DPO Radio
AesirX ComplianceOne | Decree 332 Vietnam Cybersecurity Licensing
ACTIVE
Decree 332/2026/NĐ-CP Cybersecurity Products and Services
Decree 332/2026/NĐ-CP Cybersecurity Products and Services
Screen your offerings against the signed taxonomy and run licence, reporting and renewal work on the statutory clocks.
Decree 332/2026/NĐ-CP: Scope and Current Status
Decree 332/2026/NĐ-CP was issued by the Government on 19 August 2026 and took effect the same day. It runs to 22 articles across four chapters, with the Ministry of Public Security as lead authority, detailing khoản 3 Điều 28 and khoản 3 Điều 29 of Cybersecurity Law 116/2025/QH15. It is promulgated, in force, and not a proposal.
The decree defines the complete regulated taxonomy; 8 product categories, including five "other" sub-types of which four are reserved to enterprises tasked or contracted by the Ministry of Public Security or the Ministry of National Defence, and 11 service categories, reaching services such as VPN-type IP concealment and bug-bounty platforms. Civil cryptography is excluded and runs under its own regime.
Two structural facts are worth stating plainly. First, the licence conditions are establishment, personnel and technical conditions only;the decree sets no capital threshold anywhere, which distinguishes this regime from capital-gated conditional business lines. Second, the transition is narrow: contracts signed and valid before the effective date continue, but there is no general grace period for unlicensed operations.
Civil cryptography running under its own regime does not make it someone else's problem. Decree 341/2026/NĐ-CP, in force since 1 September 2026, governs civil-cryptographic products and services, and Điều 4 khoản 5 and Điều 9 khoản 4 of that decree describe the seam between the two regimes: a product carrying both civil-cryptographic and cybersecurity features is licensed by the Ministry of Public Security under the cybersecurity regime, after Ban Cơ yếu Chính phủ has given a written opinion on the cryptographic feature. Reading either decree on its own produces a confident half-answer for such a product.
Whether any given offering, including any vendor's, and including AesirX's own, falls inside the regulated taxonomy is a classification against the statutory categories in a specific deployment. This page describes the regime; it does not classify anyone's products, and self-assessment here does not substitute for legal review.
How Decree 332 Relates to the Vietnam Cybersecurity Law 2025
Cybersecurity Law 116/2025/QH15 made cybersecurity products and services a conditional business line and delegated the conditions and procedures to the Government. Decree 332 is that decree, promulgating the business-conditions slot the implementation roadmap had tracked as a planned item.
The decree prescribes obligations and licence consequences, suspension of 3 to 6 months, revocation on stated grounds, but no fine figures of its own. Monetary exposure runs through Decree 330/2026/NĐ-CP's business and import violation families and its supplementary penalty of trading-licence revocation for 1 to 24 months, and any figure quoted from that instrument needs its individual-versus-organization attribution rule.
Legacy licences are not orphaned: a network information security licence issued under the earlier regime converts through the decree's exchange table rather than lapsing silently.
Technical Provisions and Compliance Obligations
| Provision | What It Establishes | Operational Implication |
|---|---|---|
| Điều 3 | 8 regulated product categories, including five "other" sub-types, four of them reserved to ministry-tasked or -contracted enterprises | Product screening must check the reserved sub-types before any market plan |
| Điều 4 | 11 regulated service categories, including VPN-type IP concealment and bug-bounty platforms | Service screening reaches offerings not usually labelled "security products" |
| Điều 5 | The trading licence obligation and its 10-year validity | Trading any regulated product or service without the licence is the primary exposure |
| Điều 6 | Establishment, personnel and technical conditions — lawful establishment, clean record, a foreign-invested investment term over 5 years, qualified staff; no capital threshold exists | Condition evidence is corporate, human and technical, not financial-minimum |
| Điều 8 | Service-provision conditions with headcount floors of 5 and 12, a Vietnamese-national legal representative, and four required plans | Service licences carry team-composition facts that must stay true |
| Điều 9 | The application dossier and its clocks: 3 working days validity check, 10 working days to supplement, 28 working days to decision | Dossier completeness drives the whole path; a lapsed supplement restarts it |
| Điều 10–12 | Exchange and re-issuance in 5 working days preserving the original term; one extension of up to 3 years, filed at least 60 days before expiry, decided in 10 working days | Renewal is a calendar discipline — the filing window closes 60 days out |
| Điều 13 | The per-lot export/import licence, 2-year validity, against the Phụ lục II product list, decided in 5 working days | Each shipment lot needs its own licence, tied to a valid trading licence |
| Điều 14–16 | Suspension and revocation grounds — a 40-day condition cure window, a 6-month operation-commencement requirement — plus annual reporting before 31 January and a 10-working-day suspension notice | Ongoing duties continue for the licence's whole life |
| Điều 20, Điều 21 | Same-day effect; pre-effective contracts continue; pending dossiers received before 1 July 2026 switch to this decree's procedures; no general grace period | Transition posture must be assessed per contract and per dossier, not assumed |
| Obligation | Timeline | Reference |
|---|---|---|
| Decree takes effect | 19 August 2026 | Điều 20 |
| Trading licence validity | 10 years | Điều 5 khoản 2; Điều 12 khoản 1 |
| Authority checks dossier validity | 3 working days | Điều 9 khoản 4 |
