Cybersecurity law & regulation in Vietnam (2026)

Legal framework

Law on Cybersecurity No. 116/2025/QH15 (effective 1 July 2026, replacing Law No. 24/2018/QH14); Decree 53/2022/ND-CP; Decree 13/2023/ND-CP on Personal Data Protection; enforced by the Ministry of Public Security (A05, Department of Cybersecurity and Prevention of High-Tech Crimes)

Key points: cybersecurity in Vietnam

1. 01Comprehensive Law (2018, being superseded in 2026)

   Law on Cybersecurity No. 24/2018/QH14 (in force since 1 January 2019) establishes the core regime: national cyberspace security, critical information infrastructure (CII) protection, platform obligations, and data localisation. It is being replaced on 1 July 2026 by Law No. 116/2025/QH15.

   thuvienphapluat.vn allenandgledhill.com

2. 02New Unified Law effective July 2026

   Law No. 116/2025/QH15, passed by the National Assembly on 10 December 2025 and effective 1 July 2026, consolidates the 2015 Cyber Information Security Law and 2018 Cybersecurity Law into one statute. It strengthens CII operator duties, bans AI-generated deepfakes for illegal use, mandates child-safety measures, and unifies state management under the Ministry of Public Security.

   english.luatvietnam.vn tilleke.com rajahtannasia.com

3. 03Breach & Incident Notification Duties

   Data controllers must notify the Ministry of Public Security's A05 unit within 72 hours of detecting a personal data breach (Decree 13/2023). E-commerce operators must notify authorities within 24 hours of detecting a hack risking consumer data loss. Banks and credit institutions must report cybersecurity incidents to the State Bank of Vietnam within 24 hours of detection and within five working days of resolution.

   kpmg.com resourcehub.bakermckenzie.com dlapiperdataprotection.com

4. 04Data Localisation Requirements

   Under both the 2018 law (implemented via Decree 53/2022) and the incoming 2026 law, domestic and foreign enterprises providing telecom, internet, or value-added services that collect or process Vietnamese users' personal or behavioural data must store that data on servers in Vietnam for a minimum of 24 months. Foreign enterprises are also required to establish a branch or representative office in Vietnam.

   assets.kpmg.com trade.gov tilleke.com

5. 05Critical Information Infrastructure (CII)

   CII operators across national-security-relevant sectors must conduct mandatory cybersecurity assessments, coordinate continuously with cybersecurity task forces, and apply technical security measures. Decree 53/2022 specifies patch and vulnerability management mandates and prompt incident reporting to the Ministry of Public Security for CII operators.

   pwc.com secopsolution.com

6. 06Personal Data Protection Impact Assessments

   Decree 13/2023/ND-CP (effective 1 July 2023) requires data controllers, processors, and controller-processors to prepare a written Personal Data Processing Impact Assessment at the start of processing and submit a copy to A05 within 60 days of commencing data processing activities.

   english.luatvietnam.vn dlapiper.com

Timeline of decisions

1. 1 Jul 2026Law · official
   Law on Cybersecurity No. 116/2025/QH15 enters into force

   Vietnam's consolidated Cybersecurity Law 2025, passed on 10 December 2025 with 434/443 votes in the National Assembly, takes full effect, replacing both the 2015 and 2018 laws. It mandates data localisation for all domestic and foreign platform operators, sets 24-hour (and 6-hour in urgent cases) content-removal windows, and reaffirms the Ministry of Public Security as the principal cybersecurity authority.

   Ministry of Public Security of Vietnam (bocongan.gov.vn)

2. 10 Dec 2025Law · official
   Law on Cybersecurity 2025 (No. 116/2025/QH15) Enacted, Effective 1 July 2026

   The National Assembly passed a consolidated cybersecurity statute replacing both the 2018 Cybersecurity Law and the 2015 Network Information Security Law, unifying Vietnam's cyber-safety framework for the first time. Key additions include a 6-hour emergency takedown window for illegal content, a nationwide ban on AI-generated deepfakes for illegal purposes, mandatory child-safety technical filters on platforms, and the Ministry of Public Security designated as sole national cybersecurity authority.

   LuatVietnam — Official Gazette of Vietnam

3. 1 Jan 2025Incident
   Surge in ransomware and DDoS attacks reported across Vietnamese critical sectors

   Vietnam's National Cyber Security Center recorded approximately 552,000 cyberattacks in 2025; Q1 alone saw nearly 15,000 ransom-DDoS cases, 3.7× higher year-on-year. A securities firm was hit by a 1.2 Tbps DDoS attack costing an estimated VND 200 billion in trading losses, highlighting systemic vulnerabilities in financial infrastructure.

   VietnamPlus (Vietnam News Agency)

4. 1 Jan 2024Incident · official
   14.5 million accounts leaked; ransomware losses reach USD 11 million in 2024

   Viettel's annual cyber-threat report found 14.5 million Vietnamese accounts exposed, 12% of global leaked accounts that year, alongside a 46% rise in new vulnerabilities and a 34% surge in DDoS incidents (924,000 cases). Ransomware encrypted 10 TB of data across organisations, causing USD 11 million in estimated losses.

