Art. 21 of the Law on Personal Data Protection stipulates that personal data controllers, as well as entities acting as both controllers and processors, are required to establish and retain a record of the personal data processing impact assessment. One original copy of this assessment must be submitted to the competent personal data protection authority within 60 days of the commencement of personal data processing. The personal data processing impact assessment is conducted once and applies for the entire duration of the operations of the personal data controller or of the entity acting as both controller and processor.
In addition, pursuant to Art. 33.2 of the Law, agencies and organisations are responsible for designating dedicated units and personnel with adequate capacity to ensure personal data protection, or for engaging external organisations or individuals to provide personal data protection services.
Arts. 24, 28.2, and 30.1.b of Decree No. 13/2023/ND‑CP already contain substantially similar requirements. That Decree is scheduled to be repealed in 2026, concurrently with the entry into force of the Law on Personal Data Protection.

Under Decree No. 121/2008/ND-CP, equity caps applicable to foreign investment are based on WTO commitments. That is, for fixed and mobile communications, as well as Internet services, the maximum foreign equity shares are set at 49% in facilities-based services (i.e. telecom sector with infrastructure facilities). The threshold may increase up to 65% for non-facilities-based services (i.e. telephony services with no network infrastructure) and 70% for VPN services after a three-year investing period in Vietnam.

Decree No. 147/2024/ND-CP contains several provisions requiring companies to provide user data directly to state authorities upon request, without expressly requiring a warrant or judicial authorisation. Art. 19.4 mandates that agencies, organisations, enterprises, and individuals utilising Internet resources must supply information and cooperate with competent authorities upon request. Art. 23.3.dd further provides that foreign organisations, enterprises, and individuals engaged in the cross-border provision of information to users in Vietnam, where they either lease data storage services within Vietnam or receive an average of at least 100,000 monthly visits from Vietnam over six consecutive months, are obliged to furnish information concerning service users in Vietnam to the Ministry of Information and Communications, the Ministry of Public Security, and other competent authorities upon written request, for the purposes of state management as well as the investigation and handling of legal violations. Art. 35.9 imposes a similar obligation on providers of social networking services to disclose user information to competent authorities upon written request in order to facilitate the investigation and resolution of violations relating to Internet services and online information. Finally, Art. 79.2 requires telecommunications enterprises and Internet service providers to supply information and data relating to subscribers suspected of online legal violations, enabling the accurate identification of relevant organisations and individuals, upon requests issued by the Ministry of Information and Communications or the Ministry of Public Security.

It is reported that the State retains equity participation in several telecommunications operators. In particular, the Ministry of Defence owns the Viettel Group, while both the MobiFone and the Vietnam Posts and Telecommunications Group are also state-owned enterprises. In addition, the Ministry of Public Security holds a majority stake (50.17%) in FPT Telecom.

It is reported that there is no requirement for functional or accounting separation required for operators with significant market power.

Arts. 19-21 of Decree No. 25/2011/ND-CP outline the requirements for enterprises applying for a license in the telecom sector in Vietnam. These requirements vary across types of service and geographical coverage. They include minimum capital requirements from VND 5 Billion (approx. 218,000 USD) to VND 500 Billion (approx. 21.8 million USD) and investment plans from VND 15 billion (approx. 700,00 USD) to 7,500 VND Billion (approx. 322.5 million USD) among other requirements.

Vietnam has appended the World Trade Organization (WTO) Telecom Reference Paper to its schedule of commitments.

Vietnam does not have an independent telecom authority. The Authority of Telecommunications is a ministerial unit which performs the advisory and regulatory functions over the telecommunications sectors nationwide.

Art. 25.3 of the Law on Cybersecurity stipulates that both domestic and foreign enterprises providing services via telecommunications networks, the Internet, and value-added services in cyberspace within Vietnam, and which collect, use, analyse, or process personal data, data concerning service users’ relationships, or data generated by service users in Vietnam, are required to implement data protection measures in accordance with the law. Such data must be stored within the territory of Vietnam for the duration prescribed by the Government of Vietnam. This replaces Law on Cybersecurity No. 24/2018/QH14 and Decree No. 53/2022/ND-CP Detailing Some Articles of the Law on Cybersecurity, which contained similar restrictions.

According to Art. 7.4 of Circular No. 24, electronic general information websites and social networking platforms licensed to operate in Vietnam are required to employ at least one ".vn" domain name and to store data on servers whose IP addresses are located within the territory of Vietnam. Art. 44.1(d) of Decree No. 15/2020/ND-CP stipulates penalties for failure to use the national domain name ".vn" or for failing to store information on a server system with an IP address in Vietnam. This provision applies to licensed electronic newspapers, general electronic information websites, electronic portals, and social networks.

Art. 30 of Decree 163 stipulates that data belonging to state authorities utilising data centre or cloud services must be stored exclusively within the territory of Vietnam. It is reported that this provision implies that a foreign data centre or cloud service provider seeking to contract with a state agency would be required to establish facilities within Vietnam.

Vietnam’s copyright regime is governed by Law No. 50/2005/QH11 on Intellectual Property Rights and supplemented by Decree 17/2023 on Copyright. However, the exceptions outlined in this framework do not adhere to the fair use or fair dealing models, thereby restricting the lawful use of copyrighted works by others. Art. 25 of Law No. 50/2005/QH11 enumerates these exceptions, with Decree 17/2023 providing further clarification on their application. Notable exceptions include the recitation of works without distorting the author's views in articles for newspapers or periodicals, radio or television broadcasts, or documentaries, as well as the use of works in schools for teaching purposes, provided it does not misrepresent the author’s views and is not for commercial gain, among others.

It is reported that Vietnam is a major source of online piracy and continues to host some of the most prominent English‑language copyright‑infringing websites and services worldwide, many of which target an international audience. The operators of these platforms are widely believed to be based in Vietnam, partly because of the perception that the country offers a relatively permissive environment for online piracy. Stakeholders report that Vietnam has the highest incidence of online piracy in the Asia‑Pacific region, one of the highest levels of music piracy globally, and is ranked seventh worldwide for participation in the piracy of certain video games. Although right holders welcomed landmark criminal convictions in two online piracy cases, as well as the Fmovies case, in which Vietnam’s enforcement authorities cooperated with United States enforcement authorities and other stakeholders to shut down Fmovies and associated piracy sites, all defendants received suspended sentences and were required to pay only comparatively modest financial penalties.

Vietnam has adopted the World Intellectual Property Organization (WIPO) Copyright Treaty.

Vietnam has adopted the World Intellectual Property Organization (WIPO) Performances and Phonograms Treaty.