Vietnam’s National Digital Transformation: Key Legal Developments to Expect in 2025

March 18, 2025

Vietnam’s National Digital Transformation: Key Legal Developments to Expect in 2025

On February 6, 2025, the prime minister of Vietnam, Pham Minh Chinh, chaired an online meeting to review the progress of Vietnam’s digital transformation agenda. The meeting assessed achievements under the National Digital Transformation Program and Project 06 on the development and application of population data, electronic identification, and authentication for national digital transformation for the period 2022-2025, with a vision to 2030, approved by the prime minister in 2022. The meeting also outlined key legislative and regulatory priorities for 2025, as set forth in Notice No. 56/TB-BPCP issued by the Government Office on February 23, 2025 (Notice 56).

One of the central focuses of the 2025 digital transformation agenda is the development and issuance of laws and regulations governing digital technology, data management, and cybersecurity. Below are the key legal developments provided in Notice 56 that stakeholders should anticipate in the coming months.

1. Law on Digital Technology Industry

The Ministry of Information and Communications (MIC) has been tasked with finalizing the draft Law on Digital Technology Industry (DTI Law) for submission to the National Assembly at its 9th session in May 2025. This law is expected to establish a comprehensive legal framework for the digital technology sector, addressing regulatory gaps in emerging fields such as artificial intelligence (AI), Internet of Things (IoT), cloud computing, big data and platform services to promote innovation, ensure data security, and support the growth of the digital economy in Vietnam. Concurrently, the MIC will expedite the issuance of guiding decrees to ensure the swift implementation of the DTI Law once enacted.

2. Law on Personal Data Protection and regulations guiding implementation of Data Law

The Ministry of Public Security (MPS) is making efforts to finalize the long-anticipated Law on Personal Data Protection (PDPL)—data protection is currently governed by Decree No. 13/2023/ND-CP on personal data protection—which will be presented to the National Assembly in May 2025. This law is expected to codify Vietnam’s data protection framework, with a strong emphasis on compliance obligations for businesses handling personal data.

Additionally, the MPS is tasked to finalize decrees guiding the new Data Law, which will take effect on July 1, 2025, and governs the management, integration, and usage of national and specialized databases.

3. Law on Science, Technology, and Innovation

The Ministry of Science and Technology (MOST) is leading efforts to finalize the Law on Science, Technology, and Innovation, with a submission deadline of May 2025. This legislative revision will incorporate provisions on innovation incentives, R&D funding mechanisms, and intellectual property protection for technology-driven enterprises. Once enacted, this new law will replace the current Law on Science and Technology.

Additionally, a Government Steering Committee on Science, Technology, Innovation, and Digital Transformation is being proposed. This committee will coordinate regulatory efforts across ministries to streamline policy implementation in the digital economy.

4. Decree guiding implementation of Law on E-Transactions regarding shared databases

The MIC has been assigned the responsibility of drafting a decree to provide guidance on the implementation of the Law on E-Transactions, particularly in relation to shared databases. This decree aims to establish interoperability standards for data exchange among government agencies and businesses.

5. Establishment of national government data bodies

National Data Center: A major initiative under Project 06 is the establishment of the National Data Center, slated to become operational by August 2025. To ensure legal oversight, the MPS will draft a regulatory framework governing this center’s operations. Notably, given the National Data Center’s critical role in data integration and e-government initiatives, businesses engaging with government data systems should closely monitor these developments.

National Data Monitoring Committee: Further, recognizing the need for robust governance over data usage, the government is considering the establishment of a National Data Monitoring Committee. The MPS, in collaboration with MIC and MOST, will submit a proposal for this committee by the first quarter of 2025. This committee would be expected to oversee compliance with data regulations.

Outlook

Vietnam’s digital transformation is set to accelerate in 2025, bringing significant changes to the legal and regulatory landscape. Businesses in AI, cybersecurity, cloud computing, and data analytics should prepare for compliance requirements and evolving policies. Additionally, foreign investors and tech companies looking to expand in Vietnam are recommended to stay updated on legislative developments to navigate risks and take advantage of new opportunities in this fast-evolving market.

Related Professionals

Tuyen An Thuy Nguyen

Vietnam

+84 28 6284 5674

Email

Hien Thi Thu Nguyen

Paralegal

Vietnam

+84 28 628 45678

Email

RELATED INSIGHTS

February 26, 2025

Law Over Borders: Data Protection 2025 – Thailand

Tilleke & Gibbins has contributed the Thailand chapter to Data Protection 2025, a newly published comparative guide from Global Legal Post’s Law Over Borders series. This comprehensive Q&A-style resource provides insights into data protection regulations across multiple jurisdictions worldwide, offering valuable guidance for businesses navigating the complex landscape of global data privacy requirements. The Thailand chapter offers a detailed analysis of the country’s data protection framework, with particular focus on the Personal Data Protection Act (PDPA) that came into full effect in 2022. The chapter addresses key aspects of data protection in Thailand through the following topics: Regulatory framework: National laws governing personal data, scope of application, territorial reach, and regulated operations. Data categories and protection: Types of personal data covered, special categories subject to enhanced protection, and processing requirements. Compliance obligations: Requirements for lawful processing, organizational responsibilities, and data subject rights. Marketing and cross-border considerations: Rules for commercial communications and international data transfers. Enforcement mechanisms: Regulatory powers, investigation procedures, sanctions, and remedies for noncompliance. Tilleke & Gibbins also contributed the Vietnam chapter to Data Protection 2025. Readers can access the complete Data Protection 2025 guide through Global Legal Post’s Law Over Borders platform.