   Vietnam.vn (official state portal)

5. 1 Oct 2022Law
   Decree 53/2022/ND-CP elaborating the 2018 Cybersecurity Law takes effect

   After more than four years of delay, Decree 53 operationalised the data-localisation and foreign-entity provisions of the 2018 Cybersecurity Law. It requires domestic firms and foreign platform operators to store three categories of Vietnamese user data locally for a minimum of 24 months, and compels foreign providers to establish a local branch or server within 12 months of a written MPS request.

   KPMG Vietnam

6. 1 Aug 2022Decision
   Decree 53/2022/ND-CP: Data-Localisation Details Under 2018 Cybersecurity Law

   Effective 1 October 2022, Decree 53 operationalised the data-localisation mandates of the 2018 Cybersecurity Law, requiring foreign platforms (social networks, e-commerce, cloud, video) with a material Vietnamese user base to store specified personal data domestically for a minimum 24 months and to establish a Vietnamese branch or representative office within 12 months of a ministerial request.

   U.S. International Trade Administration

7. 1 Jan 2022Guidance
   Circular 12/2022/TT-BTTTT tightens information-system security classification standards

   The Ministry of Information and Communications issued Circular 12/2022, updating technical and organisational security requirements for classified information systems (building on Decree 85/2016). Operators of systems at Level 3 and above must conduct independent security assessments and implement enhanced incident-reporting procedures.

   KPMG Vietnam

8. 1 Jan 2019Law · official
   Cybersecurity Law No. 24/2018/QH14 Enters Into Force, Foundational Data Sovereignty Baseline

   Vietnam's Cybersecurity Law (passed 12 June 2018, effective 1 January 2019) required domestic and foreign digital-service providers to store user data locally and, in some cases, to establish a local office. This law established Vietnam's data-sovereignty doctrine, the foundational constraint within which all subsequent AI data, cloud, and model-deployment regulations were built.

   U.S. International Trade Administration

9. 1 Jan 2019Law · official
   Law on Cybersecurity No. 24/2018/QH14 enters into force

   Vietnam's landmark 2018 Cybersecurity Law took effect, establishing a national framework focused on protecting sovereignty in cyberspace, prohibiting content deemed threatening to national security, and requiring internet service providers and platforms to remove offending content within 24 hours of an MPS request. It also introduced the first statutory data-localisation mandate for platforms with large Vietnamese user bases.

   LawNet Vietnam (official legal database)

10. 12 Jun 2018Law
    Cybersecurity Law No. 24/2018/QH14 Enacted

    Vietnam's landmark Cybersecurity Law imposed broad data localisation obligations on domestic and foreign companies providing digital services in Vietnam, requiring local storage of personal data, service-user data, and user-relationship data, alongside mandatory government-access and platform-cooperation provisions; it was widely contested by industry and took four years to receive an implementing decree.

    U.S. International Trade Administration

11. 1 Jul 2016Law · official
    Law on Cyber Information Security No. 86/2015/QH13 enters into force

    Vietnam's first network-security statute, adopted by the National Assembly on 19 November 2015, took effect, establishing rules on personal information protection online, requirements for licensing cybersecurity product and service vendors (10-year licences), and baseline obligations for operators of critical information infrastructure. It served as the primary framework until superseded by the 2018 Cybersecurity Law.

    Ministry of Information and Communications of Vietnam (mic.gov.vn)

Sources

1. 1.thuvienphapluat.vn/van-ban/EN/Cong-nghe-thong-tin/Law-24-2018-QH14-Cybersecurity/388829/
2. 2.english.luatvietnam.vn/lawoncybersecurityno116-2025-qh15dateddecember102025ofthenationalasse
3. 3.allenandgledhill.com/perspectives/articles/32082/vnkh-vietnam-s-new-cybersecurity-law-to-c
4. 4.tilleke.com/insights/vietnam-issues-new-cybersecurity-law/
5. 5.rajahtannasia.com/viewpoints/law-on-cybersecurity-comes-into-operation-on-1-july-2026-e
6. 6.assets.kpmg.com/content/dam/kpmg/vn/pdf/Legal-Update/2022/9/legal-alert-for-decree-53
7. 7.pwc.com/vn/en/publications/2022/220908-pwc-vietnam-legal-newsbrief-decree-53.
8. 8.english.luatvietnam.vn/decree-no-13-2023-nd-cp-dated-april-17-2023-of-the-government-on-pers
9. 9.kpmg.com/vn/en/home/insights/2023/04/legal-alert-on-decree-13.html
10. 10.dlapiperdataprotection.com/?t=breach-notification&c=VN
11. 11.resourcehub.bakermckenzie.com/en/resources/global-data-and-cyber-handbook/asia-pacific/vietnam/topi
12. 12.trade.gov/market-intelligence/vietnam-cybersecurity-data-localization-requireme
13. 13.blogs.duanemorris.com/vietnam/2026/01/08/vietnam-law-on-cybersecurity-2026-what-you-must-kn
14. 14.tilleke.com/insights/decree-53-provides-long-awaited-guidance-on-implementation-o
15. 15.secopsolution.com/blog/vietnams-law-on-cybersecurity-decree-53-2022-patch-and-vulnerabi
16. 16.dlapiper.com/en-us/insights/publications/crossroads-icr-insights/2023/vietnam-decr