The Law on E-Commerce No. 122/2025/QH15 defines four groups of basic content on operating conditions that must be disclosed on the platform including; information about the platform owner, confidentiality policy, rights and obligations of the parties, and the method of receiving and handling requests and complaints. For a platform with an online ordering function, the scope of disclosure is extended to transaction conditions such as price, payment, display priority, livestream, delivery, returns, methods of provision, and termination of service. These contents must be expressed in Vietnamese, easy to understand, not confusing, placed in a conspicuous position, and ensure equality between the parties. The platform must also have a mechanism for users to express their agreement to the operating conditions before opening an account.
The recently issued Decree 248/2026/ND-CP has continued to concretize the requirements for disclosure contents and positions that e-commerce platform owners need to establish for compliance purposes. In Part 1, CDLAF will inform you of the Four groups of information that are required for every e-commerce platform.
1. Information about the platform owner
The platform must allow users to clearly identify which entities are managing, operating, and responsible for the operation of the platform.
For organizations, the minimum amount of information required includes the name, address of the head office, legal representative, number, date of issuance, and place of issuance of the Enterprise Registration Certificate or establishment decision. For individuals or enterprise households, the information must include their name, residential address, and corresponding tax identification number.
This is not just enterprise identification information. In the event of a complaint, refund request, contractual dispute, or data incident, the user must be able to accurately identify the responsible entity. In fact, some platforms only publish trade names, application names, or trademarks without fully showing the legal name of the operator. This type of disclosure carries risks when the trade name does not match the name of the enterprise behind the platform, or multiple companies in the same group are involved in different stages of service provision. Enterprises, therefore, need to clarify which unit is the owner of the platform, which unit is the seller, which unit collects money, and which unit processes personal data. These roles should not be ambiguous in the terms of use.
2. Privacy Policy
Decree 248/2026/ND-CP sets out a relatively comprehensive list for requirements of the privacy policies. The policy must describe the purpose and scope of the information collection, the scope of use, the retention period or method of determining the retention period, the organizations and individuals who can access the information, and the security measures in place. Notably, the policy should go beyond explaining what data enterprises collect. The platform must also disclose the method for the data subject to view, edit, request correction, delete, destroy, or restrict the processing of the provided data. The mechanism for receiving and settling complaints related to information security must also be determined.
This regulation establishes an important requirement: the security policy must align with actual operational practices. Organizations should not state that users have the right to request data deletion unless they provide the necessary mechanisms, such as a request form, contact channel, designated processing point, and internal procedures, to support and process those requests. Similarly, a general record that “data is stored for the required time” may not be sufficient if the business fails to explain which criteria are used to determine the required time. The privacy policy also cannot be compiled separately from the technology system. Disclosures should accurately reflect that data is being transferred to billing units, shipping partners, cloud providers, conglomerate companies, or advertising service providers.
It is especially important that all contents related to the privacy policy as mentioned above will be required to comply with the law on data and regulations on personal data protection. It can also be understood that when enterprises carry out procedures related to registering e-commerce websites or procedures or when there is a complaint about the content on the website, the relevant regulatory authority has the right to require the enterprise to prove that the enterprise has complied with the regulations on data protection and personal data protection, including whether the enterprise has carried out the procedures for assessing the impact of personal data protection or not yet.
3. Rights and obligations of the parties
Platforms must disclose the rights and obligations of at least three groups of entities: platform owners, sellers, and buyers.
Rights and obligations of e-commerce platform owners: Promulgate, publicize, and organize the implementation of operation and transaction conditions. Develop and publicize service standards and processes for participating in activities on the platform; Collect service fees according to the publicized price policy; Full information or a summary of the type of promotion to be applied is provided to the buyer prior to placing an order; Ensure the safe and stable operation of the platform; Stipulate cases of suspension, termination, or restriction of accounts of sellers and buyers; Apply all necessary measures to ensure the security of information related to business secrets of users and personal information of consumers; Receive and settle requests, reports, and complaints from users; Supervising and preventing violations of the law; coordinate and provide information and data at the request of competent state agencies.
