{"id":1588,"date":"2026-07-01T09:49:31","date_gmt":"2026-07-01T09:49:31","guid":{"rendered":"https:\/\/lawpage.vn\/?p=1588"},"modified":"2026-08-01T10:09:03","modified_gmt":"2026-08-01T10:09:03","slug":"this-cybersecurity-law-will-come-into-effect-on-july-1-2026","status":"publish","type":"post","link":"https:\/\/lawpage.vn\/en\/this-cybersecurity-law-will-come-into-effect-on-july-1-2026\/","title":{"rendered":"This cybersecurity law will come into effect on July 1, 2026."},"content":{"rendered":"<p style=\"text-align: justify\"><span style=\"color: #000080\"><strong>SUMMARY OF THE CYBERSECURITY LAW 2025 BY CHAPTER<\/strong><\/span><\/p>\n<p style=\"text-align: justify\"><strong>Chapter I \u2013 General Provisions<\/strong><\/p>\n<ul style=\"list-style-type: disc;text-align: justify\">\n<li>Defines the scope of regulation and subjects of application.<\/li>\n<li>Explains key concepts: cybersecurity, data security, cyberattacks, cyberterrorism, cyberespionage, cybersecurity threats, etc.<\/li>\n<li>Outlines the State\u2019s policies on cybersecurity: prioritizing resources, developing human capital, international cooperation.<\/li>\n<li>Provides principles for cybersecurity protection: compliance with the Constitution, combining cybersecurity with socio-economic development, protecting personal data.<\/li>\n<li>Lists cybersecurity protection measures (assessment, inspection, monitoring, incident response\u2026).<\/li>\n<li>Specifies prohibited acts: anti\u2011State propaganda, historical distortion, fraud, cyberattacks, illegal intrusion, malware distribution\u2026<\/li>\n<\/ul>\n<p style=\"text-align: justify\"><em><strong>Article 2. Interpretation of Terms\u00a0<\/strong><\/em><\/p>\n<p style=\"text-align: justify\"><em>In this Law, the terms below are defined as follows:<\/em><\/p>\n<ol style=\"text-align: justify\" role=\"list\" start=\"1\">\n<li><em><strong>Cybersecurity<\/strong> refers to the stability, security, and safety of cyberspace; the protection of information systems and the assurance that information, data, and activities in cyberspace do not harm national security, social order and safety, or the lawful rights and interests of agencies, organizations, and individuals.<\/em><\/li>\n<li><em><strong>Network information security<\/strong> refers to ensuring the integrity, confidentiality, and availability of information in cyberspace, preventing unauthorized access, use, disclosure, modification, destruction, or other acts that threaten or harm national security, social order, and safety.<\/em><\/li>\n<li><em><strong>Data security<\/strong> refers to ensuring the quality of data and data processing activities in cyberspace serving socio\u2011economic development and national digital transformation, preventing unauthorized access, use, disclosure, modification, destruction, or other acts that threaten or harm national security, social order, and safety.<\/em><\/li>\n<li><em><strong>Cybersecurity protection<\/strong> refers to preventing, detecting, stopping, and handling acts that violate cybersecurity.<\/em><\/li>\n<li><em><strong>Cyberspace<\/strong> is the environment formed by interconnected networks of information technology infrastructure, including telecommunications networks, the Internet, computer networks, information systems, information processing and control systems, and databases; it is where people conduct social activities without being limited by space or time.<\/em><\/li>\n<li><em><strong>National cyberspace<\/strong> is the portion of cyberspace under the sovereignty, jurisdiction, and control of the Socialist Republic of Vietnam.<\/em><\/li>\n<li><em><strong>Information system<\/strong> is a set of hardware, software, and data established for the purpose of creating, providing, transmitting, collecting, processing, storing, and exchanging information in cyberspace.<\/em><\/li>\n<li><em><strong>Information system administrator<\/strong> refers to an agency, organization, or individual with direct authority to manage an information system.<\/em><\/li>\n<li><em><strong>Malicious software (malware)<\/strong> refers to software capable of causing abnormal operations in part or all of an information system, or performing unauthorized copying, modification, or deletion of information stored in the system.<\/em><\/li>\n<li><em><strong>Malicious hardware<\/strong> refers to physical components intentionally designed or additionally attached outside standard hardware structures to illegally collect information or data, or to interfere with, disrupt, paralyze, or destroy computer systems or information systems.<\/em><\/li>\n<li><em><strong>System logs<\/strong> are collections of records reflecting the time, user, activities, and status of a system, serving system management, monitoring, and security.<\/em><\/li>\n<li><em><strong>Cybercrime<\/strong> refers to socially dangerous acts defined in the Criminal Code, committed by individuals or organizations in cyberspace using information technology or electronic means.