Vietnam Cybersecurity Law

Records made under the earlier law may still matter for past periods, contracts, incidents and regulator review during the transition.

• Cybersecurity Law 24/2018
• Decree 53 Cybersecurity Implementation

Vietnam now has two five-level scales for information systems, and a level must always name the one it was set under. In both, cấp độ 1 is the lowest and cấp độ 5 the highest. Both assess potential harm, with different detailed criteria.

• The new scale. Article 8 of Law 116/2025/QH15 grades systems by how much harm an incident or a violation would cause. Article 8(2) leaves the criteria, the competent body and the procedure to a Government decree. That decree is Decree 331/2026/NĐ-CP, in force since 19 August 2026.
• The old scale. Article 21 of Law 86/2015/QH13 also grades systems by the potential harm from a violation or incident. Decree 85/2016/NĐ-CP details the criteria, including what a system serves and the information it processes. It was made under the Law on Network Information Security 86/2015/QH13, which Article 44(2) of the new Law ended on 1 July 2026. Under Article 45(1), a level already set under Decree 85 is preserved, with twelve months, to 30 June 2027, to meet the new Law's conditions, standards and measures.

Article 9 of the new Law is separate again. It lets the Prime Minister designate a system as important to national security, on the Ministry of Public Security's proposal. That is a designation, not a level.

• Decree 85/2016 Information System Security Levels – transition context, with the preserved-level route to 30 June 2027

Decree 333/2026/NĐ-CP is the general implementing decree, issued and in force since 19 August 2026. It sets out the procedures for cybersecurity protection measures, the IP identification regime and the certified training rollout. It also sets the duties of covered providers:

• Verification duties.
• Providing user information within 24 hours, or 3 hours in an emergency.
• Removing content within 24 hours, or 6 hours in an emergency.
• Keeping system logs retrievable for at least 12 months.
• Keeping data localized in Vietnam for at least 24 months.

Whether a specific service is a covered provider depends on a definition that refers to telecom law, so unclear cases need legal analysis of the actual deployment. The decree replaces an earlier consultation draft.

• Explore Decree 333 Implementation
• Superseded draft

The Ministry of Public Security's draft circular on specialist cybersecurity training would implement the training regime of Decree 333/2026/NĐ-CP: the curriculum, course and annual reports, certificates, the recognition of foreign certificates, and a Ministry-run management system. It is open for comment from 9 to 19 October 2026. It is not issued, carries no number, and its effective date is blank. It does not amend Decree 333.

• Explore the training circular draft
• Decree 333 Implementation

Decree 331/2026/NĐ-CP, issued and in force since 19 August 2026, sets out how systems are graded under the new Law's five levels. It covers:

• The criteria for levels 1–5, with data-subject thresholds.
• The level-determination dossier and its appraisal deadlines in working days.
• The criteria for systems critical to national security.
• Protection duties for each level, and separation rules for cloud and data centres.
• Incident reporting in three tiers (72-hour, 24-hour and immediate) and an annual reporting cycle.

Decree 331 repeals nothing. Decree 85/2016 remains the transitional regime for existing systems while the new duties phase in. Decree 331 replaces an earlier priority draft.

• Explore Decree 331 Information Systems Protection
• Superseded draft

Decree 327/2026/NĐ-CP sets out how to prevent and handle violating information and acts in cyberspace. It was issued and took effect on 19 August 2026, with no transitional period. It covers:

• Preventive duties for providers, and seven families of handling measures.
• A 24-hour report of a serious attack.
• Providing data within 24 hours, or 3 hours in an emergency.
• Removing content within 24 hours, or 6 hours in an emergency, with the same deadlines applying to the people who posted the content.
• A coordination contact point on continuous standby.
• Explore Decree 327 Information Handling

Decree 332/2026/NĐ-CP, issued and in force since 19 August 2026, defines which cybersecurity products and services are regulated: 8 product and 11 service categories. It sets the conditions and deadlines for the 10-year trading licence, and none of its conditions is a capital threshold. Contracts signed before it took effect continue, but there is no general grace period for operating without a licence.

• Explore Decree 332 Products and Services

Decree 328/2026/NĐ-CP was issued on 19 August 2026 and takes effect on 5 October 2026. It is signed final law in force from that date. It defines fake and false information and sets a six-step handling process, deadlines for authorities to label and publish, and a 24/7 contact point at each provider. It sets no numeric removal deadline for providers; deadlines triggered by an authority's direction arise under Decree 327.

*Decree 163/2024/NĐ-CP is not a Cybersecurity Law implementing decree. It belongs under the Telecommunications Law, and matters here only where telecom, cloud, data-center, OTT, platform or infrastructure duties overlap with cybersecurity compliance.

• Explore Decree 328 False Information Evidence

Decree 341/2026/NĐ-CP covers civil cryptography under Article 28 and Article 29 of the Law. It was issued and took effect on 1 September 2026. Its commencement does not cancel qualifying earlier licences: Article 45(2) of the Law and Article 18(1) of Decree 341 preserve them until their stated expiry. It requires:

• A business licence to trade any product or service on its conditional list.
• Conformity certification before a product circulates.
• A separate import/export licence for products listed in a second annex.

The Government Cipher Committee (Ban Cơ yếu Chính phủ), under the Ministry of National Defence, issues the licences, not the Ministry of Public Security. The Ministry of Public Security licenses only dual-use products with both civil-cryptographic and cybersecurity features, and only after the Committee's written opinion. The decree has no repeal clause and does not name Decree 211/2025. That alone does not establish that both are active. Under Article 57(2) of Law 64/2025/QH15, as amended by Law 87/2025/QH15, continuation of an implementing decree after its parent law lapses requires an official announcement. Review any such announcement and the preserved-licence rules for your filing.

• Explore Decree 341 Civil Cryptography

Decree 343/2026/NĐ-CP was issued and took effect on 3 September 2026; the Government's explanatory article followed on 4 September. Its 50 articles cover the Law's provisions within the Ministry of National Defence's remit: military information systems, cybersecurity products and services for military purposes, and preventing and responding to information conflicts.

• Filtering under Article 34 needs any one of its three factors.
• Remediation under Article 35 needs all three of its conditions.
• Article 36 does not say how its three elimination factors relate.
• Content posters within the Ministry of National Defence remit must remove content within 6 hours of a request, or 1 hour in an emergency (Article 25(1)). Related data must be supplied within 24 hours, or 6 hours in an emergency (Article 25(4)).
• Articles 29–48 set no numeric deadline for responding to a conflict. Deadlines elsewhere in the decree apply only to their own events, and Decree 333's deadlines do not carry over.
• Explore Decree 343 Cyber-Conflict Response

Decree 330/2026/NĐ-CP sets the penalties for both cybersecurity and personal data protection, in force since 19 August 2026. Its cybersecurity articles include sanctions tied to content-removal deadlines of 24 hours and 6 hours, retention of digital-account device information, IP addresses and login times for at least 90 days (Article 34(1)(c)), and data localization. Decree 333's minimum 12-month system-log retention is a separate rule. Resolution 22/2026/NQ-CP concerns procedural changes; the earlier shared enforcement draft was superseded.

• Explore Decree 330 Enforcement Penalties