Law on Cybersecurity of Vietnam
Vietnam's 2018 Law on Cybersecurity (data localisation, content control), now operating alongside the Personal Data Protection Law and Digital Technology Industry Law in force from 1 January 2026.
| Jurisdiction | Vietnam |
|---|---|
| Category | Cybersecurity |
| Status | Active |
| Latest development |
Analysis
Key Requirements
The Law on Cybersecurity of Vietnam imposes several key requirements:
- Data Localization: Certain types of personal data must be stored within Vietnam's territory. This applies to both domestic and foreign companies collecting, analyzing, and processing personal data of Vietnamese users. Article 26 of the Cybersecurity Law
- Local Office Presence: Foreign companies providing specified services may be required to establish a branch or representative office in Vietnam. Article 26 of Decree 53/2022/ND-CP
- Content Restrictions: The law prohibits using cyberspace to conduct activities that oppose the state, distort history, or spread false information. Article 8 of the Cybersecurity Law
- Cybersecurity Incident Reporting: Organizations must report cybersecurity incidents within 72 hours. Article 23 of Decree 13/2023/ND-CP
- User Data Protection: Companies must implement technical and managerial measures to protect personal data. Article 26 of Decree 13/2023/ND-CP
Compliance Challenges
Organizations face several challenges in complying with the Law on Cybersecurity:
- Ambiguity in Implementation: The law's broad scope and lack of specific guidelines create uncertainty for businesses. Vietnam Briefing Report
- Technical Complexity: Implementing data localization and cybersecurity measures requires significant technical resources and expertise. KPMG Technical Update
- Cost of Compliance: Establishing local offices and data centers in Vietnam can be expensive, especially for smaller companies. U.S. Chamber of Commerce Analysis
- Cross-border Data Flows: Restrictions on data transfers can hinder international business operations. Vietnam Cyber Security Summary Report
Implementation Best Practices
To effectively implement the Law on Cybersecurity:
- Conduct a thorough data audit to identify what personal data is collected and where it's stored. KPMG Data Protection Guide
- Implement robust data protection measures, including encryption and access controls. Vietnam Network Information Security Law
- Establish clear incident response procedures to meet the 72-hour reporting requirement. Decree 13/2023/ND-CP Guidelines
- Consider using local data centers or cloud services that comply with Vietnamese regulations. Vietnam Data Center Market Report
- Engage legal experts familiar with Vietnamese cybersecurity laws to ensure compliance. Vietnam Law Firm Directory
Recent Updates
- Decree 53/2022/ND-CP: Came into effect on October 1, 2022, providing detailed guidelines on data localization requirements. Official Announcement
- Decree 13/2023/ND-CP: Effective from July 1, 2023, this decree provides comprehensive regulations on personal data protection. DLA Piper Analysis
- Draft Personal Data Protection Law: Released for public consultation on September 24, 2024, expected to be passed in late 2025. DLA Piper Data Protection Laws of the World
Related Regulations
- Law on Network Information Security: Complements the Cybersecurity Law by providing additional guidelines on information system security. Full Text of the Law
- ASEAN Framework on Digital Data Governance: Provides regional guidelines that interact with Vietnam's national regulations. ASEAN Data Management Framework
- Vietnam's E-Transactions Law: Governs electronic transactions and intersects with cybersecurity requirements. Vietnam Legal Framework
Industry Impact
The Law on Cybersecurity has significant impacts across various industries:
- Technology Sector: Companies face increased costs and operational challenges due to data localization requirements. Vietnam Briefing Industry Analysis
- E-commerce: Online retailers must adapt their data storage and processing practices to comply with the law. Vietnam E-commerce Report
- Financial Services: Banks and fintech companies need to implement stricter data protection measures. Vietnam Fintech Landscape Report
- Healthcare: Medical institutions must ensure patient data is stored and processed in compliance with the law. Vietnam Healthcare Sector Overview
Sources
- Law on Cybersecurity of Vietnam Full Text
- Decree 53/2022/ND-CP Overview
- Decree 13/2023/ND-CP Analysis
- KPMG Technical Update on Data Security Challenges
- Vietnam Briefing Report on Data Localization
- U.S. Chamber of Commerce Analysis
- Vietnam Cyber Security Summary Report
- DLA Piper Data Protection Laws of the World - Vietnam
- ASEAN Data Management Framework
- Vietnam E-Transactions Law
- Vietnam E-commerce Report
- Vietnam Fintech Landscape Report
- Vietnam Healthcare Sector Overview
Recent developments
- — Vietnam's Ministry of Public Security released the draft Cybersecurity Law 2025 for public consultation, aiming to consolidate and replace the 2018 Cybersecurity Law and the 2015 Law on Network Information Security; the draft broadens the law’s scope, introduces new obligations for service providers, and removes the mandatory local office requirement for foreign businesses, with the law expected to take effect on 1 January 2026[1]. (source)
- — On 31 October 2025, the draft Cybersecurity Law, including new cybersecurity obligations, was formally introduced to the National Assembly, marking a major legislative step toward its expected adoption and implementation in 2026[7]. (source)
- — The draft law consolidates cybersecurity and information security regulations under the Ministry of Public Security, introduces enhanced obligations for service providers, and removes previous data localization and local presence requirements, reflecting a more flexible approach to cross-border data flows[2]. (source)
- — Vietnam’s new Cybersecurity Law, merging the 2018 and 2015 laws, is set to be introduced during the National Assembly’s 9th session in October 2025, with the goal of streamlining regulations and solidifying the Ministry of Public Security’s authority over cybersecurity[3]. (source)
- — The draft law introduces provisions to strengthen cyberattack prevention, address AI-related risks, and enhance data security, including requirements for identifying IP addresses and establishing mechanisms for rapid response to cyber incidents[5]. (source)
- — A Vietnam Today news segment highlights that the amended Cybersecurity Law 2025 merges previous laws, introduces stricter compliance requirements, and is part of a broader effort to address emerging digital threats and regulatory gaps[4]. (source)
Related regulations
- Vietnam Personal Data Protection Law (Law No. 91/2025/QH15) — Vietnam, Active, effective 2026-01-01
- Vietnam Law on Digital Technology Industry — Vietnam, Active, effective 2026-01-01
- Vietnam Law on Artificial Intelligence — Vietnam, Active, effective 2026-03-01
- NYDFS Cybersecurity Regulation — New York, Active, effective 2025-11-01
- Austria NIS2 Act — Austria, Upcoming
- Luxembourg NIS2 Transposition — Luxembourg, Active
- EU Cyber Resilience Act (CRA) — European Union, Phased, effective 2027-12-11
- EU Cyber Resilience Act - Vulnerability and Incident Reporting (11 Sep 2026) — European Union, Active, effective 2026-09-11
Put it into practice
- Generate the policy: Vietnam cybersecurity policy generator (generatepolicy.com)
- Buy the policy pack: Privacy Program Bundle (cyberpolicy.shop)
- Build it yourself: GDPR & DPIA Compliance Workbook (ciso.diy)
Browse all regulations · Compliance deadlines · Latest updates