Key Changes Businesses Need to Know: Vietnam’s Draft Cybersecurity Law 2025
Vietnam is on the brink of a major transformation in its cyber governance landscape. As the Ministry of Public Security unveils the draft Cybersecurity Law 2025 for public consultation, businesses must stay alert and informed. This significant legal shift aims to replace the existing Cybersecurity Law 2018 and the Law on Network Information Security 2015. Finalized legislation is expected by 1 January 2026, coinciding with the upcoming Data Law and the Personal Data Protection Law.
Broader Scope of Application
One of the most impactful changes in the draft is the broadened definition of “service providers.” Previously limited mainly to tech giants, the new law widens its reach dramatically, affecting various industries:
- Traditional Tech Firms: This includes internet service providers (ISPs), telecommunications, hosting services, and cloud computing.
- Social Platforms and Online Gaming: As more people engage in digital interactions, social networks and online gaming platforms are brought under regulation.
- Financial Institutions: Banks, e-wallets, and payment intermediaries will also be scrutinized.
- E-commerce and Stock Exchanges: Platforms dealing in trades or digital assets must now comply with tighter rules.
- Logistics and Media: Even logistics providers and digital television operators will feel the ripple effects.
This expanded jurisdiction means many businesses that previously didn’t require compliance may now face stringent obligations.
Data Storage and Local Presence Changes
The draft brings monumental shifts in data storage and local presence requirements for foreign businesses.
-
Current Law (2018): Under the existing law, companies collecting data from Vietnamese users must store that data in Vietnam and maintain a domestic office.
-
Draft 2025 Law: The new proposal dispenses with the strict local office requirement. Companies still need to comply with the forthcoming Personal Data Protection Law if they handle personal data from Vietnamese citizens. This change may ease operational burdens but demands vigilance regarding data compliance.
New Obligations Against Cybercrime
Chapter III of the draft brings a new set of responsibilities for service providers to combat high-tech cybercrime. Key points include:
-
User Identification: Firms are now responsible for verifying the identities of their users, eliminating the potential for fake accounts— a major loophole for cybercriminals.
-
Reporting: Cyberattacks must be reported to authorities within a tight 24-hour window, compelling businesses to develop rapid-response plans.
-
Compliance Obligations: Authorities gain increased powers, with the ability to suspend accounts, freeze transactions, or even seize electronic devices involved in violations.
In addition to business obligations, users are also urged to maintain the confidentiality of their digital information, with penalties for lapses leading to illegal activities under their accounts.
Legal Definition of Digital Assets
For the first time, the draft defines “digital assets” explicitly. This includes products linked with blockchain technology that possess value and legal rights under civil law. This definition is crucial for sectors like cryptocurrencies, NFTs, and blockchain, setting a foundation for future regulations.
Tightened Controls on Cybersecurity Products and Services
The draft introduces new chapters aimed at tightening controls on cybersecurity measures:
-
Certification Requirements: Organizations will need to certify compliance with national cybersecurity standards for their products and services before they can be traded.
-
Licensing: As the scrutiny intensifies, companies offering cybersecurity products and services must adhere to newly established licensing requirements.
Proactive Steps for Businesses
With the draft undergoing public consultation until 16 July 2025, businesses are encouraged to take proactive measures:
-
Review Your Business Scope: Assess whether your organization qualifies as a “service provider” as defined in the draft law. Understanding your position is crucial for anticipating compliance requirements.
-
Data Policy Assessment: Critically examine your company’s data handling practices concerning Vietnamese citizens. Ensuring alignment with emerging data protection laws is a must.
-
Updated Compliance Processes: Develop internal protocols for user identity verification and incident reporting. Pay special attention to cooperation guidelines with authorities.
-
Legal Monitoring: With the draft still in flux, stay alert to any legislative updates. Maintaining awareness of the latest changes will help avoid potential compliance pitfalls.
Vietnam’s Draft Cybersecurity Law 2025 represents a seismic shift towards comprehensive governance in cyberspace. The upcoming law not only broadens the definition of regulated entities but also emphasizes data protection and cybercrime prevention. By taking early action, businesses can mitigate legal risks and secure their operations in this rapidly evolving landscape.