Vietnam Cybersecurity Law Takes Effect in 2026

Vietnam has officially brought the Vietnam Cybersecurity Law into force as part of a significant update to its national cybersecurity and data protection framework. Law No. 116/2025/QH15 became effective on July 1, 2026, following its issuance on December 10, 2025. The law establishes a comprehensive legal framework governing cybersecurity, data protection, and information systems operating within Vietnam’s national cyberspace. Moreover, it applies broadly to both domestic and foreign entities engaged in digital operations, data processing, or the commercial provision of network security products and services in the Vietnamese market. Official source. Official PDF. Global Regulatory Updates Service. Entirety Regulatory Updates.

The legislation is particularly relevant for manufacturers, exporters, and operators of data networking equipment, infrastructure equipment, cybersecurity software and hardware, civil cryptography products, and telecommunications devices seeking market access in Vietnam. Importantly, the law does not change immediate physical product compliance elements such as labeling, user manuals, or specific ISO/TCVN technical standard versions. However, it introduces broader compliance obligations that affect market access and operational authorization. Official source. Official PDF.

Scope of the Vietnam Cybersecurity Law

The law establishes a regulatory framework covering cybersecurity, data protection, and information systems used to process, store, and transmit information in cyberspace. In addition, its scope includes entities involved in digital operations and the commercial supply of network security products and services in Vietnam. Consequently, foreign technology suppliers and service providers should evaluate whether their activities fall within the law’s jurisdiction before entering or continuing operations in the Vietnamese market. Official source. Official PDF.

Compliance Mechanisms Introduced by the Law

A central feature of the Vietnam Cybersecurity Law is the introduction of macro-level compliance mechanisms. These include:

• Mandatory state-level cybersecurity appraisals (thẩm định an ninh mạng).
• System security assessments.
• Comprehensive system log-keeping (nhật ký hệ thống).
• Specialized business licensing for entities trading cryptographic or security-centric goods.

Furthermore, cybersecurity products and civil cryptography products are subject to enhanced state oversight. This oversight includes licensing and appraisal requirements before commercial deployment or trading activities can proceed in Vietnam. As a result, organizations may need to update internal compliance procedures, record retention practices, and authorization workflows. Official source. Official PDF.

Emergency Powers Affecting Telecommunications Equipment

Under Article 5, Vietnamese authorities are granted emergency cybersecurity enforcement powers. Specifically, authorities may temporarily suspend or completely halt the manufacturing and deployment of radio transmitter and transceiver equipment when they identify a threat to national security. Therefore, this provision is particularly relevant for telecommunications equipment manufacturers, infrastructure operators, and project managers responsible for deploying radio-based systems in Vietnam. The measure functions as a national security enforcement mechanism rather than a change to spectrum licensing rules. Official source. Official PDF.

Market Access Considerations

Although the law does not introduce new product labels or technical standard versions, it directly affects type approval and market access pathways for regulated product categories. Accordingly, companies involved in networking infrastructure, cybersecurity solutions, civil cryptography, and telecommunications devices should monitor forthcoming government decrees that are expected to define:

• Administrative procedures.
• Technical testing criteria.
• Documentary requirements.
• Approval dependencies for regulated products.

Additionally, compliance teams should prepare for possible procedural changes associated with cybersecurity assessments and licensing activities that may become prerequisites for commercialization in Vietnam. The current law establishes the legal basis, while subsequent implementing decrees are expected to provide the detailed operational requirements. Official source. Official PDF.

For organizations tracking Regulatory Updates and cybersecurity-related News in Vietnam, this law represents a significant framework development that warrants ongoing monitoring as implementing regulations are issued. Entirety’s Global Regulatory Updates Service can support teams that need structured monitoring of upcoming Vietnamese cybersecurity decrees and related compliance developments.

Impact Assessment

• Technical Standards? ❌ No

• Type Approval & Market Access? ❌ No

• Imports, Customs, Trade, or Market Surveillance? ❌ No

• Spectrum Management? ❌ No