Decree 147/2024/ND-CP on Internet Services and Online Information Management – Part 3: Impact on ISP, Web Hosting, and Data Center Sectors

Decree 147/2024/ND-CP (Decree 147) on the management, provision, and use of internet services and online information in Vietnam, effective from December 25, 2024, will impact domestic and foreign organizations involved in managing, providing, or using internet services and online information, such as social network service providers, online application providers, app stores, and online game service providers.

Impacts of Decree 147 on Individuals and Businesses Operating/Using ISP, Web Hosting, and Data Center Services

(i) Decree 147 defines "Data storage rental service" as a service that "Provides storage space established by service providers for organizations and individuals" (Article 3.45). Currently, there are various definitions scattered across different legal documents describing similar services, specifically:

· Article 3.9 of the Telecommunications Law 2023 defines "Data center service" as "A telecommunications service providing information processing, storage, and retrieval functions for users via telecommunications networks through the rental of part or all of a data center".

· Article 3.23 of the Telecommunications Law 2023 defines "Data Center" as "A telecommunications facility, including buildings, stations, cable systems, computer systems, and electrical systems along with auxiliary equipment installed therein for processing, storing, and managing data of one or more organizations or individuals".

· Article 18 of the Information Technology Law 2006 defines: "Digital information storage rental" as "A service for renting storage device capacity to store information in the network environment".

· Consolidated Document No. 08/VBHN-BTTTT dated July 20, 2022, of the Minister of Information and Communications regarding administrative violations in telecommunications uses the term "Digital information storage rental" rather than "Data center service".

It remains unclear whether these definitions target the same subjects, as obligations for these entities may vary across different legal documents, thus affecting businesses' compliance obligations. Businesses need to analyze and assess whether their services fall within the scope of Decree 147 and related regulations, and in case of conflicts, which legal provisions take precedence.

(ii) Decree 147 stipulates that foreign organizations and individuals providing cross-border information into Vietnam that either (i) use data storage rental services in Vietnam or (ii) have regular monthly total visits from Vietnam (average statistics over 6 consecutive months) of 100,000 visits or more (Article 23.3) must fulfill their responsibilities within 90 days from the effective date of Decree 147 (December 25, 2024) ( Article 82.10).

This will affect customers who are "Foreign organizations and individuals conducting cross-border information provision into Vietnam using data storage rental services in Vietnam" of data center businesses. Therefore, businesses need to review their customer base and notify customers who are "Foreign organizations and individuals conducting cross-border information provision into Vietnam" to fulfill their notification obligations under Decree 147; simultaneously, they need to review service contracts to add corresponding customer responsibilities.

(iii) Decree 147 imposes numerous additional responsibilities on telecommunications enterprises, Internet service providers, web hosting services, data center services, and telecommunications application service providers, for example: Must report to the Ministry of Information and Communications (currently merging with the Ministry of Science & Technology) in writing, by phone, or email within 24 hours of self-discovery or receiving feedback, complaints from users about content, services (Article 23.6.a); Must provide periodic reports or ad hoc reports when requested by phone, in writing, or through electronic means by the Ministry of Information and Communications (Article 23.6.b); Must implement necessary technical measures to prevent access to illegal content, services, and applications on the network within 24 hours of receiving requests by phone, in writing, or through electronic means from the Ministry of Information and Communications, Ministry of Public Security (Article 80.4.a).

To ensure legal compliance, telecommunications enterprises, Internet service providers, web hosting services, data center services, and telecommunications application service providers are recommended to prepare and implement the following:

· Prepare feasible technical solutions to remove violating content when requested by competent authorities.

· Review Service Agreements with customers to clarify additional obligations for both Service Providers and Customers to comply with these regulations, as well as the Service Provider's right to take necessary actions to comply with Decree 147 without being subject to penalties or compensation to Customers.

· Service Providers must review their current customer base to identify any "Foreign organizations and individuals conducting cross-border information provision into Vietnam" to prepare reports according to Decree 147.

· In practice, Service Providers cannot know when their "foreign organization or individual" customers will conduct "cross-border information provision to service users in Vietnam," so they need to review Service Agreements with Customers to add notification obligations and obligations to comply with relevant legal regulations.

(iv) Decree 147 limits the form of dispute resolution that relevant agencies, organizations, and individuals in Vietnam can choose to protect their rights and interests regarding websites, social networks, and applications provided by foreign organizations and individuals across borders to "Filing lawsuits at competent people's courts in Vietnam” (Article 23.7.c). Thus, other dispute resolution methods such as Commercial Arbitration are not feasible.

Therefore, businesses need to review their Service Agreements and related documents (e.g., Service Terms/Conditions) to examine current dispute resolution methods and adjust them to comply with Decree 147.

