the identity card number, along with the date and place of issuance. For foreign citizens, passport details must be provided.

Art. 14 of the Law on Cybersecurity provides that administrators of information systems, defined in Art. 2.8 as agencies, organisations, or individuals with direct management authority over an information system, together with domestic and foreign enterprises offering services on telecommunications networks, the Internet, and value added services in cyberspace, are required to implement managerial and technical measures to prevent, detect, block, and remove information containing the forms of content specified in Art. 13, whether on systems under their control or upon the request of specialised cybersecurity protection authorities; such content includes material propagandising against the State, inciting unrest, undermining security, or disrupting public order, as well as content that seeks to sabotage policies on national unity and socio economic development, or that infringes upon the lawful rights and interests of organisations and individuals.

Art. 79.2 of Decree No. 147/2024/ND-CP stipulates that telecommunications enterprises providing Internet services, as well as Internet service providers, are required to implement measures to monitor, collect, and identify information that contravenes the law within their technical infrastructures and applications. Such measures must be undertaken in accordance with the guidance and directives issued by the Ministry of Information and Communications and the Ministry of Public Security of Vietnam. In relation to infringements of copyright and intellectual property, these obligations must be fulfilled in compliance with the Law on Intellectual Property and other relevant legal provisions.

It is reported that Telegram was blocked in Vietnam between 25 May and 10 July 2025. The government is reported to have instructed internet service providers on 21 May to block the application, citing Telegram’s alleged failure to cooperate with state authorities in efforts to combat criminal activity on the platform. The ban is understood to have followed cybersecurity legislation enacted in 2018 and 2024, under which technology companies are reportedly required to register with local authorities, cooperate with government requests, store user data domestically, and provide such data to the authorities upon request.

In November 2024, the Government issued Decree No. 147/2024/ND-CP on the management, provision, and use of internet services and online information (Decree 147), which entered into force in December 2024. This decree replaced Decree No. 72/2013/ND-CP, retaining most of its original provisions while introducing new and revised regulations.
Under Art. 23 of Decree 147, foreign organisations, enterprises, and individuals providing cross-border information services to users in Vietnam—whether through domestic data hosting arrangements or when their platforms receive 100,000 or more regular monthly visits from Vietnam (based on a six-month average)—are required to cooperate with authorities in removing or blocking content deemed to include prohibited acts. These include activities such as opposing the State, threatening national security or public order, disseminating propaganda, promoting obscenity or pornography, offending national customs and traditions, defaming individuals or organisations, and advertising banned goods or services, as outlined in Art. 8 of the Cybersecurity Law.
Numerous press outlets have raised concerns about the broad scope and potentially far-reaching implications of Decree 147, particularly in relation to its expansive powers to block online content.

According to Art. 13 of Decree 181/2013/ND-CP, Vietnamese companies and individuals who want to place online advertisements on foreign websites or platforms must advertise via agents in Vietnam. In addition, Pursuant to Art. 14 of the Decree, foreign companies and individuals who want to place online advertisements on Vietnamese websites or platforms must do so via Vietnamese agents.

According to Art. 95.3 of Decree No.15/2020/ND-CP, a fine ranging from VND 50,000,000 to VND 70,000,000 (approx. 2,040 USD to 2,860 USD) shall be imposed for advertising email and internet message services using servers not located in Vietnam.

Art. 23.3.dd of Decree No. 147/2024/ND-CP provides that foreign organisations, enterprises, and individuals engaged in the cross-border provision of information to entities in Vietnam, where such activities involve the use of data storage leasing services within Vietnam or where total regular monthly visits from Vietnam, calculated as an average over six consecutive months, reach 100,000 or more, are subject to specific obligations. These include the requirement to retain information about service users in Vietnam upon account registration, including full name, date of birth, and a Vietnamese telephone number or personal identification number. For users of social networking services who are minors (under 16 years of age), their parents or legal guardians must register the accounts using their own information. Additionally, such entities are obliged to provide user information to the Ministry of Information and Communications, the Ministry of Public Security, and other competent authorities upon receipt of a written request, for the purposes of state management, investigation, and the handling of legal violations concerning the management, provision, and use of Internet services and cyber information.

Art. 21 of the Law on Personal Data Protection stipulates that personal data controllers, as well as entities acting as both controllers and processors, are required to establish and retain a record of the personal data processing impact assessment. One original copy of this assessment must be submitted to the competent personal data protection authority within 60 days of the commencement of personal data processing. The personal data processing impact assessment is conducted once and applies for the entire duration of the operations of the personal data controller or of the entity acting as both controller and processor.
In addition, pursuant to Art. 33.2 of the Law, agencies and organisations are responsible for designating dedicated units and personnel with adequate capacity to ensure personal data protection, or for engaging external organisations or individuals to provide personal data protection services.
Arts. 24, 28.2, and 30.1.b of Decree No. 13/2023/ND‑CP already contain substantially similar requirements. That Decree is scheduled to be repealed in 2026, concurrently with the entry into force of the Law on Personal Data Protection.

Under Decree No. 121/2008/ND-CP, equity caps applicable to foreign investment are based on WTO commitments. That is, for fixed and mobile communications, as well as Internet services, the maximum foreign equity shares are set at 49% in facilities-based services (i.e. telecom sector with infrastructure facilities). The threshold may increase up to 65% for non-facilities-based services (i.e. telephony services with no network infrastructure) and 70% for VPN services after a three-year investing period in Vietnam.

Decree No. 147/2024/ND-CP contains several provisions requiring companies to provide user data directly to state authorities upon request, without expressly requiring a warrant or judicial authorisation. Art. 19.4 mandates that agencies, organisations, enterprises, and individuals utilising Internet resources must supply information and cooperate with competent authorities upon request. Art. 23.3.dd further provides that foreign organisations, enterprises, and individuals engaged in the cross-border provision of information to users in Vietnam, where they either lease data storage services within Vietnam or receive an average of at least 100,000 monthly visits from Vietnam over six consecutive months, are obliged to furnish information concerning service users in Vietnam to the Ministry of Information and Communications, the Ministry of Public Security, and other competent authorities upon written request, for the purposes of state management as well as the investigation and handling of legal violations. Art. 35.9 imposes a similar obligation on providers of social networking services to disclose user information to competent authorities upon written request in order to facilitate the investigation and resolution of violations relating to Internet services and online information. Finally, Art. 79.2 requires telecommunications enterprises and Internet service providers to supply information and data relating to subscribers suspected of online legal violations, enabling the accurate identification of relevant organisations and individuals, upon requests issued by the Ministry of Information and Communications or the Ministry of Public Security.

It is reported that the State retains equity participation in several telecommunications operators. In particular, the Ministry of Defence owns the Viettel Group, while both the MobiFone and the Vietnam Posts and Telecommunications Group are also state-owned enterprises. In addition, the Ministry of Public Security holds a majority stake (50.17%) in FPT Telecom.

It is reported that there is no requirement for functional or accounting separation required for operators with significant market power.