Industrial Policy & Trade Monitor· 2663 actions· ✨ 89 recent

Decree 353/2025/NĐ-CP is the principal implementing instrument of Vietnam's Law on Digital Technology Industry (Law No. 71/2025/QH15), effective 1 January 2026 — the same date as the parent statute. The decree's five chapters and 36 articles operationalise three pillars: (i) a comprehensive State-support and preferential-incentive framework for products, services, and infrastructure across the semiconductor, AI, cloud, fintech, and e-commerce sectors; (ii) a high-quality-human-resources development framework covering training funds, scholarship schemes, and foreign-expert visa fast-tracks; and (iii) Vietnam's first statutory innovation sandbox, allowing organisations to deploy new digital products and business models under time- and scope-limited regulatory carve-outs where current law has not kept pace with practice.

Presidential Decision No. 10767, published in the Official Gazette (Resmî Gazete, Issue No. 33118) on 25 December 2025, re-sets the Digital Services Tax (Dijital Hizmet Vergisi, DHV) rate under Article 5(3) of Law No. 7194. The rate, set at 7.5% since the tax's 2020 introduction, is reduced to 5% for revenue generated from 1 January 2026 and to 2.5% for revenue generated from 1 January 2027. The tax applies to gross Turkish-sourced revenue of digital-service providers (online advertising, content sales, social-media/intermediary platforms) exceeding statutory turnover thresholds, and falls predominantly on large non-resident platform operators (Google, Meta, Amazon and comparable multinationals).

Vietnam's National Assembly passed Law on Cybersecurity No. 116/2025/QH15 on 10 December 2025 (434 of 443 deputies in favour), effective 1 July 2026. The law supersedes both the 2018 Cybersecurity Law (Law 24/2018/QH14) and the 2015 Law on Cyber Information Security, consolidating cybersecurity, cyber-information-security, and network-information-security into a unified Ministry of Public Security-led framework. It retains data-localization obligations for foreign digital-service providers handling personal data, user-generated content, and relationship graphs of Vietnamese users (minimum 24-month retention), introduces 6-hour urgent / 24-hour standard content take-down windows on MPS request, expressly prohibits AI/deepfake forgery of images, voices, and videos for illegal purposes, and mandates child-safety platform measures.

President Trump signed Executive Order 14324, "Suspending Duty-Free De Minimis Treatment for All Countries," on 30 July 2025 (published in the Federal Register on 5 August 2025 as FR doc 2025-14897, 90 FR 37775). The order eliminated the Section 321(a)(2)(C) administrative exemption that had allowed shipments valued at $800 or less to enter the United States duty-free, applying the suspension to all countries of origin rather than the China/Hong Kong-only carve-out imposed earlier in 2025. DHS/CBP published a Notice of Implementation on 2 September 2025 (FR doc 2025-16802) modifying the Harmonized Tariff Schedule so that covered low-value goods must be entered via formal or informal ACE entry types and pay applicable duties; goods shipped through the international postal network were instead made subject to a new flat ad valorem or specific per-item duty rate set by HTSUS annex. The suspension took effect for entries on or after 12:01 a.m. EDT on 29 August 2025. A DHS/CBP rule published 24 June 2026 (FR doc 2026-12670) converted the non-postal suspension from time-limited to indefinite and closed the remaining international-postal-network exemption to formal/ informal entry procedures as well.

Mexico's tax authority (SAT), acting under SHCP, published the Cuarta Resolución de Modificaciones a las Reglas Generales de Comercio Exterior para 2025 in the Diario Oficial de la Federación on 28 July 2025, raising the flat tax rate applied under the simplified customs regime for low-value courier and parcel shipments (goods valued at USD 2,500 or less) from 19% to 33.5%, effective 15 August 2025. The increase applies to shipments from countries without a free trade agreement with Mexico — in practice overwhelmingly China-origin goods — and is aimed at cross-border e-commerce platforms (Shein, Temu, AliExpress) as well as triangulated goods routed through courier channels by other importers including large retailers. The measure is framed by SHCP as combating under-invoicing and non-tariff-preference triangulation via the courier de minimis channel.

The National Assembly of Vietnam passed the Personal Data Protection Law (Luật Bảo vệ dữ liệu cá nhân), Law No. 91/2025/QH15, on 26 June 2025; it enters into force on 1 January 2026. The PDPL is Vietnam's first statutory (rather than decree-level) personal-data-protection framework, elevating the prior Decree 13/2023/ND-CP (PDPD) regime into a 5-chapter, 39-article primary statute and adding revenue-based administrative penalties of up to 5% of prior-year annual revenue for cross-border data-transfer violations and up to 10x illegal gains for unlawful data trading. The law is implemented by Decree 356/2025/ND-CP (issued 31 December 2025, effective 1 January 2026) and applies extraterritorially to foreign organisations offering services to or processing the personal data of Vietnam residents.

The Nigeria Data Protection Commission issued the General Application and Implementation Directive (GAID) 2025 on 20 March 2025, the principal implementing directive of the Nigeria Data Protection Act 2023 (NDPA). The GAID came fully into force on 19 September 2025, replacing the Nigeria Data Protection Regulation (NDPR) 2019 as the operative enforcement instrument. It applies extraterritorially to any data controller or processor established outside Nigeria that processes personal data of Nigerian data subjects, imposes a tripartite cross-border transfer framework (adequacy decisions, Transfer Instruments, and statutory exceptions), mandates Data Protection Impact Assessments for AI and high-risk technologies, and carries a civil-penalty ceiling of 2% of annual gross revenue or NGN 10 million for designated data controllers and processors of major importance (DCPMIs), whichever is greater.