It is reported that the State retains equity participation in several telecommunications operators. In particular, the Ministry of Defence owns the Viettel Group, while both the MobiFone and the Vietnam Posts and Telecommunications Group are also state-owned enterprises. In addition, the Ministry of Public Security holds a majority stake (50.17%) in FPT Telecom.

It is reported that there is no requirement for functional or accounting separation required for operators with significant market power.

Arts. 19-21 of Decree No. 25/2011/ND-CP outline the requirements for enterprises applying for a license in the telecom sector in Vietnam. These requirements vary across types of service and geographical coverage. They include minimum capital requirements from VND 5 Billion (approx. 218,000 USD) to VND 500 Billion (approx. 21.8 million USD) and investment plans from VND 15 billion (approx. 700,00 USD) to 7,500 VND Billion (approx. 322.5 million USD) among other requirements.

Vietnam has appended the World Trade Organization (WTO) Telecom Reference Paper to its schedule of commitments.

Vietnam does not have an independent telecom authority. The Authority of Telecommunications is a ministerial unit which performs the advisory and regulatory functions over the telecommunications sectors nationwide.

Art. 25.3 of the Law on Cybersecurity stipulates that both domestic and foreign enterprises providing services via telecommunications networks, the Internet, and value-added services in cyberspace within Vietnam, and which collect, use, analyse, or process personal data, data concerning service users’ relationships, or data generated by service users in Vietnam, are required to implement data protection measures in accordance with the law. Such data must be stored within the territory of Vietnam for the duration prescribed by the Government of Vietnam. This replaces Law on Cybersecurity No. 24/2018/QH14 and Decree No. 53/2022/ND-CP Detailing Some Articles of the Law on Cybersecurity, which contained similar restrictions.

According to Art. 7.4 of Circular No. 24, electronic general information websites and social networking platforms licensed to operate in Vietnam are required to employ at least one ".vn" domain name and to store data on servers whose IP addresses are located within the territory of Vietnam. Art. 44.1(d) of Decree No. 15/2020/ND-CP stipulates penalties for failure to use the national domain name ".vn" or for failing to store information on a server system with an IP address in Vietnam. This provision applies to licensed electronic newspapers, general electronic information websites, electronic portals, and social networks.

Art. 30 of Decree 163 stipulates that data belonging to state authorities utilising data centre or cloud services must be stored exclusively within the territory of Vietnam. It is reported that this provision implies that a foreign data centre or cloud service provider seeking to contract with a state agency would be required to establish facilities within Vietnam.

Art. 27 of Decree No. 147/2024/ND-CP mandates that general electronic information websites and social networking platforms must store user data on servers utilising Internet Protocol (IP) addresses located within the territory of Vietnam. In addition, it requires the presence of at least one server situated in Vietnam for the purposes of inspection and data provision. Art. 3 defines a general information website as an electronic information website of an agency, organisation, or enterprise that provides general information.
Decree No. 147/2024/ND-CP supersedes Decree No. 72/2013/ND-CP, which, in Arts. 24, 25, 28, and 34, previously imposed similar requirements on providers of websites, social networks, mobile network-based information services, and online gaming services, respectively, stipulating that they maintain at least one server within the country.

Art. 20 of the Law on Personal Data Protection stipulates that agencies, organisations and individuals engaging in specified forms of cross‑border personal data transfer must prepare an impact assessment dossier and submit one original copy to the authority responsible for personal data protection within 60 days of the initial transfer. These activities include transferring personal data stored in Vietnam to data systems located abroad, transferring personal data from Vietnam to foreign organisations or individuals, and processing personal data collected in Vietnam through platforms located outside the territory of Vietnam. Such an impact assessment is required to be conducted only once and remains valid for the entire duration of the operations of the relevant entity. The competent authority may decide to request the suspension of cross‑border personal data transfers where it determines that the use of the transferred data may adversely affect national defence or security. However, certain cases are exempt from the requirement to conduct a cross‑border transfer impact assessment, including transfers carried out by competent state authorities, the storage of employees’ personal data by agencies and organisations on cloud computing services, transfers initiated directly by the data subject, and other cases as prescribed by the Government.
Art. 25 of Decree No. 13/2023/ND-CP already contains substantially similar restrictions on cross‑border transfers of personal data. That Decree is scheduled to be repealed in 2026, concurrently with the entry into force of the Law on Personal Data Protection.

Art. 23 of the Data Law provides that the cross-border transfer of core data or important data must be carried out in a manner that ensures national defence, security, and the protection of national interests, public interests, and the rights and legitimate interests of data subjects and data owners, in accordance with the laws of Vietnam and the international treaties to which Vietnam is a party. The cross-border transfer of core data or important data encompasses: (i) the transfer of data stored within the territory of Vietnam to data storage systems located outside Vietnam; (ii) the transfer of data by Vietnamese agencies, organisations, and individuals to foreign agencies, organisations, and individuals; and (iii) the use by Vietnamese agencies, organisations, and individuals of offshore platforms for data processing purposes.
Under the Data Law, important data refers to information the compromise of which may affect national defence, security, foreign relations, macroeconomic stability, social order, public health, or public safety, as specified in the list promulgated by the Prime Minister. Core data constitutes a specific subset of important data that has a direct and immediate impact on these areas.
It is not yet clear which conditions will apply to these transfers.

Vietnam has adopted the World Intellectual Property Organization (WIPO) Performances and Phonograms Treaty.

The Law on Intellectual Property provides a framework for effective protection of trade secrets.

Circular No. 40 seeks to enhance the legal framework governing the prioritisation of domestically produced information technology (IT) products and services in investment, hiring, and procurement, as mandated by Art. 4 of Decree No. 73/2019/ND-CP. The Circular provides guidance to state agencies on consulting and accessing information regarding prioritised IT products and services for these purposes. Enterprises whose IT products and services meet the priority criteria outlined in the Circular (Arts. 5-9) are eligible to receive preferential consideration from state agencies in investment, leasing, and procurement processes.

Art. 13.4.b of the Law on Telecommunications stipulates that service providers owning network infrastructure are under an obligation to lease passive infrastructure to other telecommunications enterprises, provided that such leasing is consistent with the approved passive infrastructure master plans and is both economically and technically feasible. Art. 47 further provides that the sharing of telecommunications infrastructure shall be conducted pursuant to contractual arrangements that ensure the protection of the lawful rights and interests of all relevant stakeholders. Where the stakeholders are unable to reach agreement on the pricing of shared telecommunications infrastructure, negotiations shall be undertaken in accordance with the legal framework governing price regulation. In the event that agreement cannot be reached on other aspects of infrastructure sharing, the matter shall be determined by the competent State authorities.