Art. 25.2.a of the Law on Cybersecurity stipulates that both domestic and foreign enterprises providing services on telecommunications networks, the Internet, and other value‑added services in cyberspace within Vietnam are under an obligation to supply user information to the specialised cybersecurity protection forces under the Ministry of Public Security within 24 hours of receiving a request, which may be made in written form, by email, by telephone, or through any other verified means of communication, for the purposes of verification, investigation, and the handling of cybersecurity law violations; in circumstances involving an emergency that threatens national security or human life, such information must be provided within three hours. The provision does not expressly indicate whether compliance with such requests is contingent upon the prior issuance of a court order, and a broadly comparable requirement was previously set out in Art. 26.2.a of the earlier Law on Cybersecurity.

Art. 17.1.c of the Law on Cyber Information Security No. 86/2015/QH13 requires technology companies to share user data at the request of competent state agencies. It also mandates that authorities be given decryption keys on request, and it introduces licensing requirements for tools that offer encryption as a primary function. There is no mention of a requirement for a court order.

Decree No. 17/2023/ND-CP establishes a safe harbour regime for intermediaries for copyright infringements. According to the Decree, to benefit from this safe harbour, Internet Service Providers (ISPs) must act promptly to remove or block content upon acquiring "knowledge" of copyright infringement. While Decree No. 17 does not define "knowledge," it considers takedown notices from authorities or rights holders as evidence of ISPs' "knowledge" without specifying whether such notices must be substantiated (Arts. 113.3 and 114.5).
Additionally, Decree No. 17 outlines the required information and documents for takedown notices and counter-responses, indicating that ISPs must take appropriate action—such as removal, blocking, or restoration—upon receipt of the complete set of required information and documents (Art. 111.4).

A basic legal framework on intermediary liability beyond copyright infringement is absent in Vietnam's law and jurisprudence.

Art. 25.2.a of the Law on Cybersecurity stipulates that domestic and foreign enterprises providing services on telecommunications networks, the Internet, and value‑added services in cyberspace in Vietnam are required to verify user information at the time of registration of digital accounts. Under Art. 2.19, a “digital account” is defined as information employed for the purposes of authentication, verification, and authorisation in relation to the use of applications and services in cyberspace. A comparable obligation is also provided for in Art. 26.2.a of the previous Law on Cybersecurity.

Art. 23.3.e of Decree No. 147/2024/ND-CP provides that only foreign organisations, enterprises, and individuals engaged in the provision of cross-border information services to entities in Vietnam, either through the leasing of data storage services within Vietnam or by attaining a total of 100,000 or more regular monthly visits from Vietnam, calculated as an average over six consecutive months, are subject to specific obligations, namely that they must verify user accounts using Vietnamese telephone numbers. Foreign providers of social networking services may alternatively verify accounts through personal identification numbers, where users declare, in accordance with the law on electronic identification and authentication, that they do not possess a Vietnamese telephone number. Such providers are further required to verify accounts through personal identification numbers where users employ livestream features for commercial purposes under the same legal framework; and, in all cases, only duly verified accounts are permitted to post content, including articles, comments, and livestream sessions, or otherwise share information on social networking platforms.

Pursuant to Art. 15.1 of Decree No. 25/2011/ND-CP, individuals subscribing to telecommunications services are required to provide telecommunication enterprises with specific information. This includes the subscriber's full name, date of birth, and, for Vietnamese citizens, the identity card number, along with the date and place of issuance. For foreign citizens, passport details must be provided.

Art. 14 of the Law on Cybersecurity provides that administrators of information systems, defined in Art. 2.8 as agencies, organisations, or individuals with direct management authority over an information system, together with domestic and foreign enterprises offering services on telecommunications networks, the Internet, and value added services in cyberspace, are required to implement managerial and technical measures to prevent, detect, block, and remove information containing the forms of content specified in Art. 13, whether on systems under their control or upon the request of specialised cybersecurity protection authorities; such content includes material propagandising against the State, inciting unrest, undermining security, or disrupting public order, as well as content that seeks to sabotage policies on national unity and socio economic development, or that infringes upon the lawful rights and interests of organisations and individuals.

Art. 79.2 of Decree No. 147/2024/ND-CP stipulates that telecommunications enterprises providing Internet services, as well as Internet service providers, are required to implement measures to monitor, collect, and identify information that contravenes the law within their technical infrastructures and applications. Such measures must be undertaken in accordance with the guidance and directives issued by the Ministry of Information and Communications and the Ministry of Public Security of Vietnam. In relation to infringements of copyright and intellectual property, these obligations must be fulfilled in compliance with the Law on Intellectual Property and other relevant legal provisions.

It is reported that Telegram was blocked in Vietnam between 25 May and 10 July 2025. The government is reported to have instructed internet service providers on 21 May to block the application, citing Telegram’s alleged failure to cooperate with state authorities in efforts to combat criminal activity on the platform. The ban is understood to have followed cybersecurity legislation enacted in 2018 and 2024, under which technology companies are reportedly required to register with local authorities, cooperate with government requests, store user data domestically, and provide such data to the authorities upon request.

In November 2024, the Government issued Decree No. 147/2024/ND-CP on the management, provision, and use of internet services and online information (Decree 147), which entered into force in December 2024. This decree replaced Decree No. 72/2013/ND-CP, retaining most of its original provisions while introducing new and revised regulations.
Under Art. 23 of Decree 147, foreign organisations, enterprises, and individuals providing cross-border information services to users in Vietnam—whether through domestic data hosting arrangements or when their platforms receive 100,000 or more regular monthly visits from Vietnam (based on a six-month average)—are required to cooperate with authorities in removing or blocking content deemed to include prohibited acts. These include activities such as opposing the State, threatening national security or public order, disseminating propaganda, promoting obscenity or pornography, offending national customs and traditions, defaming individuals or organisations, and advertising banned goods or services, as outlined in Art. 8 of the Cybersecurity Law.
Numerous press outlets have raised concerns about the broad scope and potentially far-reaching implications of Decree 147, particularly in relation to its expansive powers to block online content.

According to Art. 13 of Decree 181/2013/ND-CP, Vietnamese companies and individuals who want to place online advertisements on foreign websites or platforms must advertise via agents in Vietnam. In addition, Pursuant to Art. 14 of the Decree, foreign companies and individuals who want to place online advertisements on Vietnamese websites or platforms must do so via Vietnamese agents.

According to Art. 95.3 of Decree No.15/2020/ND-CP, a fine ranging from VND 50,000,000 to VND 70,000,000 (approx. 2,040 USD to 2,860 USD) shall be imposed for advertising email and internet message services using servers not located in Vietnam.

Pursuant to Art. 37 of Decree No. 147/2024/ND-CP, enterprises are permitted to release online G1 video games provided that they have obtained both a licence to provide such services and a decision authorising their release; G1 games are defined as those involving simultaneous interaction among multiple players through the enterprise’s game server systems. By contrast, enterprises may release online G2, G3, and G4 video games where they possess written confirmation both of their eligibility to provide such services and of their notification of the release, with G2 games involving interaction between players and the enterprise’s game server systems, G3 games involving interaction among multiple players without interaction with such server systems, and G4 games being those downloaded via networks without any interaction either among players or between players and the enterprise’s game server systems. Art. 39 sets out the conditions for the grant of licences to provide online G1 video game services, while Art. 48 prescribes the requirements to be satisfied by enterprises seeking certificates for the provision of online G2, G3, and G4 video game services.

It is reported that Vietnam prohibits the commercial importation of some products, including encryption devices and encryption software.