DPO Radio
AesirX ComplianceOne | Decree 328 Vietnam False Information
UPCOMING
Decree 328/2026/NĐ-CP – False Information
Preventing and Combating Fake and False Information: Issued 19 August 2026, in force from 5 October 2026
Prepare labeling-response, takedown and contact-point readiness against the signed text before its duties bind.
Decree 328/2026/NĐ-CP: Scope and Current Status
Decree 328/2026/NĐ-CP was issued by the Government on 19 August 2026 and takes effect on 5 October 2026. It is signed, final law – not a draft, and not a consultation document – but none of its obligations bind before that date. It runs to 24 articles across four chapters, with the Ministry of Public Security as lead authority, and it is a new implementing decree under the Cybersecurity Law with no draft lineage: nothing preceded it in the readiness track, and it supersedes nothing.
The decree establishes one umbrella definition of fake and false information with seven sub-types and a confirmed-versus-suspected split, two classification axes (harm level and access-to-information category) with stated carve-outs, a six-step handling process from detection through sanction routing, verification outcomes with portal processing statuses, labeling and publication clocks, provider blocking and removal duties, citizen reporting channels including the national digital identity application, and a distributed authority map with a central results repository at the ministry.
One fact deserves emphasis because it is easy to assume otherwise: the decree sets no numeric provider-side removal deadline. Providers must block, refuse posting of, or remove information once it is labeled, notified or published by competent authorities, but the numbered clocks in the decree sit on the authority side, and direction-based deadlines for providers arise under the separate handling decree.
How Decree 328 Relates to the Vietnam Cybersecurity Law 2025
Cybersecurity Law 116/2025/QH15 prohibits false and fabricated information among its named harms; Decree 328 supplies the dedicated machinery for fake and false information specifically; definition, classification, verification, labeling, publication and correction.
Its two siblings complete the picture. Decree 327, in force since 19 August 2026, carries the general violating-information measures and the direction-based clocks (removal within 24 hours or 6 in emergencies once a direction issues) that continue to apply while this decree awaits effect and alongside it afterwards. And Decree 328 contains no penalty schedule of its own: sanctions route to the administrative-violations and penal frameworks, with monetary exposure crossing into Decree 330/2026/NĐ-CP where conduct overlaps its false-information article families, and no figure from that instrument should be quoted without its individual-versus-organization attribution rule.
Technical Provisions and Compliance Obligations
| Provision | What It Establishes | Operational Implication |
|---|---|---|
| Điều 3 | One umbrella definition of fake and false information with seven sub-types, split into confirmed and suspected | Screening vocabulary should match the statutory sub-types, not a house taxonomy |
| Điều 4 | Two classification axes: harm level – especially serious versus harmful – and access-to-information category | The harm classification drives which publication clock applies |
| Điều 5 khoản 5 | Three carve-outs from the handling process | Not every disputed statement enters the process; the carve-outs are checkable |
| Điều 8 | The six-step handling process from detection to sanction routing | Each step is a distinct record with its own owner and outcome |
| Điều 9 | Verification outcomes – confirmed, cleared, unverifiable – and portal processing statuses | An outcome is a recorded state, not an inference |
| Điều 10 | Authority-side labeling within 24 hours of the verification conclusion, using the prescribed mark or warning text | Labeled content is the trigger for downstream provider duties |
| Điều 11 | Publication clocks: immediate for especially-serious items, within 12 working hours of labeling for harmful items | Victims and affected organizations get dated, checkable publication duties |
| Điều 12 | Provider duties to block, refuse posting of, and remove labeled, notified or published information, with no numeric deadline stated in this decree | Provider readiness is about intake and execution capability, not a countdown in this text |
| Điều 13, Điều 14 | Citizen reporting channels including the national digital identity application, evidence preservation, and the ministry's central results repository | Report intake and evidence handling face statutory channels |
| Điều 16–21 | The distributed authority map: every verifying ministry and People's Committee labels within its remit, with the Ministry of Public Security taking cross-cutting cases | The counterpart authority varies by subject matter — verification is not single-agency |
| Điều 22 khoản 2 | Provider controls – detect, block, remove, a user violation-reporting mechanism, a non-amplification bar – and a 24/7 contact point | The contact point is continuous availability, not a numeric response deadline |
| Obligation | Timeline | Reference |
|---|---|---|
| Decree takes effect | 5 October 2026 | Điều 23 |
| Authority labels information concluded fake or false | 24 hours from the verification conclusion | Điều 10 khoản 4 điểm a |
| Publication of especially-serious cases | Immediately | Điều 11 khoản 4 điểm a |
| Publication or warning for harmful cases | Within 12 working hours of labeling | Điều 11 khoản 4 điểm b |
| Provider contact point with the ministry | Continuous, 24/7 | Điều 22 khoản 2 điểm đ |
| Provider removal of labeled content | On labeling, notification or publication – no numeric deadline stated in this decree | Điều 12 khoản 2 |
Forms and Data Requirements
The decree prescribes no appendix forms anywhere in its text, and its sanctions live in other instruments rather than in a schedule of its own. Everything ComplianceOne supplies for this instrument is an internal preparation template, labelled as internal and carried with the 5 October 2026 effective date so preparation work is dated to the regime it anticipates.
