Workspaces
Log in Sign up

Vietnam's Cybersecurity Law (No. 116/2025/QH15): Government Issues Landmark Suite of Guiding Decrees to Operationalize National Security Protections

Updated

Sources

Vietnam's Cybersecurity Law (No. 116/2025/QH15): Government Issues Landmark Suite of Guiding Decrees to Operationalize National Security Protections

Vietnam has finalized the operational architecture of its unified cybersecurity regime. Following the entry into force of the landmark Law on Cybersecurity No. 116/2025/QH15 on July 1, 2026, the Vietnamese Government issued a comprehensive suite of seven implementing and guiding decrees on August 19, 2026 (with one taking effect on October 5, 2026). These decrees translate the high-level statutory mandates of the Cybersecurity Law into concrete operational obligations, technical standards, and enforcement mechanisms for businesses, platform operators, and critical information infrastructure.1

The Landmark Suite of Implementing Decrees (Issued August 19, 2026)

This coordinated regulatory release provides the missing pieces of Vietnam's cybersecurity and data protection architecture:

  1. Decree No. 333/2026/ND-CP (Detailed Cybersecurity Regulations): Serves as the primary guiding decree for the Cybersecurity Law, setting forth detailed requirements for data localization, local branch/representative office establishment, and the specific categories of foreign service providers caught under these mandates2.
  2. Decree No. 331/2026/ND-CP (Information System Protection): Mandates specific cybersecurity measures for information systems, classifying them into five distinct levels. Systems classified at higher levels (such as critical infrastructure or systems processing sensitive national data) are subject to continuous, state-monitored cybersecurity protection, periodic audits, and strict access controls.3
  3. Decree No. 330/2026/ND-CP (Administrative Sanctions): Establishes the first dedicated administrative penalty regime for cybersecurity and personal data protection, introducing severe fines (including revenue-based fines of up to 5% for serious cross-border transfer violations and up to 10x proceeds for illegal data trading)4 and operational suspensions of up to 12 months.
  4. Decree No. 327/2026/ND-CP (National Security Threat Prevention): Establishes immediate prevention and response protocols for information and acts that utilize computer or telecommunications networks to infringe upon national security, social order, or national data sovereignty.
  5. Decree No. 329/2026/ND-CP (Cybersecurity Protection Force): Defines the roles, responsibilities, and authority of the specialized cybersecurity protection forces (operating under the Ministry of Public Security and Ministry of National Defense) during audits, system inspections, and emergency interventions.
  6. Decree No. 332/2026/ND-CP (Cybersecurity Products and Services Business): Regulates the licensing, business conditions, and quality standards required for companies providing cybersecurity products, encryption tools, and security services within Vietnam.
  7. Decree No. 328/2026/ND-CP (Fake Information Control - Effective October 5, 2026): Establishes strict administrative procedures, liabilities, and response timelines for the prevention and removal of fake, untruthful, or defamatory information circulating on digital platforms and social networks.

Practical Compliance Context

With these decrees now in effect, multinational companies operating in Vietnam must move beyond high-level policy alignment to demonstrable, audit-ready operational compliance5. The combination of Decree 331 (system classification) and Decree 330 (administrative penalties) means that failure to implement prescribed security measures, maintain system logs, or cooperate with the cybersecurity protection force can result in immediate system suspensions, service blocks, or heavy financial penalties.

Furthermore, these decrees are tightly integrated with the Personal Data Protection Law (PDPL) and Decree No. 356/2025/ND-CP, creating a unified, multi-layered regulatory environment where cybersecurity and data privacy are enforced in parallel.

Verbatim Quotes

"After promulgation and the entry into effect of the Cybersecurity Law and the PDPL, the next important step in Vietnam’s regulatory build-out is the issuance of implementing and sanctioning decrees that will operationalize many of the statutory requirements set forth in these laws." — Nishimura & Asahi, September 3, 2026

"The compliance framework for cybersecurity and personal data protection has become more detailed and more enforceable. The recently issued implementing decrees have clarified operational requirements that are expressed only at a high level in the Cybersecurity Law, while Decree 330 has converted many of those obligations into concrete administrative sanctions." — Nishimura & Asahi, September 3, 2026

  1. An instance of A data protection statute is theater until its implementing decree lands. — Vietnam's Cybersecurity Law became enforceable only when seven decrees specified localization, classification, and sanction mechanics, converting statutory text into audit-ready duties. ↩︎

  2. An instance of National security mandates are displacing consumer privacy as the primary driver of data controls. — Vietnam's implementing decrees enforce localization, local presence, and state-monitored protection under police and defense authorities, redefining data control as a sovereignty matter. ↩︎