| Applicant supplements the dossier | 10 working days | Điều 9 khoản 4 điểm b |
| Licensing decision | 28 working days from a valid dossier | Điều 9 khoản 5 |
| Exchange or re-issuance decision | 5 working days | Điều 10 khoản 6; Điều 11 khoản 5 |
| Extension filing window | At least 60 days before expiry; one extension, up to 3 years | Điều 12 khoản 1 |
| Extension decision | 10 working days | Điều 12 khoản 5 |
| Export/import licence validity | 2 years, per shipment lot | Điều 13 khoản 1 |
| Export/import licence decision | 5 working days | Điều 13 khoản 7 |
| Cure a condition deficiency | 40 days from the remediation demand | Điều 14 khoản 1 điểm b |
| Commence operations after issuance | 6 months | Điều 14 khoản 1 điểm c |
| Suspension or revocation decision | 15 working days from the violation minutes | Điều 14 khoản 3 |
| Annual trading report | Before 31 January, covering 1 January to 31 December | Điều 16 khoản 3 |
| Notify a business suspension | 10 working days | Điều 16 khoản 4 |
| Pending-dossier cutoff | Dossiers received before 1 July 2026 and unresolved are processed under this decree | Điều 21 khoản 2 |
| Comprehensive inspections | At most once per year absent violation signs | Điều 19 khoản 1 |
Forms and Data Requirements
The decree's first appendix prescribes twelve official forms, Mẫu số 01 through Mẫu số 12: the licences, the application and export/import forms, personnel declarations, the technical and business plans, the annual report, and the receipt, supplementation and refusal notices. All twelve are carried from the signed source with their titles and section structures.
Phụ lục II, the list of products subject to export/import licensing by customs code, is cited, not reproduced: ComplianceOne references it from the decree's export/import article and describes how it is used, but the itemized customs-code table itself is not carried as platform content. Export/import screening against it belongs with the trade-compliance owner and the signed text.
How ComplianceOne Supports Decree 332 Compliance
The regulated taxonomy is carried category by category with its article citations, including the reserved sub-types, so an offering screen reads against the signed lists rather than a paraphrase.
Self-classification is structured as evidence: which category was considered, what the offering does, who concluded what and when, a record framed as preparation for legal review, not a substitute for it.
The licence lifecycle runs on the statutory clocks, with the 60-day extension window, the 40-day cure window, the 6-month commencement requirement and the annual report date carried as deadlines with owners.
Condition facts that must stay true – personnel floors, technical capability, the monitoring connection – are tracked as maintained evidence rather than a one-time application artifact.
Built for Licence-Lifecycle Discipline
The taxonomy screen is a record, not a memory. What was considered, against which category, with what conclusion, retrievable when the question is asked again.
Deadlines run in both directions: the authority's review clocks are diarized so a filing that goes quiet is noticed, and the applicant's windows (supplementation, cure, extension) are owned so they do not lapse by inattention.
Condition evidence stays current. A licence issued on a team that has since changed is an exposure; the facts that must remain true are reviewed, not archived.
Classification is preparation for counsel. The record states what the offering does and where it may sit, the decision that it is or is not regulated stays a legal judgment.
Compliance Readiness Checklist
Organizations operating under Decree 332 should confirm:
See Decree Decree 332 Compliance in Action
See how ComplianceOne carries a licensing decree with its taxonomy, its review clocks, its official forms and the condition evidence a licence depends on.
Ronni K. Gothard Christiansen - Technical Privacy Engineer & CEO
Technical Compliance Expert, 32+ Years Open Source Advocate, X-BoD Open Source Matters Inc.
Frequently Asked Questions
Yes. It was issued on 19 August 2026 and took effect the same day under Điều 20. Only contracts signed and valid before that date continue under the transition article; there is no general grace window for unlicensed operations.
No. The decree sets no capital threshold anywhere. Its conditions are establishment, personnel and technical; lawful establishment and clean record, an investment term over 5 years for foreign-invested enterprises, qualified staff with stated headcount floors for services, and appropriate equipment and facilities.
The decree defines 8 product categories and 11 service categories, reaching offerings such as VPN-type IP concealment services and bug-bounty platforms, with four sensitive product sub-types reserved to ministry-tasked or -contracted enterprises. Whether a specific offering falls inside a category is a classification in its deployment; screen first, then take the close calls to counsel.
The trading licence is valid 10 years: a 3-working-day validity check, up to 10 working days to supplement, and a decision within 28 working days of a valid dossier. Exchange and re-issuance decide in 5 working days preserving the original term, and one extension of up to 3 years is available if filed at least 60 days before expiry.
Listed products need a per-shipment-lot export/import licence, valid 2 years and dependent on a valid trading licence, decided in 5 working days. The product list is the decree's second appendix, referenced by customs code; ComplianceOne cites it from the signed text rather than reproducing the itemized table.
Next Steps
Start a Compliance Pilot
Test taxonomy screening, licence-lifecycle deadlines, condition evidence and reporting against the signed decree.
Discuss Your Compliance Needs
Review your offering screen, your transition posture, and the renewal calendar your licences will run on.
The evolution of Aesir is Aesir + 
(the Norse symbol for Necessity)"Needed in order to achieve a particular result"
♥Join the AesirX Privacy Newsletter. Stay Informed. Stay Compliant.
