Vietnam has taken a major step in strengthening its cybersecurity regulatory architecture.
On 19 August 2026, the Government issued three new decrees that materially expand the obligations applicable to businesses operating in Vietnam:
- Decree 331/2026/ND-CP – cybersecurity protection for information systems;
- Decree 332/2026/ND-CP – conditions for conducting business in cybersecurity products and services; and
- Decree 333/2026/ND-CP – detailed implementation of the Cybersecurity Law.
All three Decrees took effect immediately on 19 August 2026.
For foreign investors and foreign-invested enterprises (“FIEs”), the new framework is highly significant. It introduces clearer system-classification requirements, licensing rules for cybersecurity businesses, expanded operational obligations, and detailed data-localization requirements.
The overall message is clear: cybersecurity compliance in Vietnam is becoming a core market-access and operational issue, not merely an IT concern.
- A Five-Level Cybersecurity Classification System
Decree 331 establishes a five-level classification framework for information systems in Vietnam.
The regime applies directly to organizations that build, manage, operate or upgrade information systems serving state-agency IT infrastructure and online public services. Other organizations are encouraged to apply the same standards voluntarily, and the framework may also become relevant where government customers impose equivalent contractual obligations on private-sector service providers.
The classification framework ranges from Level 1, covering lower-risk internal systems processing only public information, through to Level 5, covering strategic defense and national-security systems, centralized national data storage, international-connection infrastructure and particularly sensitive industrial-control systems.
The higher the classification level, the more stringent the obligations become.
At a minimum, organizations must maintain:
- cybersecurity policies and procedures;
- appropriately qualified personnel;
- secure system design;
- operational security controls;
- risk-management systems;
- monitoring capabilities;
- backup arrangements; and
- incident-response mechanisms.
For Level 3 and Level 4 systems, cloud and data-center environments must be logically segregated.
For Level 5 systems, physical segregation of systems, storage and principal network equipment is required, together with mandatory independent licensed assessment.
The incident-reporting obligations are also significant. Serious incidents must generally be reported within 24 hours, followed by a full report within 72 hours, while incidents affecting national security require immediate notification.
For FIEs operating cloud, data-center, managed-service or infrastructure businesses, these requirements may become especially important when providing services to government bodies or other critical-sector customers.
- Cybersecurity Products and Services Become a Licensed Business Sector
Decree 332 introduces a formal licensing regime for entities conducting business in cybersecurity products and services in Vietnam, excluding civil cryptography.
A cybersecurity business license issued by the Ministry of Public Security (“MPS”) is required and is valid for 10 years.
General licensing conditions include:
- establishment under Vietnamese law;
- good standing;
- an eligible legal representative or authorized manager;
- qualified technical personnel;
- appropriate equipment, facilities and technology; and
- compliance with specific professional requirements.
For foreign-invested economic organizations, one particularly important condition is that the remaining term of the Vietnam investment project must exceed five years at the time of license issuance.
Additional conditions apply to particular cybersecurity activities.
Cybersecurity assessment and consultancy
Providers must have at least five qualified technical personnel residing in Vietnam, and the legal representative must be a Vietnamese national.
Cybersecurity monitoring services
Providers must have at least 12 qualified technical personnel, and again the legal representative must be a Vietnamese national.
Manufacturing, trading, importing and exporting cybersecurity products
Businesses must maintain suitable business and technical plans, satisfy relevant technical standards, implement quality-control measures and maintain documentation concerning the end use of the relevant products.
Import and export activities are subject to an additional shipment-specific MPS license, valid for two years.
Applications must be submitted in Vietnamese, with a statutory review period of 28 working days after submission of a complete dossier.
Licensed entities must also submit annual compliance reports to MPS by 31 January each year.
For international cybersecurity companies considering market entry into Vietnam, these requirements should now form part of the initial investment-structuring analysis.
- Data Localization: A Critical Distinction Between FIEs and Offshore Providers
Decree 333 provides greater detail on the data-localization and local-presence requirements under Vietnam’s Cybersecurity Law.
The rules differ materially depending on whether the enterprise is incorporated in Vietnam or operates offshore.
Vietnam-incorporated enterprises, including FIEs
Vietnam-incorporated companies are subject to an automatic local-storage obligation for specified categories of data relating to users in Vietnam.
These include:
- personal information of users in Vietnam; and
- user-generated data such as account names, service-use times, credit-card information, email addresses, recent login/logout IP addresses and telephone numbers associated with user accounts or data.
For Vietnam-incorporated FIEs, the question is therefore no longer whether localization may be imposed in the future, but whether the company’s current data architecture already complies.