<\/em><\/li>\n<li><em><strong>Cyberattack<\/strong> refers to acts carried out in cyberspace using information technology or electronic means to appropriate information, disrupt, interrupt, paralyze operations, destroy, or take control of telecommunications networks, the Internet, computer networks, information systems, information processing and control systems, databases, or electronic devices.<\/em><\/li>\n<li><em><strong>Cyberterrorism<\/strong> refers to acts carried out in cyberspace using information technology or electronic means with the intent to cause public fear or destabilize political security.<\/em><\/li>\n<li><em><strong>Cyberespionage<\/strong> refers to acts carried out in cyberspace using information technology or electronic means to secretly infiltrate and appropriate, collect, or copy information classified as state secrets or important data of agencies, organizations, or individuals, with the intent to harm national security, social order, and safety.<\/em><\/li>\n<li><em><strong>Cybersecurity threat<\/strong> refers to a state of cyberspace in which signs appear indicating potential violations of national security, causing serious harm to social order and safety, or to the lawful rights and interests of agencies, organizations, and individuals.<\/em><\/li>\n<li><em><strong>Cybersecurity incident<\/strong> refers to unexpected events occurring in cyberspace that violate national security, social order and safety, or the lawful rights and interests of agencies, organizations, and individuals.<\/em><\/li>\n<li><em><strong>Dangerous cybersecurity situation<\/strong> refers to a state or development in cyberspace involving elements of attack, intrusion, provocation, information leakage, information loss, or other acts that seriously threaten national security, social order and safety, or the lawful rights and interests of agencies, organizations, and individuals.<\/em><\/li>\n<li><em><strong>Digital account<\/strong> refers to information used for authentication, verification, and authorization when using applications and services in cyberspace.<\/em><\/li>\n<li><em><strong>Civil cryptography<\/strong> refers to cryptographic techniques and cryptographic products used to secure or authenticate information not classified as state secrets, ensuring information security for agencies, organizations, and individuals.<\/em><\/li>\n<li><em><strong>Cybersecurity products<\/strong> refer to hardware and software designed to protect cybersecurity, network information security, data security, information, data, information systems, and information technology infrastructure.<\/em><\/li>\n<li><em><strong>Cybersecurity services<\/strong> refer to services provided to protect cybersecurity, network information security, data security, information, data, information systems, and information technology infrastructure.<\/em><\/li>\n<li><em><strong>Core information systems<\/strong> refer to information systems that use core cryptography to protect information classified as state secrets, serving specialized cipher operations and directly managed and operated by cipher organizations.<\/em><\/li>\n<\/ol>\n<div style=\"text-align: justify\"><strong><em>Article 7. Prohibited Acts Related to Cybersecurity\u00a0<\/em><\/strong><\/div>\n<div style=\"text-align: justify\"><em>1. Posting or disseminating the following types of information in cyberspace:<\/em><\/div>\n<div style=\"padding-left: 40px;text-align: justify\"><em>a) Propaganda against the Socialist Republic of Vietnam, including: distorting or defaming the people&#8217;s government; psychological warfare; inciting aggressive war; creating division or hatred among ethnic groups, religions, or peoples of other countries; insulting the nation, national flag, national emblem, national anthem, great figures, leaders, national heroes.<\/em><\/div>\n<div style=\"padding-left: 40px;text-align: justify\"><\/div>\n<div style=\"padding-left: 40px;text-align: justify\"><em>b) Distorting history, denying revolutionary achievements, undermining national unity, insulting religions, gender discrimination, racial discrimination.<\/em><\/div>\n<div style=\"padding-left: 40px;text-align: justify\"><\/div>\n<div style=\"padding-left: 40px;text-align: justify\"><em>c) Fabricating, slandering, or spreading false information that infringes upon the dignity, honor, or reputation of others, or causes harm to the lawful rights and interests of agencies, organizations, or individuals.<\/em><\/div>\n<div style=\"padding-left: 40px;text-align: justify\"><\/div>\n<div style=\"padding-left: 40px;text-align: justify\">\n<p><em>d) Disseminating false information that causes public panic, damages socio\u2011economic activities, obstructs normal operations of state agencies or public officials, or infringes upon lawful rights and interests of agencies, organizations, or individuals; fabricating false information about products, goods, currency, bonds, bills, treasury notes, checks, and other valuable papers; spreading false information in finance, banking, e\u2011commerce, multi\u2011level marketing, or securities.