Vietnam's New Cybersecurity Law (No. 116/2025/QH15) Takes Effect: Unified Governance, Strict Timelines, and Retained Data Localization

On July 1, 2026, Vietnam’s brand-new Law on Cybersecurity No. 116/2025/QH15 (passed by the National Assembly on December 10, 2025) officially came into operation. This landmark legislation consolidates the country's fragmented cybersecurity framework under a single unified statutory regime, establishing strict incident response timelines and introducing a new three-tier classification of information systems.

Crucially for multinational technology firms, the law retains the highly controversial data localization and local presence mandates first introduced under Decree 53/2022/ND-CP.

In early 2026, the Ministry of Public Security (MPS) finalized a draft general implementing decree designed to guide the implementation of Law No. 116/2025/QH15 and formally replace Decree 53. The draft decree, which went through a public consultation period ending in late February 2026, has drawn sharp criticism and intensive lobbying from global tech and trade coalitions, including the Business Software Alliance (BSA) and the Global Data Alliance (GDA).

1. Retention of Strict Data Localization Mandates

Despite hopes that the new unified law might ease data localization, the 2026 draft implementing decree explicitly reaffirms the obligation for foreign digital platforms and service providers to store specified categories of user data locally¹ in Vietnam and establish a physical branch or representative office.

The Triggers: The localization requirement is triggered if a foreign company provides telecommunications, internet, cloud, or digital services in Vietnam, and is formally notified by the MPS of a cybersecurity violation (such as hosting prohibited content) that it fails to remedy within a specified timeframe.
Data Types Covered: Regulated data includes personal information of Vietnamese users, user-generated data (such as posts, uploads, and contact lists), and relationship data (such as transaction records and IP addresses).

2. Overlapping Compliance with the New "Data Law" Draft Decree

Compounding the compliance burden, the Vietnamese Government is simultaneously drafting an implementing decree for its brand-new Data Law (which also has a phased rollout starting in 2025/2026). Under the draft Data Law decree, any organization transferring "core data" (national security, public safety, and strategic infrastructure) or "important data" (critical economic, social, and public health datasets) outside Vietnam must:

Conduct a formal risk assessment before any cross-border transfer.
Submit an impact assessment dossier to the relevant government agency.
Establish strict data protection agreements with offshore receivers.

This dual-layered regulatory push means multinational SaaS vendors and cloud providers must navigate both the MPS cybersecurity localization triggers and the Data Law's strict cross-border transfer barriers for important datasets.

3. Industry Backlash Against Timelines and Data Sovereignty

Global business groups have raised significant concerns regarding the operational feasibility of the draft cybersecurity decree. In formal submissions to the Vietnamese Government in March 2026:

BSA (Business Software Alliance) recommended extending the "overly short incident reporting timelines" and urged the government to remove the broad local data storage and local presence requirements, warning they would stifle digital innovation and cloud adoption.
Global Data Alliance (GDA) submitted recommendations highlighting that the proposed localization mandates would restrict cross-border data flows, disrupt global supply chains, and increase operational costs for businesses in Vietnam without demonstrably improving cybersecurity.

Verbatim Quotes

BSA formal comment letter:

"BSA recommends extending overly short incident reporting timelines, removing requirements to store data in Vietnam, and extending the consultation period with stakeholders." "Vietnam's ongoing review of the draft decree detailing a number of articles in the Cybersecurity Law dated 24 February 2026 (Draft Decree)..."
Indochine Counsel analysis:

"Vietnam has historically emphasized data localization, particularly in the 2018 Cybersecurity Law and Decree No. 13/2023/ND-CP on Personal Data Protection (Decree 13). The Draft Decree continues this trend by mandating that businesses transferring core or important data outside Vietnam must: Conduct a risk assessment before cross-border transfer; Submit an impact assessment dossier to the relevant government agency..."

An instance of National data localization mandates systematically hollow out international digital trade agreements. — Vietnam's insistence on domestic storage blocks standard cloud-transfer options, overriding the spirit of modern digital trade agreements. ↩︎

Part of

This finding is an example of a pattern recurring across your work:

Centralized regional data hubs cannot survive APAC's escalating revenue-based privacy penalties.

Vietnam's strict local storage and presence rules show that sovereign states are actively dismantling centralized offshore hosting models.

Cross-border data flows require proactive state logging and approval immediately upon execution.

Vietnam's regulations enforce proactive regulatory registration, requiring organizations to submit comprehensive risk and impact dossiers before executing cross-border transfers.

National security mandates are displacing consumer privacy as the primary driver of data controls.

Vietnam's cybersecurity decrees enforce strict localized presence and data storage mandates to protect national sovereignty over critical information assets.

Revision history