Vietnam’s Law on Cybersecurity was passed by the National Assembly of Vietnam on June 12, 2018, and took effect on January 1, 2019. The law sets out specific provisions regarding the responsibilities of organisations and individuals in securing networks and data in Vietnam. Foreign firms looking to do business in Vietnam in the technology sector including video game developers and cross border service providers should make sure they are familiar with these regulations.
Cybersecurity Protection
The law covers the protection of the information systems crucial to national security, preventing and countering cyberattacks, ensuring the safety of cyber infrastructure, and safeguarding national defence and state secrets. Cybersecurity assessments and protective measures are required for critical national information systems.
Data Localization and Branch/Office Requirements
Foreign companies that provide services on the internet or in cyberspace to users in Vietnam (e.g., social media, online gaming, e-commerce) are required to:
- Store data: Personal data of users, data on user relationships, and information generated by users must be stored in Vietnam.
- Establish a branch or representative office: Foreign companies may be required to set up a local office in Vietnam if they provide services that have been used to violate cybersecurity laws, and they fail to cooperate with authorities in addressing these violations.
Decree 53
Of note, in 2022, Decree 53 was issued providing detailed regulations with respect to the Law on Cyber Security. Whereas most of these pertained to government departments, Articles 26 and 27 addressed data localisation for foreign firms. It did so as follows:
Article 26. Data storage, establishment of branches or representative offices in Vietnam
Data that must be stored in Vietnam includes:
- Personal information of service users in Vietnam.
- Data generated by service users in Vietnam, such as service account names, usage times, credit card details, email addresses, recent login/logout IP addresses, and phone numbers linked to accounts.
- Data on relationships of service users in Vietnam, such as friends and groups with which users interact.
Domestic enterprises must store the specified data within Vietnam. Foreign enterprises operating in Vietnam in fields such as telecommunications, data storage, e-commerce, online payment, social networks, online games, and others, must store this data and establish a branch or representative office in Vietnam if their services are used to violate cybersecurity laws. If a violation occurs and the enterprise does not comply with cybersecurity enforcement, the company will be required to store data and open an office in Vietnam.
In case of force majeure, foreign enterprises can notify the Department of Cyber Security, and if verified, will have 30 days to resolve the issue.
If the data collected by an enterprise is incomplete, they must work with the Department of Cyber Security to store what has been collected. If additional data types are gathered, the enterprise must also store them.
The form of data storage is up to the enterprise.
Procedures for requiring data storage and branch establishment involve a decision from the Minister of Public Security. The Department of Cyber Security will monitor and guide compliance. Enterprises have 12 months to complete data storage and establish their branch or representative office.
Establishment procedures will follow relevant business laws, and non-compliance with these provisions will result in penalties depending on the severity of the violation.
Article 27. Data storage period, establishment of branches or representative offices in Vietnam
The data storage period begins when an enterprise receives a request and lasts for a minimum of 24 months. Branch or representative office establishment begins upon receiving a request and continues until the enterprise ceases operations in Vietnam or no longer offers its services in the country. System logs for investigating cybersecurity violations must be stored for at least 12 months.
Personal Data Protection
The law emphasises personal data protection. Organisations and individuals that collect, store, or process data must ensure the confidentiality and security of the data. Consent from individuals is required for the collection of their personal data, and unauthorised disclosure of personal information is strictly prohibited.
Content Control and Information Removal
Service providers are required to remove content that is deemed harmful to national security or public order. This includes content that incites violence, disrupts national unity, promotes anti-state propaganda, or defames individuals or organisations. Authorities can demand that companies block or remove illegal content, and non-compliance can result in penalties or restrictions on the company’s operations in Vietnam.
Cybersecurity Inspections and Audits
Authorities are empowered to carry out inspections, audits, and supervision of information systems. They can examine systems to ensure compliance with the cybersecurity law, especially in cases involving systems that are deemed essential for national security.
Handling Cybersecurity Violations
The law provides for various sanctions and penalties for organisations and individuals that violate cybersecurity regulations. These penalties can include fines, administrative sanctions, or criminal charges for serious violations. Service providers that do not comply with authorities’ requests related to cybersecurity violations or do not adequately protect user data may face fines or restrictions on their operations in Vietnam.
Responsibility of Service Providers
Internet and telecommunications companies, social media platforms, and other service providers must cooperate with the Vietnamese government in protecting cybersecurity. This cooperation includes sharing user information when requested for investigations related to national security and ensuring that services are not used to engage in illegal activities.
Cybersecurity Threats
The law outlines measures for detecting, preventing, and responding to cybersecurity threats. It includes provisions for combating cyberattacks, terrorism, espionage, and other malicious activities aimed at critical national systems or public safety.
Impacts on Businesses and Individuals
- Domestic Enterprises: Vietnamese companies are required to follow stringent regulations on data protection, cybersecurity assessments, and security measures to protect their systems from cyber threats.
- Foreign Enterprises: Foreign service providers must store user data in Vietnam and may need to establish a local presence. They are also required to comply with the Vietnamese government’s requests for user data in certain cases.
- Users: Individuals must be cautious about online activities. Any actions deemed as threats to national security, such as spreading false information, defaming the state, or engaging in anti-government propaganda, can be subject to criminal penalties.
The Law on Cybersecurity reflects Vietnam’s increasing focus on protecting its digital sovereignty and ensuring the safety of its cyber infrastructure in an era of growing digital interconnectivity and cyber threats.
All of that said, foreign firms operating in Vietnam’s digital arena–in the video games, social media, or streaming services, for example–should keep in mind that law, rules, and regulations in Vietnam change frequently. With this in mind, foreign firms doing business in Vietnam can best keep up to date with these changes by subscribing to the-shiv.