This may require businesses to review cloud architecture, server locations, vendor arrangements, intra-group data flows and outsourcing agreements.
Offshore foreign enterprises
For offshore service providers, the obligation is conditional rather than automatic.
The relevant sectors include, among others:
- telecommunications;
- cloud and data-storage services;
- domain-name services;
- e-commerce;
- online payments;
- transport platforms;
- social media;
- online games;
- messaging;
- VoIP;
- email; and
- other online information services.
An offshore provider becomes subject to localization and local-presence requirements only where three cumulative conditions are satisfied:
- the service has been used in connection with cybersecurity-law violations;
- the specialized MPS cybersecurity force has issued written cooperation, prevention or investigation requests three times within a period of up to six months; and
- the enterprise fails to remedy the issue, fails to comply fully, or obstructs or neutralizes the required protective measures.
If those conditions are triggered, the Minister of Public Security may issue a formal decision requiring the enterprise to store data in Vietnam and establish a branch or representative office.
The enterprise then has 12 months to comply.
The minimum data-retention period is generally 24 months from the date of the storage request, or for as long as the request remains in force.
System logs required for investigation purposes must be retained for at least 12 months, while telecom and internet IP-allocation logs must also be retained for at least 12 months in a complete, continuous and secure manner.
- What Foreign Investors and FIEs Should Do Now
The new framework should prompt an immediate cybersecurity compliance review.
Foreign investors and FIEs should in particular consider the following actions.
Assess system-classification exposure
Determine whether any systems built, managed or operated by the business fall within the mandatory scope of Decree 331 or may become subject to equivalent requirements through contracts with government customers or critical-sector operators.
Review cybersecurity licensing requirements
Businesses involved in cybersecurity products or services should determine immediately whether an MPS license is required and whether current corporate, personnel and investment-term arrangements satisfy the licensing conditions.
Review governance and staffing
Companies providing cybersecurity assessment, consultancy or monitoring services should confirm compliance with the Vietnamese-national legal-representative requirement and the applicable minimum staffing thresholds.
Audit data-storage architecture
Vietnam-incorporated FIEs should confirm that the required categories of Vietnamese user data are stored in Vietnam.
Offshore digital-service providers should establish internal procedures to identify and respond promptly to MPS requests that could eventually trigger localization obligations.
Implement reporting procedures
Licensed cybersecurity businesses should establish internal compliance calendars to ensure timely annual reporting to MPS by 31 January.
Conduct a legal and technical gap analysis
Because the three Decrees became effective immediately, businesses should conduct a coordinated legal, technical and operational review rather than treat the matter as a purely IT exercise.
- Why This Matters for Investment Strategy
Vietnam is one of Southeast Asia’s fastest-growing digital economies.
The expansion of cloud computing, fintech, e-commerce, digital infrastructure, AI, data centers, smart manufacturing and online services makes cybersecurity regulation increasingly central to investment strategy.
The new Decrees therefore have implications far beyond the cybersecurity sector itself.
They affect:
- market-entry structuring;
- investment licensing;
- cloud architecture;
- data governance;
- outsourcing;
- M&A due diligence;
- technology contracts;
- regulated-sector operations;
- internal compliance systems; and
- long-term business continuity.
For international investors, cybersecurity compliance must increasingly be treated in the same way as tax, licensing, competition, employment and foreign-investment regulation: as a fundamental component of Vietnam market access.
Conclusion – Cybersecurity Is Becoming Part of the Investment License to Operate
The issuance of Decrees 331, 332 and 333 marks a significant evolution in Vietnam’s cybersecurity regime.
The direction of travel is unmistakable.
Vietnam is moving toward a more structured, enforceable and institutionally supervised cybersecurity framework, with clearer obligations concerning system protection, cybersecurity business licensing, data localization, staffing, reporting and incident response.
For foreign investors and FIEs, the practical consequence is equally clear:
cybersecurity can no longer be addressed only after a business has entered Vietnam. It must increasingly be considered at the investment-structuring stage itself.
Companies that act early will be better positioned to align their data architecture, licensing structure, personnel, contracts and operational systems before issues arise.
Those that do not may face licensing delays, restructuring costs, regulatory scrutiny or operational disruption.
Vietnam remains one of Asia’s most compelling investment destinations. But as its economy becomes more digital, sophisticated and interconnected, the regulatory expectations imposed on investors are also becoming more sophisticated.
The competitive advantage will therefore increasingly belong to investors who understand that cybersecurity compliance is not an obstacle to doing business in Vietnam — it is becoming part of the legal infrastructure required to do business successfully.
Please do not hesitate to contact Dr. Oliver Massmann at [email protected] if you have any questions or would like further information regarding the new cybersecurity framework.