At the heart of Vietnam’s internet services regulations is Decree No. 72/2013/ND-CP on the Management, Provision, and Use of Internet Services and Online Information. This was issued by the Government of Vietnam on July 15, 2013, and took effect on September 1, 2013. This decree sets forth the legal framework for the management and use of internet services, online information, and related activities in Vietnam. It outlines the responsibilities of organisations, individuals, and service providers regarding internet use, and aims to regulate the online environment while ensuring national security and public order. Foreign firms looking to do business in Vietnam in the technology sector including video game developers and cross border service providers should make sure they are familiar with these regulations.
Key Provisions of Decree 72
Scope of Regulation
The decree governs the management, provision, and use of internet services and online information, including:
- Provision of internet services.
- Provision of online information and websites.
- Use of social networks.
- Registration, storage, and use of domain names.
Provision and Use of Internet Services
Internet service providers (ISPs) must meet specific conditions and obtain licenses to operate. The decree classifies internet services into two types:
- Internet connection services (e.g., services that provide internet access to users).
- Internet application services (e.g., value-added services provided over the internet, such as web hosting or data storage).
The decree also outlines conditions for entities to establish their own private internet networks for internal communication or business operations.
Management of Online Information
Online information includes any data provided, transmitted, or exchanged via the internet. The decree divides online information into two categories:
- Official information: Information provided by state agencies or approved media.
- Personal information: Information shared by individuals on personal websites or social networks.
Entities that provide online content, including news websites and social networks, are required to manage their content to prevent the dissemination of illegal information, such as content that violates national security, promotes violence, or spreads false information.
Responsibilities of Organizations and Individuals
Organisations and individuals are required to comply with the following responsibilities:
- Use the internet in a manner that does not harm national security, public order, or social ethics.
- Prevent the dissemination of illegal, harmful, or false content.
- Ensure personal data protection and the security of their online activities.
Organisations providing online information, social networking platforms, and other internet services are responsible for monitoring content on their platforms and removing illegal content when requested by the authorities.
Social Networks
The decree introduces regulations for social networking platforms, requiring them to:
- Register with the Ministry of Information and Communications.
- Clearly identify the individuals or entities responsible for operating the platform.
- Ensure users provide accurate personal information upon registration.
- Remove content that violates Vietnamese law, especially content that undermines national security or public order.
Domain Name Management
The decree sets forth guidelines for the registration and management of domain names in Vietnam, specifically for websites using Vietnam’s country-code top-level domain (.vn). Individuals and organisations must ensure the accuracy of the information used to register domain names, and domain names must not infringe on the rights of others.
Protection of National Security and Public Order
To protect national security and public order, the decree emphasises the following:
- ISPs and social networks must cooperate with the authorities in monitoring and handling violations.
- Providers must store certain types of user information and provide it to authorities upon request for investigation purposes.
- Any content that could negatively affect national security, public order, or social morality is subject to removal by request of the Ministry of Information and Communications or relevant state agencies.
Penalties for Violations
Entities that violate the provisions of Decree 72 may face administrative sanctions, fines, or other penalties based on the severity of the violation. Severe cases, particularly those affecting national security or public order, could result in criminal prosecution.
Amendments and Revisions
Decree 72 has been amended and revised by subsequent legal documents to address the evolving nature of internet services, online content, and cybersecurity in Vietnam. The amendments primarily focus on enhancing regulation of cross-border services, protecting personal data, and aligning with new laws, such as the Law on Cybersecurity (2018). Below are the key amendments and revisions:
1. Decree No. 27/2018/ND-CP (March 1, 2018)
This amendment updates and expands Decree No. 72/2013 to regulate new developments in internet services, particularly social networks and online information.
Key Changes:
- Social Network Regulations: Decree No. 27 introduces stricter regulations for social networking platforms, especially those operated by foreign entities. It requires foreign service providers (like social media platforms) with users in Vietnam to comply with Vietnamese laws, including removing illegal content upon request by the authorities.
- Personal Information Protection: The amendment strengthens the protection of personal data by requiring platforms to ensure the security of user information and mandating that personal information can only be collected, stored, or used with the individual’s consent.
- Content Moderation and Removal: Social media platforms and websites are required to take down illegal content within 24 hours of a request from Vietnamese authorities. This is aimed at preventing content that harms national security, public order, or social ethics.