Rights and obligations of sellers: To register, maintain, suspend, and terminate the sale of goods and provision of services; to decide on goods, services, selling prices, and sales promotion policies in accordance with the provisions of law and agreements with the platform managers; to use technical infrastructure, the platform’s supporting tools; have access to data directly related to enterprise activities; be ensured to make full and timely payments and settle requests, reflections, and complaints according to the principles of publicity and transparency; Provide accurate and complete information; ensure the quality of goods and services; fully fulfill the obligations of delivery, warranty, return, and refund; and not taking advantage of the platform to do business in industries and trades banned from enterprise investment, counterfeit goods, goods infringing upon intellectual property rights, and other violations of law. Fulfill financial obligations to the state; protect buyer data; protect consumer information; coordinate with platform managers and competent state agencies in handling violations of law.
Rights and obligations of buyers: To be guaranteed the interests of consumers; to be provided with complete and accurate information about goods, services, and sellers; to choose goods, services, payment, and delivery methods; to protect personal data; to handle complaints, requests, and complaints as prescribed; Provide necessary and accurate information; make full and on-time payments. Comply with legal regulations, operating conditions, and trading conditions of the platform; do not take advantage of the platform to commit acts of violating the law.
The point to avoid is to build the clause in such a way that all rights belong to the platform, and all risks are passed on to the seller or buyer. Provisions that allow platforms to lock accounts, hold funds, change fees, or adjust services without specifying grounds, notification processes, and complaint mechanisms can create significant imbalances. The disclosure clause not only needs to protect the platform, but it must also show how the platform’s power is controlled.
4. Methods of receiving and settling complaints, requests, and complaints
The platform must publish at least one online contact method, the intake and processing process, the steps that users must take, the initial response deadline, the expected deadline for resolution, and the tools used to support the processing. A simple customer care email address may not be enough if the platform does not disclose response times, how complaints are classified, requests for evidence, or mechanisms for tracking progress.
For enterprises with a large volume of transactions, the complaint mechanism should be designed as a verifiable process: the time of receipt must be recorded, the record must have a reference code, the user must be able to track the processing status, and the results must be able to be stored. This is also an area where public content needs to match operational capacity. Committing to a processing time which is too short and not having enough personnel or a support system can cause enterprises to continuously violate the policies issued by them.
The Law on E-commerce and Decree 248 has classified e-commerce platforms according to their functions and scope of operation, and based on that classification, set requirements for information disclosure. Therefore, enterprises will also need to accurately determine the function of the e-commerce platform that the business is managing, developing, and operating, whether it directly sells, provides an intermediary environment or has an online ordering function. Determining the exact type of platform is especially important because it determines the obligations and legal responsibilities that enterprises must comply with, from legal procedures to content issues expressed on the platform. This content will continue to be detailed in Part 2 about the content that needs to be disclosed on the e-commerce platform.
Time of writing: July 13, 2026
The article contains general information which is of reference value. In case you want to receive legal opinions on issues you need clarification on, please get in touch with our Lawyer at info@cd.az9s.com
Why choose CDLAF’s service?
- We provide effective and comprehensive legal solutions that help you save money and maintain compliance in your business;
- We continue to monitor your legal matters even after the service is completed and update you when there are any changes in the Vietnamese legal system;
- Our system of forms and processes related to labor and personnel is continuously built and updated and will be provided as soon as the customer requests it;
- As a Vietnamese law firm, we have a thorough understanding of Vietnam’s legal regulations, and grasp the psychology of employees, employers, and working methods at competent authorities;
- CDLAF’s team of lawyers has many years of experience in the field of labor and enterprises, as well as human resources and financial advisory.
- Strict information security procedures throughout the service performance and even after the service is completed.
You can refer for more information:
- Transferring Employees to Perform Other Works: Key Considerations for Enterprises
- Lawful Labor Discipline: Procedures and Key Notes for Enterprises
- Non-Compete Agreements In Employment Relationships: Are They Enforceable In Vietnam?
- Determining “Serious Damage” in Disciplinary Dismissal
- What Must Social Networks and Online Platforms Do to Comply with the Personal Data Protection Law 2025?