<\/em><\/p>\n<p>&nbsp;<\/p>\n<\/div>\n<div style=\"text-align: justify\"><\/div>\n<div style=\"text-align: justify\"><em>2. Committing the following acts in cyberspace:<\/em><\/div>\n<div style=\"padding-left: 40px;text-align: justify\"><em>a) Organizing, operating, colluding, inciting, bribing, deceiving, luring, training, or instructing others to act against the Socialist Republic of Vietnam.<\/em><\/div>\n<div style=\"padding-left: 40px;text-align: justify\"><\/div>\n<div style=\"padding-left: 40px;text-align: justify\"><em>b) Inciting, calling for, mobilizing, threatening, or dividing people to conduct armed activities or use violence against the people&#8217;s government; calling for or inciting gatherings that cause disorder, resist law enforcement, or obstruct operations of agencies or organizations, thereby destabilizing security and order.<\/em><\/div>\n<div style=\"padding-left: 40px;text-align: justify\"><\/div>\n<div style=\"padding-left: 40px;text-align: justify\"><em>c) Appropriating, trading, storing, or intentionally disclosing state secrets, work secrets, business secrets; appropriating, trading, storing, or intentionally disclosing personal secrets, family secrets, or private life information that affects the dignity, honor, or lawful rights of agencies, organizations, or individuals; intentionally eavesdropping, recording, or filming conversations in cyberspace without permission; disclosing information about civil cryptographic products or customers using such products; using or trading civil cryptographic products of unclear origin.<\/em><\/div>\n<div style=\"padding-left: 40px;text-align: justify\"><\/div>\n<div style=\"padding-left: 40px;text-align: justify\"><em>d) Engaging in prostitution, social evils, human trafficking, trafficking of human organs; disseminating obscene or depraved materials; inciting or promoting violence, immoral lifestyles, deviant behaviors, or acts that undermine cultural values, social ethics, or community health.<\/em><\/div>\n<div style=\"padding-left: 40px;text-align: justify\"><\/div>\n<div style=\"padding-left: 40px;text-align: justify\"><em>e) Committing fraud to appropriate assets; organizing gambling or online gambling; stealing international telecommunications charges via the Internet; promoting, advertising, or trading prohibited goods or services; violating copyright or intellectual property rights in cyberspace.<\/em><\/div>\n<div style=\"padding-left: 40px;text-align: justify\"><\/div>\n<div style=\"padding-left: 40px;text-align: justify\"><em>f) Impersonating websites of agencies, organizations, or individuals; forging, circulating, stealing, trading, collecting, or illegally exchanging credit card information, bank accounts, encrypted assets, or digital assets of others; issuing, providing, or using illegal payment instruments; forging documents of agencies or organizations.<\/em><\/div>\n<div style=\"padding-left: 40px;text-align: justify\"><\/div>\n<div style=\"padding-left: 40px;text-align: justify\"><em>g) Using artificial intelligence or new technologies to impersonate videos, images, or voices of others in violation of the law; creating, posting, or disseminating information specified in Clause 1 of this Article.<\/em><\/div>\n<div style=\"padding-left: 40px;text-align: justify\"><\/div>\n<div style=\"padding-left: 40px;text-align: justify\"><em>h) Collecting, using, disseminating, exchanging, transferring, or trading personal data of others illegally.<\/em><\/div>\n<div style=\"padding-left: 40px;text-align: justify\"><\/div>\n<div style=\"padding-left: 40px;text-align: justify\"><em>i) Instructing, inciting, luring, or encouraging others to commit crimes or violate the law.<\/em><\/div>\n<div style=\"padding-left: 40px;text-align: justify\"><\/div>\n<div style=\"padding-left: 40px;text-align: justify\"><em>k) Conducting other acts in cyberspace using information technology or electronic means that violate national security, social order, or safety.<\/em><\/div>\n<div style=\"text-align: justify\"><em>3. Conducting cyberattacks, cyberterrorism, cyberespionage, cybercrime, or high\u2011tech crime; causing incidents, attacks, intrusions, taking control, altering, disrupting, paralyzing, or destroying information systems.<\/em><\/div>\n<div style=\"text-align: justify\"><em>4. Producing or using tools, devices, or software, or committing acts that obstruct, disrupt, or spread spam emails, spam messages, spam calls, or harmful software that affects telecommunications networks, the Internet, computer networks, information systems, or information processing and control systems.