- Domain Name and Website Regulations: Stricter rules for the registration and management of domain names were introduced, emphasising transparency in the registration process.
2. Decree No. 150/2018/ND-CP (November 7, 2018)
This amendment addresses the need to align Decree No. 72/2013 with the newly enacted Law on Cybersecurity (2018), which provides a broader framework for protecting national security in cyberspace.
Key Changes:
- Alignment with Cybersecurity Law: The amendment enhances regulations for protecting critical national infrastructure, ensuring that entities handling sensitive information or data storage comply with cybersecurity assessments.
- Data Localization Requirements: The decree expands the requirement for foreign companies operating in Vietnam to store user data within the country, consistent with the data localization provisions of the Law on Cybersecurity.
- Establishment of Local Offices: Foreign online service providers, including social networks and e-commerce platforms, are required to establish branches or representative offices in Vietnam to ensure legal compliance, particularly with regards to cooperating with Vietnamese authorities in matters of national security and cybersecurity.
3. Decree No. 91/2020/ND-CP (August 14, 2020)
This decree primarily addresses the prevention of spam messages, emails, and calls. Although it is not a direct amendment to Decree No. 72/2013, it affects online services and communication platforms by introducing specific regulations on how online marketing and messaging can be conducted.
Key Changes:
- Anti-Spam Regulations: Decree No. 91 focuses on preventing the abuse of internet services to send spam messages and emails. It introduces penalties for individuals and organisations that send unsolicited marketing messages without user consent.
- Protection of Personal Information: It reinforces the protection of personal data in electronic communication, requiring companies to gain explicit consent before sending promotional messages or collecting user data.
4. Decree No. 70/2021/ND-CP (July 20, 2021)
This amendment targets cross-border advertising services and how foreign companies can advertise in Vietnam, especially on platforms like Facebook, Google, and YouTube.
Key Changes:
- Cross-border Advertising Services: Foreign online platforms that provide advertising services to Vietnamese users must comply with Vietnamese advertising laws. This includes registering with the Ministry of Information and Communications and ensuring that advertisements comply with content regulations in Vietnam (such as prohibiting ads that promote illegal products or violate national security).
- Tax Compliance: The amendment introduces stricter tax compliance measures for cross-border advertising services, ensuring that foreign platforms contribute to Vietnam’s tax system.
- Content Moderation for Ads: Advertisements that contain false information or content that violates the law must be removed or blocked by the platform when requested by authorities.
5. Decree No. 53/2022/ND-CP (August 15, 2022)
This amendment implements several provisions of the Law on Cybersecurity (2018) and strengthens the regulations introduced by Decree No. 72/2013.
Key Changes:
- Data Storage and Localization: Foreign companies offering services in Vietnam that process personal data are required to store user data in Vietnam, especially for critical sectors like finance, banking, and telecommunications.
- Cybersecurity Requirements: The decree introduces a comprehensive set of cybersecurity requirements for businesses operating in Vietnam, including obligations to monitor their networks for threats, report cybersecurity incidents, and take measures to prevent cyberattacks.
- Cooperation with Authorities: The decree mandates that foreign internet service providers cooperate with Vietnamese authorities by providing data for investigations and taking down illegal content when requested.
6. Draft Amendments
As of 2023, the Vietnamese government has proposed further amendments to Decree 72. These include:
- Enhanced Data Privacy Protections: New rules are being discussed to improve data privacy, especially with the rise of cloud services and online platforms that handle sensitive personal information.
- Regulation of New Technologies: The draft proposals aim to regulate emerging technologies like AI and cloud computing to ensure they comply with national security requirements and protect user data.
- Stricter Control of Social Media Content: Further measures may be introduced to ensure that social media platforms do not allow the spread of misinformation or harmful content, with quicker response times for removing illegal content.
Conclusion
The amendments and revisions to Decree 72 reflect efforts to adapt to the rapidly changing internet landscape and address concerns related to cybersecurity, data privacy, and national security. These amendments have introduced stricter regulations for foreign service providers, expanded protections for personal data, and ensured compliance with the Law on Cybersecurity (2018).
All of that said, foreign firms operating in Vietnam’s digital arena–in the video games, social media, or streaming services, for example–should keep in mind that law, rules, and regulations in Vietnam change frequently. With this in mind, foreign firms doing business in Vietnam can best keep up to date with these changes by subscribing to the-shiv.