  3. An instance of Population-scale data handlers are now regulated as critical infrastructure. — Vietnam's implementing decrees place higher-classified information systems under continuous state-monitored protection and specialized cybersecurity forces, subjecting data operations to critical-infrastructure supervision. ↩︎

  4. An instance of Sovereign data penalties now target global corporate revenue and personal executive liability. — Vietnam's implementing decrees establish harsh administrative sanctions that explicitly leverage revenue-based calculations to punish serious cross-border and trading violations. ↩︎

  5. An instance of Static privacy policies are no protection against active regulatory audits of data minimization. — Vietnam's decree suite converts high-level statutory duties into concrete, enforced operational requirements with system classification, logging, audits, and suspension powers. ↩︎

Part of

This finding is an example of a pattern recurring across your work:

Revision history

  • Update Vietnam's Cybersecurity Law note to capture the issuance of the suite of seven landmark implementing decrees on August 19, 2026 (including Decree 331, 333, etc.), detailing how they translate statutory cybersecurity mandates into concrete operational requirements.
    · by the agent
  • Update Vietnam Cybersecurity Law note to incorporate the newly issued Decrees 331, 332, and 333 on August 19, 2026, detailing system classification, business licensing, and data localization.
    · by the agent
  • Update Vietnam Cybersecurity Law note to incorporate the newly issued Decrees 331, 332, and 333 on August 19, 2026, detailing system classification, business licensing, and data localization.
    · by the agent
  • Update Vietnam Cybersecurity Law note to incorporate the newly issued Decrees 331, 332, and 333 on August 19, 2026, detailing system classification, business licensing, and data localization.
    · by the agent
  • Update Vietnam's cybersecurity law enactment note with the details of the early 2026 draft implementing decree, the new draft Data Law decree, and the policy feedback/criticisms from BSA and GDA.
    · by the agent
  • Update Vietnam's cybersecurity law enactment note with the details of the early 2026 draft implementing decree, the new draft Data Law decree, and the policy feedback/criticisms from BSA and GDA.
    · by the agent
  • Update Vietnam's cybersecurity law enactment note with the details of the early 2026 draft implementing decree, the new draft Data Law decree, and the policy feedback/criticisms from BSA and GDA.
    · by the agent
  • Update Vietnam's cybersecurity law enactment note with the details of the early 2026 draft implementing decree, the new draft Data Law decree, and the policy feedback/criticisms from BSA and GDA.
    · by the agent
  • Update Vietnam's cybersecurity law enactment note with the details of the early 2026 draft implementing decree, the new draft Data Law decree, and the policy feedback/criticisms from BSA and GDA.
    · by the agent
  • Update Vietnam's cybersecurity law enactment note with the details of the early 2026 draft implementing decree, the new draft Data Law decree, and the policy feedback/criticisms from BSA and GDA.
    · by the agent
  • Update Vietnam's cybersecurity law enactment note with the details of the early 2026 draft implementing decree, the new draft Data Law decree, and the policy feedback/criticisms from BSA and GDA.
    · by the agent
  • Update Vietnam's cybersecurity law enactment note with the details of the early 2026 draft implementing decree, the new draft Data Law decree, and the policy feedback/criticisms from BSA and GDA.
    · by the agent
  • Update Vietnam's cybersecurity law enactment note with the details of the early 2026 draft implementing decree, the new draft Data Law decree, and the policy feedback/criticisms from BSA and GDA.
    · by the agent
  • Update Vietnam's cybersecurity law enactment note with the details of the early 2026 draft implementing decree, the new draft Data Law decree, and the policy feedback/criticisms from BSA and GDA.
    · by the agent
  • Update Vietnam's cybersecurity law enactment note with the details of the early 2026 draft implementing decree, the new draft Data Law decree, and the policy feedback/criticisms from BSA and GDA.
    · by the agent
  • Update Vietnam's cybersecurity law enactment note with the details of the early 2026 draft implementing decree, the new draft Data Law decree, and the policy feedback/criticisms from BSA and GDA.
    · by the agent
  • Update Vietnam's cybersecurity law enactment note with the details of the early 2026 draft implementing decree, the new draft Data Law decree, and the policy feedback/criticisms from BSA and GDA.
    · by the agent
  • Update Vietnam's cybersecurity law enactment note with the details of the early 2026 draft implementing decree, the new draft Data Law decree, and the policy feedback/criticisms from BSA and GDA.
    · by the agent
  • Update Vietnam's cybersecurity law enactment note with the details of the early 2026 draft implementing decree, the new draft Data Law decree, and the policy feedback/criticisms from BSA and GDA.
    · by the agent
  • Update Vietnam's cybersecurity law enactment note with the details of the early 2026 draft implementing decree, the new draft Data Law decree, and the policy feedback/criticisms from BSA and GDA.
    · by the agent