For online advertising, placing advertisement through big US internet companies such as Google or Facebook is a must for many Vietnamese companies. Under the WTO Commitments, Vietnam undertakes to allow cross-border supply for advertising services (CPC 871, excluding advertising for cigarettes) with no limitation. As such, a foreign company should be able to provide online advertising services to Vietnamese customers without having to set up a commercial presence in Vietnam.
That being said, Decree 181/2013 does not allow Vietnamese organisations or individuals to place their online advertisement directly on overseas server-based website. Instead, online advertisement with foreign internet companies must be placed via a local advertising service provider in Vietnam. In addition, 15 days before the placement of the local advertiser’s advertisement on its website, the foreign publisher is required to report the corporate information and key business lines of the authorised local advertising service provider to the Ministry of Culture, Sports and Tourism.
On the other hand, under the Advertising Law, foreign organisations or individuals not having a commercial presence in Vietnam must conduct the advertisement of their products, goods or services in Vietnam via an advertising service provider in Vietnam. In theory, these restrictions may be viewed as contrary to Vietnam’s undertaking under the WTO Commitments which allow cross-border supply for advertising services without limitation. However, it is not clear if one can successfully invoke the WTO Commitments.
On 16 March 2026, the Ministry of Public Security (MPS) issued the draft decree on administrative sanctions in the fields of cybersecurity and personal data protection (the Draft Decree) for public consultation. It is the first step to put concrete penalties behind the PDPL 2025, which took effect on 1 January 2026 but left the enforcement details to the Government. The Draft covers a wide range of sectors, such as cybersecurity, personal data, AI, telecommunications, and digital signatures. This post focuses on the personal data provisions (Articles 57 to 69 of the Draft Decree), which raise potential concerns for businesses.