Key takeaways

Classification of OTT, DC and Cloud services as value-added telecom services

The new Telecommunications Law defines basic telecom services on the internet (e.g., OTT communication services), DC and Cloud services as telecom services with specific relevant functions. However, as telecom services merely include (i) basic telecom services and (ii) value-added telecom services, under Decree 163, these three new services are classified as value-added telecom services, among other traditional services, such as email services, voicemail services, value-added fax services and internet access services.

Provision of telecom services on a cross-border basis

To provide telecom services on a cross-border basis to users within the territory of Vietnam, the service provider must execute a commercial agreement with a licensed Vietnamese telecom company (unless provided otherwise by an international treaty to which Vietnam is a signatory). Nonetheless, this precondition does not apply to newly regulated services, such as basic telecom services on the internet, DC and Cloud services, as Decree 163 explicitly excludes these new services from the scope of the obligation.

Obligations of offshore providers of basic telecom service on the internet

Under Decree 163, the offshore providers of basic telecom service on the Internet are obliged to do the following:

• Notify the Vietnam Telecommunications Authority (VNTA) of the service being provided. The notification must include basic information about the service provider, its incorporation document, descriptions of the services being provided and information about the contact point to liaise with the Ministry of Information and Communications. If there are any changes to the providers' names or information about the contact point in Vietnam, notification is required.
• Comply with certain requirements under the new Telecommunications Law, notably the following:
  • Suspend the service in the case of riots or abuse of services to oppose the state or violate national security upon the competent authorities' request.
  • Not disclose private information about the service users, except in certain cases.
  • Obtain users' consent when accessing any function on the users' end devices.
  • Announce the quality of the service being provided.
• Verify the users' telephone numbers before providing the service.
• Store information about the users (including their names and phone numbers) and other information about the users' use of the service, per cybersecurity laws.
• Comply with requests from competent authorities to ensure cybersecurity, per the law.

Obligations of offshore providers of DC and Cloud services

Under Decree 163, the obligations of DC and Cloud service providers are largely similar to those of offshore providers of basic telecom services on the internet (e.g., notifying the competent authority of the service being provided; storing the users' information). However, there are several specialized differences. These are as follows:

• While there is no obligation regarding access to users' end devices, providers of DC and Cloud services must refrain from accessing, exploiting or using the service users' data without their consent.
• These providers must also comply with additional obligations under the Telecommunications Law, such as the following:
  • Upon request of competent authorities, take timely measures to block access to information.
  • Refrain from tracking or monitoring service users' information.
  • Store some basic information about individual and corporate users, such as their name and contact details.

Notification of the information to the VNTA

Decree 163 establishes a mandatory form that providers of basic telecom services, internet services, DC or Cloud services must use to notify the VNTA before offering relevant services in Vietnam.

In general, the notification form requires service providers to provide, among other things, some corporate information, a description of the telecom services, information on the telecom equipment system, information on service quality and pricing, and their contact information.

Provision of DC and Cloud services to state authorities

Decree 163 states that the data of state authorities using DC or Cloud services must be exclusively stored in Vietnam. This means that if an offshore DC and Cloud service provider plans to become a state's contractor, it will need to set up facilities in Vietnam to store the relevant state agency's data.

The information systems used to render DC or Cloud services must meet relevant requirements under the laws on cyber information security before being deployed.

Conclusion

As Decree 163 has already taken effect, offshore providers of DC, Cloud and OTT services should promptly assess their new obligations/requirements under the decree and devise a comprehensive compliance plan.

* * * * *

Tuan Linh Nguyen, Government Affairs Manager, has contributed to this legal update.