What are the Vietnam Cybersecurity Law 2025 compliance deadlines?

Jul 1, 2026: Cybersecurity Law 2025 takes effect. Jul 1, 2027: Transition ends for existing systems and products.

When does Vietnam Cybersecurity Law 2025 take effect?

Vietnam Cybersecurity Law 2025 took effect on Jul 1, 2026. The next milestone is Jul 1, 2027: Transition ends for existing systems and products.

Who does Vietnam Cybersecurity Law 2025 apply to?

Vietnamese agencies, organisations and individuals, and foreign organisations and individuals in Vietnam or directly involved in cybersecurity protection or cybersecurity products and services in Vietnam.

What are the penalties under Vietnam Cybersecurity Law 2025?

Handled under administrative sanctions decrees and the Criminal Code. The Law itself does not set fine amounts.

Vietnam Cybersecurity Law 2025

In force Vietnam · In force Jul 1, 2026 · next deadline Jul 1, 2027 (in 8 months)

Official text

Add to calendar

Apple Calendar or Outlook Google Calendar Download .ics

Deadlines

Coming up

Transition endsJul 1, 2027 · in 8 months · Source

Transition ends for existing systems and productsInformation systems classified under the 2015 law, and security products already in use, must meet the new law's conditions within 12 months of its effective date.

Already passed

Takes effectJul 1 · 4 months ago · Source

Cybersecurity Law 2025 takes effectThe new law takes effect. Law 86/2015/QH13 and Law 24/2018/QH14 cease to have effect.

Summaries for reference, not legal advice. Check the official text.

What it does

A single cybersecurity law that replaces both the Law on Network Information Security (2015) and the Cybersecurity Law (2018) from 1 July 2026. It covers cybersecurity protection, the security of information systems by classification level, cybersecurity products and services, and the duties of domestic and foreign organisations. Systems and products approved under the old laws have 12 months to meet the new requirements.

Who it applies to: Vietnamese agencies, organisations and individuals, and foreign organisations and individuals in Vietnam or directly involved in cybersecurity protection or cybersecurity products and services in Vietnam.
Penalties: Handled under administrative sanctions decrees and the Criminal Code. The Law itself does not set fine amounts.
Enforced by: Ministry of Public Security
Official name: Cybersecurity Law 2025 (Law No. 116/2025/QH15)
Citation: Law No. 116/2025/QH15
Topics: Cybersecurity, Data residency, Online safety

Verified 2026-09-25 datafiles.chinhphu.vn

Research notes

Passed at the 10th session of the 15th National Assembly. The official PDF is a scanned image, and dates were read by OCR of Articles 44 and 45. Licences issued under the 2015 law stay valid until they expire. Ministry of Public Security as enforcer is from established knowledge, not confirmed in the fetched text.

In forceAustralia

Australia Cyber Security Act (ransomware reporting)Australia's first standalone cyber law: mandatory reporting of ransomware or cyber-extortion payments within 72 hours, security standards for consumer smart devices, 'limited use' protections for information shared with ASD and the National Cyber Security Coordinator, and a Cyber Incident Review Board. Ransomware payment reporting has applied since 30 May 2025.In effect since Nov 30, 2024

AmendedAustralia

Australia Online Safety ActSets up the eSafety Commissioner and removal schemes for cyber-bullying of children, adult cyber-abuse, non-consensual intimate images and abhorrent violent material. It also sets Basic Online Safety Expectations with reporting duties, and binding industry codes and standards. The Unlawful Material codes and standards cover class 1A and 1B material such as child sexual exploitation and pro-terror content. The Age-Restricted Material codes cover class 1C and class 2 material such as online pornography, and require age assurance and other measures to protect children.In effect since Jan 23, 2022

AmendedAustralia

Australia SOCI ActAustralia's critical infrastructure security law. Owners and operators of critical infrastructure assets must register ownership and operational information, and many must report cyber security incidents to the Australian Signals Directorate. Responsible entities for many asset classes must also keep a critical infrastructure risk management program. Systems of national significance face enhanced cyber security obligations, and the government has step-in and assistance powers.In effect since Jul 11, 2018

In forceAustralia

Australia Social Media Minimum AgeRequires providers of age-restricted social media platforms to take reasonable steps to stop Australians under 16 from having accounts. Platforms may not rely only on government ID for age assurance, and must protect data collected for age checks and destroy it after use. eSafety has named platforms including Facebook, Instagram, Snapchat, TikTok, X, YouTube, Reddit, Threads, Twitch and Kick.In effect since Dec 10, 2025

In forceChina

China AI Content Labeling MeasuresRequires generative AI service providers to add explicit (visible) labels to AI-generated text, images, audio, video and virtual scenes, and implicit labels (metadata) to generated files. Content distribution platforms must detect and label AI-generated content, and app stores must check labeling functions when apps are listed. A mandatory national standard (GB 45438-2025) takes effect on the same date.In effect since Sep 1, 2025

In forceChina

China Algorithmic Recommendation ProvisionsRegulates recommendation, ranking, personalization, generation and dispatch algorithms used in internet services in China. Users must be able to switch off personalized recommendations and manage tags, and providers may not use algorithms for price discrimination or to induce addiction. Providers with public opinion attributes or social mobilization capacity must file their algorithms with the CAC within 10 working days of launching a service.In effect since Mar 1, 2022

In forceChina

China Anthropomorphic AI MeasuresRegulates AI companion and emotional interaction services that simulate human personality. Providers must tell users they are talking to AI, remind users after every 2 hours of use, intervene in crises such as self-harm, offer easy exit, and may not offer virtual partner or relative services to minors. Users' interaction data may not be shared or used for training on sensitive data without consent, and services with 1 million registered or 100,000 monthly active users need a security assessment filed with the provincial CAC.In effect since Jul 15, 2026

In forceChina

China Cross-Border Data Flow ProvisionsRelaxes China's data export regime by exempting common transfers (contracts with the individual, cross-border HR, emergencies, and non-CII transfers of PI of fewer than 100,000 people a year) and setting volume thresholds for when a CAC security assessment, standard contract or certification is needed. Data is not 'important data' unless regulators have notified or published it as such.In effect since Mar 22, 2024

Questions about Vietnam Cybersecurity Law 2025

What are the Vietnam Cybersecurity Law 2025 compliance deadlines?: Jul 1, 2026: Cybersecurity Law 2025 takes effect. Jul 1, 2027: Transition ends for existing systems and products.
When does Vietnam Cybersecurity Law 2025 take effect?: Vietnam Cybersecurity Law 2025 took effect on Jul 1, 2026. The next milestone is Jul 1, 2027: Transition ends for existing systems and products.
Who does Vietnam Cybersecurity Law 2025 apply to?: Vietnamese agencies, organisations and individuals, and foreign organisations and individuals in Vietnam or directly involved in cybersecurity protection or cybersecurity products and services in Vietnam.
What are the penalties under Vietnam Cybersecurity Law 2025?: Handled under administrative sanctions decrees and the Criminal Code. The Law itself does not set fine amounts.

Deadlines

What it does

Related