How ComplianceOne Supports Decree 328 Compliance
The instrument is carried with its true status (final law, not yet in force) so preparation runs against a known effective date without presenting the duties as currently binding.
The definitional structure is held as the decree states it: the umbrella definition, the seven sub-types, the confirmed-versus-suspected split and the carve-outs, each with its citation, so screening work uses the statutory vocabulary from day one.
The clocks are carried on the side of the ladder they actually sit on. The 24-hour labeling and the immediate and 12-working-hour publication duties are authority-side; the provider record states the no-numeric-deadline fact and points direction-based clocks to the sibling handling decree.
Contact-point, report-intake and evidence-preservation readiness can be assigned, evidenced and reviewed before 5 October, so the effective date arrives as a checkpoint rather than a scramble.
Built for a Dated Effective-Date Runway
Status is the loudest claim, and it is carried honestly: signed final law, binding from 5 October 2026, with nothing presented as in force early.
The clocks sit where the text puts them. Authority-side labeling and publication deadlines are not converted into invented provider countdowns, and the no-numeric-removal-deadline fact is stated rather than smoothed over.
Readiness work is dated to the regime it anticipates, so evidence built in September reads correctly when inspected in November.
The sibling boundary is kept: directions and their deadlines under the handling decree stay on that instrument's record, connected but not conflated.
Related Modules
Incident Operations
Coordinates labeled-content handling, direction execution and correction tracking on one evidence chain
Explore Incident Operations
Program Governance
Assigns readiness work against the 5 October 2026 effective date with named owners
Explore Program Governance
Monitoring Programs
Tracks screening fronts, contact-point reviews and post-effective-date duties
Explore Monitoring Programs
Audit Trail
Preserves verification requests, outcomes, executions and correction history
Explore Audit TrailCompliance Readiness Checklist
Organizations preparing for Decree 328 should confirm:
See Decree 328 Compliance in Action
See how ComplianceOne turns Decree requirements into practical compliance workflows and evidence.
Ronni K. Gothard Christiansen - Technical Privacy Engineer & CEO
Technical Compliance Expert, 32+ Years Open Source Advocate, X-BoD Open Source Matters Inc.
Frequently Asked Questions
Decree 328 was issued on 19 August 2026, with an effective date of 5 October 2026 under Điều 23. Compliance records should distinguish between readiness work before that date and obligations applying from it.
No. The decree sets no numeric provider-side removal deadline. The 24-hour clock in its text is the authority's labeling duty after a verification conclusion. Providers must block, refuse posting of, or remove content once it is labeled, notified or published, and where an authority issues a direction, the numbered deadlines arise under the separate handling decree.
A distributed authority map: each verifying ministry and People's Committee labels within its own remit, with the Ministry of Public Security taking cross-cutting cases and maintaining the central results repository. Verification and labeling are not the monopoly of a single agency.
Especially-serious cases are published immediately; harmful cases with narrower impact are published or warned about within 12 working hours of labeling. Both are duties on the authority side of the process, with victims and affected organizations able to track dated outcomes.
Decree 328 contains no penalty schedule of its own. Sanctions route to the administrative-violations and penal frameworks; where conduct overlaps the false-information article families of the shared penalty decree, monetary exposure runs there; and any figure from that instrument must carry its individual-versus-organization attribution rule.
Next Steps
Start a Compliance Pilot
Test screening vocabulary, contact-point readiness, intake routing and correction workflows under Decree 328.
Discuss Your Compliance Needs
Review your platform exposure, verification-request options as a potential victim, and Decree 328 compliance readiness.
The evolution of Aesir is Aesir + 
(the Norse symbol for Necessity)"Needed in order to achieve a particular result"
♥Join the AesirX Privacy Newsletter. Stay Informed. Stay Compliant.
