Vietnam Cybersecurity Law 24/2018

The Vietnam Cybersecurity Law 2025 (Law 116/2025/QH15) is the successor framework that will replace Law 24/2018 on July 1, 2026. For the obligations that will apply after that date, see the Vietnam Cybersecurity Law 2025 (Law 116/2025/QH15) compliance page.

Law 24 is the predecessor that defines the current baseline. Organizations that have been complying with Law 24 since 2019 have a compliance foundation that Law 116 will build on and expand. The transition from Law 24 to Law 116 involves expanded scope (more organization types and service categories come within Law 116's coverage), updated obligation specifications, and the eventual issuance of new implementing decrees under Law 116 to replace Decree 13/2022 and Circular 24/2023. The degree of continuity versus change between the two laws determines how much of an organization's Law 24 compliance program can be directly transitioned versus rebuilt.

For the Cybersecurity and Legal Operations Lead (P-VN-06) and the Internal Audit Lead (P-VN-10), the transition period creates a dual compliance requirement: maintaining active compliance under Law 24 until July 1, 2026, while simultaneously preparing for Law 116 compliance from that date. This dual-track requirement means that compliance programs must account for both frameworks during the transition window, and that evidence produced during the transition period must be correctly attributed to the applicable framework.

ComplianceOne supports Law 24 compliance through its cybersecurity incident operations, authority cooperation, and program governance capabilities – with evidence continuity features that carry compliance records through the transition to Law 116.

The Incident Response module manages cybersecurity incident case workflows under Law 24's notification requirements. Each case captures the incident discovery timestamp, assessment timeline, notification to MPS, and any authority follow-up, preserving the evidence chain of custody that demonstrates compliance with the notification obligation. For organizations managing dual-framework compliance during the transition period, incident cases can be tagged to the applicable framework (Law 24 or Law 116) based on the incident date and the framework in force at the time, ensuring that historical incident records are correctly attributed.

The Monitoring Programs module handles authority cooperation workflows under Law 24 – MPS information requests, system access requests, and user data provision requests – through a structured workflow with verification, legal review, approval, and disclosure logging. Each authority interaction is captured in the centralized disclosure register with the legal basis, scope, approving authority, and response details. This register serves as the primary evidence of Law 24 authority cooperation compliance and remains accessible for historical inspection readiness after the transition to Law 116.

For in-scope determination and data localization compliance documentation, the Program Governance module supports governance workflows that record the in-scope assessment, the criteria applied (per Decree 13/2022), the determination outcome, and the data localization measures implemented. These records are the foundational evidence of Law 24 compliance posture and are maintained through the transition as part of the organization's compliance archive.