February 20, 2025

A Closer Look at Vietnam’s Decree 147 on Internet Services and Online Information

Vietnam’s Decree No. 147/2024/ND-CP on the management, provision, and use of internet services and online information (Decree 147) was issued on November 9, 2024, and came into effect on December 25, 2024. Decree 147 represents a more stringently regulated digital landscape in Vietnam, creating challenges not only for offshore service providers offering cross-border services but also for onshore providers. As these new regulations impose stricter requirements, particularly in areas like content control, user authentication, data storage, and service license/notification, companies will need to adapt quickly to maintain compliance and minimize legal risks. The following are some of the key topics covered by Decree 147. [Note: Shortly after the issuance of Decree 147, Vietnam began a government restructuring process, with the aim of streamlining the government by consolidating and eliminating various ministries and agencies. Thus, the decree’s references to authorities such as the Authority of Broadcasting and Electronic Information (ABEI) and the Ministry of Information and Communications (MIC) are subject to change.] 1. Cross-Border Information Provision Cross-border information provision is defined broadly as the provision by overseas organizations and individuals of information and online information content services for service users in Vietnam to access or use. This wide-ranging definition encompasses various types of cross-border services, including social network services, online game services, and app store services. However, cross-border provision of online game services remains prohibited under Decree 147 (see further details below). Offshore providers of services on a cross-border basis who lease data storage in Vietnam or meet a threshold of 100,000 or more total visits per month from Vietnam for six consecutive months (“regulated cross-border providers”) must adhere to stricter requirements. Specifically, they are required to, among other requirements: Notify the relevant authority of their contact information, including the location of the main server providing the service, within 60

February 17, 2025

Fintech Operators and Thailand’s Draft Emergency Decree on Technology Crimes Suppression

Thailand’s draft Emergency Decree on Technology Crimes Suppression, which we covered in a client alert in January 2025 primarily addressed to telecom operators and financial institutions, is expected to have significant implications for a wide range of business operators. The draft emergency decree has already been approved by the cabinet but may undergo further developments as it continues in the legislative process. In this article, we will highlight the material impacts of the draft emergency decree on overseas and local fintech operators. Expanded Definition of “Technology Crimes” The definition of “technology crimes” now includes the following acts of forgery or alteration: Forging or altering the identity of individuals and biometric characteristics by utilizing computer or communication systems or other electronic means to commit offenses. Forging or altering symbols, trademarks, or seals of groups (e.g., foundations, community enterprises) or juristic persons, including acts by juristic persons using individuals or juristic persons as nominal directors or shareholders, regardless of whether such individuals or legal juristic persons reside in Thailand. Forging or altering digital or online platforms, regardless of the platform’s location or legal status. Individuals who conspire, utilize, assist, or support the commission of these offenses will face the same penalties as the principal offender. Business Operator Definition The scope of “business operators” is now expanded to cover various fintech and digital asset operators beyond those under the Payment Systems Act (PSA). The draft emergency decree now includes the following operators, whether they are legally authorized or not: Business operators under the PSA and business operators who operate “as if” they are payment system operators Business operators under the Royal Decree on Digital Asset Businesses or business operators who operate “as if” they are digital asset business operators. Foreign exchange business operators. Disclosure and Exchange of Information Business operators must disclose

February 7, 2025

Vietnam’s Government Restructuring: Key Changes and Implications for Businesses

Vietnam’s political system is currently undergoing a significant reorganization to streamline government operations and improve efficiency. In this regard, Plan 141/KH-BCDTKNQ18, issued on December 6, 2024, provided guidelines on the restructuring of existing ministries, ministerial-level agencies, and government-affiliated agencies. Accordingly, the number of ministries is being reduced from 18 to 14 through mergers and consolidations and the establishment of a new Ministry of Ethnic and Religious Affairs. The number of ministerial-level agencies is being reduced to three, and government-affiliated agencies to five. Similar streamlining is happening at provincial levels. The newly consolidated state agencies will assume all functions, rights, and responsibilities of the merged entities, and will continue handling all ongoing matters previously handled by the former agencies. Some examples of these changes include the following: The Ministry of Science and Technology (MOST) will oversee telecommunications, IT applications, cybersecurity, e-transactions, and national digital transformation, which had previously been managed by the Ministry of Information and Communications (MIC). MOST will also be responsible for issuing licenses related to these areas, such as licenses for G1 online game services and telecommunication services. The Ministry of Culture, Sports, and Tourism will assume the responsibility of press management, previously under the MIC. The Ministry of Finance will assume state management functions related to investment, previously handled by the Ministry of Planning and Investment. Provincial Departments of Finance will issue Investment Registration Certificates and Enterprise Registration Certificates, a responsibility previously held by the Departments of Planning and Investment. The Ministry of Home Affairs will oversee labor and employment matters. Provincial Departments of Home Affairs will be authorized to issue work permits and will be the designated authorities for companies to register their internal labor regulations. Official Letter No. 35/CV-BCDTKNQ18 dated January 23, 2025, mandated that all ministries submit their draft decrees outlining their functions,

You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

Industries

Practices

March 18, 2025