In November 2024, the Government issued Decree No. 147/2024/ND-CP on the management, provision, and use of internet services and online information (Decree 147), which entered into force in December 2024. This decree replaced Decree No. 72/2013/ND-CP, retaining most of its original provisions while introducing new and revised regulations.
Under Art. 23 of Decree 147, foreign organisations, enterprises, and individuals providing cross-border information services to users in Vietnam—whether through domestic data hosting arrangements or when their platforms receive 100,000 or more regular monthly visits from Vietnam (based on a six-month average)—are required to cooperate with authorities in removing or blocking content deemed to include prohibited acts. These include activities such as opposing the State, threatening national security or public order, disseminating propaganda, promoting obscenity or pornography, offending national customs and traditions, defaming individuals or organisations, and advertising banned goods or services, as outlined in Art. 8 of the Cybersecurity Law.
Numerous press outlets have raised concerns about the broad scope and potentially far-reaching implications of Decree 147, particularly in relation to its expansive powers to block online content.

Vietnam has joined an agreement with binding commitments to open transfers of data across borders: the Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP, Art. 14.11). However, the country has been given a period of five years to comply with the requirement.

The Law on Personal Data Protection establishes a comprehensive framework for data protection in Vietnam. Decree No. 356/2025/ND-CP was promulgated to provide detailed guidance on the implementation of the Law and formally superseded Decree No. 13/2023/ND-CP on Personal Data Protection. The 2025 legislation thereby elevated the regulatory framework from decree‑level regulation to statutory law.

Art. 23.3.dd of Decree No. 147/2024/ND-CP provides that foreign organisations, enterprises, and individuals engaged in the cross-border provision of information to entities in Vietnam, where such activities involve the use of data storage leasing services within Vietnam or where total regular monthly visits from Vietnam, calculated as an average over six consecutive months, reach 100,000 or more, are subject to specific obligations. These include the requirement to retain information about service users in Vietnam upon account registration, including full name, date of birth, and a Vietnamese telephone number or personal identification number. For users of social networking services who are minors (under 16 years of age), their parents or legal guardians must register the accounts using their own information. Additionally, such entities are obliged to provide user information to the Ministry of Information and Communications, the Ministry of Public Security, and other competent authorities upon receipt of a written request, for the purposes of state management, investigation, and the handling of legal violations concerning the management, provision, and use of Internet services and cyber information.

Art. 21 of the Law on Personal Data Protection stipulates that personal data controllers, as well as entities acting as both controllers and processors, are required to establish and retain a record of the personal data processing impact assessment. One original copy of this assessment must be submitted to the competent personal data protection authority within 60 days of the commencement of personal data processing. The personal data processing impact assessment is conducted once and applies for the entire duration of the operations of the personal data controller or of the entity acting as both controller and processor.
In addition, pursuant to Art. 33.2 of the Law, agencies and organisations are responsible for designating dedicated units and personnel with adequate capacity to ensure personal data protection, or for engaging external organisations or individuals to provide personal data protection services.
Arts. 24, 28.2, and 30.1.b of Decree No. 13/2023/ND‑CP already contain substantially similar requirements. That Decree is scheduled to be repealed in 2026, concurrently with the entry into force of the Law on Personal Data Protection.

Under Decree No. 121/2008/ND-CP, equity caps applicable to foreign investment are based on WTO commitments. That is, for fixed and mobile communications, as well as Internet services, the maximum foreign equity shares are set at 49% in facilities-based services (i.e. telecom sector with infrastructure facilities). The threshold may increase up to 65% for non-facilities-based services (i.e. telephony services with no network infrastructure) and 70% for VPN services after a three-year investing period in Vietnam.

Decree No. 147/2024/ND-CP contains several provisions requiring companies to provide user data directly to state authorities upon request, without expressly requiring a warrant or judicial authorisation. Art. 19.4 mandates that agencies, organisations, enterprises, and individuals utilising Internet resources must supply information and cooperate with competent authorities upon request. Art. 23.3.dd further provides that foreign organisations, enterprises, and individuals engaged in the cross-border provision of information to users in Vietnam, where they either lease data storage services within Vietnam or receive an average of at least 100,000 monthly visits from Vietnam over six consecutive months, are obliged to furnish information concerning service users in Vietnam to the Ministry of Information and Communications, the Ministry of Public Security, and other competent authorities upon written request, for the purposes of state management as well as the investigation and handling of legal violations. Art. 35.9 imposes a similar obligation on providers of social networking services to disclose user information to competent authorities upon written request in order to facilitate the investigation and resolution of violations relating to Internet services and online information. Finally, Art. 79.2 requires telecommunications enterprises and Internet service providers to supply information and data relating to subscribers suspected of online legal violations, enabling the accurate identification of relevant organisations and individuals, upon requests issued by the Ministry of Information and Communications or the Ministry of Public Security.

It is reported that the State retains equity participation in several telecommunications operators. In particular, the Ministry of Defence owns the Viettel Group, while both the MobiFone and the Vietnam Posts and Telecommunications Group are also state-owned enterprises. In addition, the Ministry of Public Security holds a majority stake (50.17%) in FPT Telecom.

It is reported that there is no requirement for functional or accounting separation required for operators with significant market power.

Arts. 19-21 of Decree No. 25/2011/ND-CP outline the requirements for enterprises applying for a license in the telecom sector in Vietnam. These requirements vary across types of service and geographical coverage. They include minimum capital requirements from VND 5 Billion (approx. 218,000 USD) to VND 500 Billion (approx. 21.8 million USD) and investment plans from VND 15 billion (approx. 700,00 USD) to 7,500 VND Billion (approx. 322.5 million USD) among other requirements.

Vietnam has appended the World Trade Organization (WTO) Telecom Reference Paper to its schedule of commitments.

Vietnam does not have an independent telecom authority. The Authority of Telecommunications is a ministerial unit which performs the advisory and regulatory functions over the telecommunications sectors nationwide.

Art. 25.3 of the Law on Cybersecurity stipulates that both domestic and foreign enterprises providing services via telecommunications networks, the Internet, and value-added services in cyberspace within Vietnam, and which collect, use, analyse, or process personal data, data concerning service users’ relationships, or data generated by service users in Vietnam, are required to implement data protection measures in accordance with the law. Such data must be stored within the territory of Vietnam for the duration prescribed by the Government of Vietnam. This replaces Law on Cybersecurity No. 24/2018/QH14 and Decree No. 53/2022/ND-CP Detailing Some Articles of the Law on Cybersecurity, which contained similar restrictions.

According to Art. 7.4 of Circular No. 24, electronic general information websites and social networking platforms licensed to operate in Vietnam are required to employ at least one ".vn" domain name and to store data on servers whose IP addresses are located within the territory of Vietnam. Art. 44.1(d) of Decree No. 15/2020/ND-CP stipulates penalties for failure to use the national domain name ".vn" or for failing to store information on a server system with an IP address in Vietnam. This provision applies to licensed electronic newspapers, general electronic information websites, electronic portals, and social networks.

Art. 30 of Decree 163 stipulates that data belonging to state authorities utilising data centre or cloud services must be stored exclusively within the territory of Vietnam. It is reported that this provision implies that a foreign data centre or cloud service provider seeking to contract with a state agency would be required to establish facilities within Vietnam.