Industrial Policy & Trade Monitor· 2665 actions· ✨ 90 recent

Vietnam's National Assembly passed Law on Cybersecurity No. 116/2025/QH15 on 10 December 2025 (434 of 443 deputies in favour), effective 1 July 2026. The law supersedes both the 2018 Cybersecurity Law (Law 24/2018/QH14) and the 2015 Law on Cyber Information Security, consolidating cybersecurity, cyber-information-security, and network-information-security into a unified Ministry of Public Security-led framework. It retains data-localization obligations for foreign digital-service providers handling personal data, user-generated content, and relationship graphs of Vietnamese users (minimum 24-month retention), introduces 6-hour urgent / 24-hour standard content take-down windows on MPS request, expressly prohibits AI/deepfake forgery of images, voices, and videos for illegal purposes, and mandates child-safety platform measures.

Thailand's Board of Investment issued Notification No. 9/2568 on 14 November 2025, amending the Activity List Eligible for Investment Promotion by splitting the prior single data-center category into two tiers based on power-usage efficiency: high-efficiency data centers (PUE ≤ 1.3) qualify for an 8-year corporate income tax (CIT) exemption, while other data centers receive a 5-year CIT exemption. A precursor restructure (Notification No. 5/2568, 5 June 2025) first introduced the two-tier category split; Notification 9/2568 added location-differentiated terms based on the Eastern Economic Corridor (EEC). New benefit conditions require applicants to submit a Thailand-benefit plan — training programmes, academic/R&D partnerships, local supply-chain support, or knowledge transfer to Thai nationals — that must be implemented before CIT exemption benefits can be exercised.

President Trump signed Executive Order "Saving TikTok While Protecting National Security" on September 25, 2025, certifying a restructuring plan as a "qualified divestiture" under the 2024 PAFACA law and directing the Attorney General not to enforce the Act for 120 days while the transaction closes. The plan creates TikTok USDS Joint Venture LLC, valued at roughly $14 billion, with a new US-investor consortium (Oracle, Silver Lake and MGX at 15% each, plus other investors, totaling 50%), affiliates of existing ByteDance investors holding 30.1%, and ByteDance itself retaining 19.9%. Oracle will run US data storage and algorithm retraining/oversight; the deal closed January 22, 2026.

The Protecting Americans from Foreign Adversary Controlled Applications Act (PAFACA), enacted as Division H of P.L. 118-50 (21st Century Peace through Strength Act), prohibits app stores and internet hosting services from distributing, maintaining, or updating "foreign adversary controlled applications" — defined explicitly to include ByteDance Ltd and its subsidiaries (TikTok). ByteDance was given 270 days from enactment (until January 19, 2025) to execute a "qualified divestiture" — selling TikTok to an owner with no operational relationship with a foreign adversary — or face a nationwide distribution ban. The Supreme Court unanimously upheld the law's constitutionality in TikTok, Inc. v. Garland (January 17, 2025), rejecting First Amendment challenges and affirming the national-security rationale grounded in data-collection concerns.

Government Decree 53/2022/ND-CP, signed 15 August 2022 and effective 1 October 2022, implements Article 26 of Vietnam's 2018 Law on Cybersecurity. It mandates in-country storage of three categories of data — personal data of users in Vietnam, user-generated data, and user-relationship data — for both domestic and foreign cyberspace- service providers, with a minimum 24-month retention period. Foreign enterprises providing telecoms, data storage, domain names, e-commerce, online payments, social networks, online video games, or messaging services to users in Vietnam must establish a Vietnamese branch or representative office within 12 months of a Minister of Public Security written request. The decree closes a four-year implementation gap on the 2018 Cybersecurity Law and is the principal Vietnamese digital-trade barrier alongside Decree 13/2023/ND-CP (Personal Data Protection).