It is reported that Telegram was blocked in Vietnam between 25 May and 10 July 2025. The government is reported to have instructed internet service providers on 21 May to block the application, citing Telegram’s alleged failure to cooperate with state authorities in efforts to combat criminal activity on the platform. The ban is understood to have followed cybersecurity legislation enacted in 2018 and 2024, under which technology companies are reportedly required to register with local authorities, cooperate with government requests, store user data domestically, and provide such data to the authorities upon request.

In November 2024, the Government issued Decree No. 147/2024/ND-CP on the management, provision, and use of internet services and online information (Decree 147), which entered into force in December 2024. This decree replaced Decree No. 72/2013/ND-CP, retaining most of its original provisions while introducing new and revised regulations.
Under Art. 23 of Decree 147, foreign organisations, enterprises, and individuals providing cross-border information services to users in Vietnam—whether through domestic data hosting arrangements or when their platforms receive 100,000 or more regular monthly visits from Vietnam (based on a six-month average)—are required to cooperate with authorities in removing or blocking content deemed to include prohibited acts. These include activities such as opposing the State, threatening national security or public order, disseminating propaganda, promoting obscenity or pornography, offending national customs and traditions, defaming individuals or organisations, and advertising banned goods or services, as outlined in Art. 8 of the Cybersecurity Law.
Numerous press outlets have raised concerns about the broad scope and potentially far-reaching implications of Decree 147, particularly in relation to its expansive powers to block online content.

According to Art. 13 of Decree 181/2013/ND-CP, Vietnamese companies and individuals who want to place online advertisements on foreign websites or platforms must advertise via agents in Vietnam. In addition, Pursuant to Art. 14 of the Decree, foreign companies and individuals who want to place online advertisements on Vietnamese websites or platforms must do so via Vietnamese agents.

According to Art. 95.3 of Decree No.15/2020/ND-CP, a fine ranging from VND 50,000,000 to VND 70,000,000 (approx. 2,040 USD to 2,860 USD) shall be imposed for advertising email and internet message services using servers not located in Vietnam.

Pursuant to Art. 37 of Decree No. 147/2024/ND-CP, enterprises are permitted to release online G1 video games provided that they have obtained both a licence to provide such services and a decision authorising their release; G1 games are defined as those involving simultaneous interaction among multiple players through the enterprise’s game server systems. By contrast, enterprises may release online G2, G3, and G4 video games where they possess written confirmation both of their eligibility to provide such services and of their notification of the release, with G2 games involving interaction between players and the enterprise’s game server systems, G3 games involving interaction among multiple players without interaction with such server systems, and G4 games being those downloaded via networks without any interaction either among players or between players and the enterprise’s game server systems. Art. 39 sets out the conditions for the grant of licences to provide online G1 video game services, while Art. 48 prescribes the requirements to be satisfied by enterprises seeking certificates for the provision of online G2, G3, and G4 video game services.

Art. 21 of the Law on Personal Data Protection stipulates that personal data controllers, as well as entities acting as both controllers and processors, are required to establish and retain a record of the personal data processing impact assessment. One original copy of this assessment must be submitted to the competent personal data protection authority within 60 days of the commencement of personal data processing. The personal data processing impact assessment is conducted once and applies for the entire duration of the operations of the personal data controller or of the entity acting as both controller and processor.
In addition, pursuant to Art. 33.2 of the Law, agencies and organisations are responsible for designating dedicated units and personnel with adequate capacity to ensure personal data protection, or for engaging external organisations or individuals to provide personal data protection services.
Arts. 24, 28.2, and 30.1.b of Decree No. 13/2023/ND‑CP already contain substantially similar requirements. That Decree is scheduled to be repealed in 2026, concurrently with the entry into force of the Law on Personal Data Protection.

Under Decree No. 121/2008/ND-CP, equity caps applicable to foreign investment are based on WTO commitments. That is, for fixed and mobile communications, as well as Internet services, the maximum foreign equity shares are set at 49% in facilities-based services (i.e. telecom sector with infrastructure facilities). The threshold may increase up to 65% for non-facilities-based services (i.e. telephony services with no network infrastructure) and 70% for VPN services after a three-year investing period in Vietnam.

Decree No. 147/2024/ND-CP contains several provisions requiring companies to provide user data directly to state authorities upon request, without expressly requiring a warrant or judicial authorisation. Art. 19.4 mandates that agencies, organisations, enterprises, and individuals utilising Internet resources must supply information and cooperate with competent authorities upon request. Art. 23.3.dd further provides that foreign organisations, enterprises, and individuals engaged in the cross-border provision of information to users in Vietnam, where they either lease data storage services within Vietnam or receive an average of at least 100,000 monthly visits from Vietnam over six consecutive months, are obliged to furnish information concerning service users in Vietnam to the Ministry of Information and Communications, the Ministry of Public Security, and other competent authorities upon written request, for the purposes of state management as well as the investigation and handling of legal violations. Art. 35.9 imposes a similar obligation on providers of social networking services to disclose user information to competent authorities upon written request in order to facilitate the investigation and resolution of violations relating to Internet services and online information. Finally, Art. 79.2 requires telecommunications enterprises and Internet service providers to supply information and data relating to subscribers suspected of online legal violations, enabling the accurate identification of relevant organisations and individuals, upon requests issued by the Ministry of Information and Communications or the Ministry of Public Security.

It is reported that the State retains equity participation in several telecommunications operators. In particular, the Ministry of Defence owns the Viettel Group, while both the MobiFone and the Vietnam Posts and Telecommunications Group are also state-owned enterprises. In addition, the Ministry of Public Security holds a majority stake (50.17%) in FPT Telecom.

It is reported that there is no requirement for functional or accounting separation required for operators with significant market power.

Arts. 19-21 of Decree No. 25/2011/ND-CP outline the requirements for enterprises applying for a license in the telecom sector in Vietnam. These requirements vary across types of service and geographical coverage. They include minimum capital requirements from VND 5 Billion (approx. 218,000 USD) to VND 500 Billion (approx. 21.8 million USD) and investment plans from VND 15 billion (approx. 700,00 USD) to 7,500 VND Billion (approx. 322.5 million USD) among other requirements.

Vietnam has appended the World Trade Organization (WTO) Telecom Reference Paper to its schedule of commitments.

Vietnam does not have an independent telecom authority. The Authority of Telecommunications is a ministerial unit which performs the advisory and regulatory functions over the telecommunications sectors nationwide.

Art. 25.3 of the Law on Cybersecurity stipulates that both domestic and foreign enterprises providing services via telecommunications networks, the Internet, and value-added services in cyberspace within Vietnam, and which collect, use, analyse, or process personal data, data concerning service users’ relationships, or data generated by service users in Vietnam, are required to implement data protection measures in accordance with the law. Such data must be stored within the territory of Vietnam for the duration prescribed by the Government of Vietnam. This replaces Law on Cybersecurity No. 24/2018/QH14 and Decree No. 53/2022/ND-CP Detailing Some Articles of the Law on Cybersecurity, which contained similar restrictions.

According to Art. 7.4 of Circular No. 24, electronic general information websites and social networking platforms licensed to operate in Vietnam are required to employ at least one ".vn" domain name and to store data on servers whose IP addresses are located within the territory of Vietnam. Art. 44.1(d) of Decree No. 15/2020/ND-CP stipulates penalties for failure to use the national domain name ".vn" or for failing to store information on a server system with an IP address in Vietnam. This provision applies to licensed electronic newspapers, general electronic information websites, electronic portals, and social networks.