(v) Decree 147 establishes two (02) focal points for directing and monitoring compliance for telecommunications enterprises, Internet service providers, web hosting services, and data center services: the Ministry of Information and Communications (currently merging with the Ministry of Science & Technology) and the Ministry of Public Security (Article 80.2).

(vi) Decree 147 stipulates strict sanctions for violations, particularly risks for data center service businesses.

Accordingly, violations may be subject to administrative penalties as specified in Clauses 2 and 3, Article 102 of Consolidated Document No. 08/VBHN-BTTTT dated July 20, 2022, of the Minister of Information and Communications on administrative violations in telecommunications, specifically:

· Fines from VND 5,000,000-10,000,000 (clause 2) and VND 10,000,000-20,000,000 (clause 3).

· Additional penalty form: confiscation of exhibits and means used in administrative violations for acts under point b, clause 3, specifically: "Failure to implement necessary measures to prevent access to information or remove illegal information as requested by competent state authorities when transmitting or renting digital information storage space".

In the case of data centers, it is unclear whether "Exhibits and means of administrative violations" includes server systems, machinery, and technological equipment. If so, the "Confiscation" of these exhibits would particularly severely affect the operation and activities of that business.

(vii) Decree 147 stipulates numerous conditions that must be met and maintained during the operation of "Organizations and businesses providing content information services on mobile telecommunications networks" for example: Must have at least 01 server system located in Vietnam to serve inspection and examination as prescribed (Article 74.2); Develop and publicly announce Agreements for providing and using content information services on mobile telecommunications networks, guidelines for resolving user complaints before providing services according to relevant legal regulations (Article 74.5)…

Therefore, businesses must review whether they have met the conditions as prescribed, for example: have issued Agreements for providing and using content information services on mobile telecommunications networks; For services provided periodically (daily, weekly, monthly, quarterly, yearly...), services can only be provided after successful service registration notification to service users...

(viii) Decree 147 stipulates that "Certificates of registration for providing content information services on mobile telecommunications networks" will expire 90 days from the effective date of this Decree (December 25, 2024). If businesses want to continue providing services, they must register for a new "Connection Registration Certificate" to provide content information services on mobile telecommunications networks (Article 82.9). Therefore, to avoid business interruption, businesses need to immediately implement procedures for obtaining a Connection Registration Certificate as prescribed by Decree 147.

 ALTAS Services

(i) Conduct Legal Review for telecommunications enterprises, Internet service providers, web hosting services, data center services, and other businesses to assess compliance with Decree 147;

(ii) Advise and draft compliance forms for Decree 147 for businesses;

(iii) Advise and prepare documents, implement registration procedures for Connection Registration Certificate (replacing the Certificate of registration for providing content information services on mobile telecommunications networks) to provide content information services on mobile telecommunications networks;

(iv) Advise, review, and draft Contracts, Agreements, Service Terms between telecommunications enterprises, Internet service providers, web hosting services, data center services, and customers; and

(v) Advise and prepare documents, forms on personal data protection, player information protection in compliance with legal regulations.

Conclusion

ALTAS LAW is committed to supporting investors and businesses during this volatile period. Please contact Member Attorney Chris Luong at email chris.luong@altas.vn if investors need more detailed information or legal procedure assistance.

Copyright © 2025 ALTAS LAW. All rights reserved. Ownership: This documentation and content (Content) is a proprietary resource owned exclusively by ALTAS LAW (meaning ALTAS LAW, ALTAS CORP and its member firms). Use of this Content does not of itself create a contractual relationship, nor any attorney/client relationship, between ALTAS LAW and any person. Disclaimers: The Content provided is for informational purposes only and may not reflect the latest legal or regulatory developments. Summaries of laws, regulations, and practices are subject to change. This Content does not constitute legal or professional advice for any specific situation and should not be relied upon as a substitute for reviewing and complying with applicable laws, rules, regulations, or official forms. Always seek legal counsel before making any decisions or taking any action based on this Content. ALTAS LAW, along with its editors and contributing authors, make no guarantees regarding the accuracy of the Content and explicitly disclaim any liability for any consequences resulting from actions taken, allowed, or omitted, whether fully or partially based on any part of the Content. The Content may include links to external websites, and external sites may also link to it. ALTAS LAW is not responsible for the content or functionality of any such external websites and disclaims all liability for any issues arising from their content or operation. Please note: Past results do not guarantee similar outcomes.

Written: Luong Van Chuong - Partner Lawyer at  ALTAS Law & Dang Thi Ngoc Lan - Legal Senior Assistant

Date: 21/02/2025