<\/em><\/div>\n<div style=\"text-align: justify\"><em>5. Illegally infiltrating telecommunications networks, computer networks, information systems, information processing and control systems, databases, or electronic devices of others.<\/em><\/div>\n<div style=\"text-align: justify\"><em>6. Resisting or obstructing cybersecurity protection forces; attacking or illegally disabling cybersecurity protection measures.<\/em><\/div>\n<div style=\"text-align: justify\"><em>7. Abusing or misusing cybersecurity protection activities to infringe upon national sovereignty, interests, security, social order and safety, or lawful rights and interests of agencies, organizations, or individuals, or for personal gain.<\/em><\/div>\n<div style=\"text-align: justify\">\n<p><em>8. Other acts violating the provisions of this Law.<\/em><\/p>\n<p>&nbsp;<\/p>\n<\/div>\n<p style=\"text-align: justify\"><strong>Chapter II \u2013 Cybersecurity Protection for Information Systems<\/strong><\/p>\n<ul style=\"list-style-type: disc;text-align: justify\">\n<li>Classifies information systems into 5 levels based on potential damage if incidents occur.<\/li>\n<li>Identifies information systems critical to national security (military, diplomacy, energy, finance, healthcare\u2026).<\/li>\n<li>Defines tasks and measures for cybersecurity protection for each system level.<\/li>\n<li>Responsibilities of administrators of critical information systems: periodic inspection, monitoring, incident response.<\/li>\n<li>Responsibilities of the Ministry of Public Security, Ministry of National Defense, and Government Cipher Committee in assessment and supervision.<\/li>\n<li>Cybersecurity inspection for systems not classified as critical.<\/li>\n<li>Chapter III \u2013 Prevention and Handling of Acts Violating Cybersecurity<\/li>\n<\/ul>\n<p style=\"text-align: justify\"><strong><br \/>\nChapter III \u2013 Prevention and Handling of Acts Violating Cybersecurity<\/strong><\/p>\n<ul style=\"list-style-type: disc;text-align: justify\">\n<li>Identifies types of information violating national security: anti\u2011State content, undermining unity, defamation, disturbing public order.<\/li>\n<li>Defines illegal acts using IT: impersonation, fraud, gambling, data trading, illegal online platforms\u2026<\/li>\n<li>Responsibilities of enterprises and system administrators in blocking and removing violating information.<\/li>\n<li>Preventing cyberespionage; protecting state secrets and personal privacy.<\/li>\n<li>Protecting children online: content control, preventing exploitation.<\/li>\n<li>Preventing malware, cyberattacks, cyberterrorism.<\/li>\n<li>Handling dangerous cybersecurity situations (large\u2011scale attacks, threats to sovereignty).<\/li>\n<li>Cybersecurity defense and prevention of information conflicts.<\/li>\n<\/ul>\n<p style=\"text-align: justify\"><strong>Chapter IV \u2013 Cybersecurity Protection Activities<\/strong><\/p>\n<ul style=\"list-style-type: disc;text-align: justify\">\n<li>Implementing cybersecurity protection in state agencies: regulations, technology application, personnel training.<\/li>\n<li>Protecting national cyberspace infrastructure and international gateways.<\/li>\n<li>Ensuring information security: account verification, providing data to authorities, storing data in Vietnam.<\/li>\n<li>Ensuring data security: procedures, standards, personnel control, risk assessment, cross\u2011border data transfer control.<\/li>\n<\/ul>\n<p style=\"text-align: justify\"><strong>Chapter V \u2013 Standards, Technical Regulations, Cybersecurity Products and Services<\/strong><\/p>\n<ul style=\"list-style-type: disc;text-align: justify\">\n<li>Defines standards and technical regulations for cybersecurity products and services.<\/li>\n<li>Certification of conformity and compliance for products and services.<\/li>\n<li>Classification of cybersecurity products (civil cryptography, monitoring, anti\u2011attack\u2026).<\/li>\n<li>Classification of cybersecurity services (assessment, consulting, monitoring, incident response\u2026).<\/li>\n<li>Regulations on cybersecurity business: licensing, quality assurance, customer data protection.<\/li>\n<\/ul>\n<p style=\"text-align: justify\"><strong>Chapter VI \u2013 Forces and Conditions Ensuring Cybersecurity<\/strong><\/p>\n<ul style=\"list-style-type: disc;text-align: justify\">\n<li>Defines cybersecurity forces: Ministry of Public Security, Ministry of National Defense, Government Cipher Committee, and units in ministries and organizations.<\/li>\n<li>Policies for training and developing cybersecurity human resources.<\/li>\n<li>Advanced training for administrators of high\u2011level information systems.<\/li>\n<li>Public cybersecurity awareness programs.<\/li>\n<li>Research and development of cybersecurity technologies; enhancing national autonomy.<\/li>\n<li>Regulations on cybersecurity funding (minimum 15% of digital transformation budget).<\/li>\n<\/ul>\n<p style=\"text-align: justify\"><strong>Chapter VII \u2013 Responsibilities of Agencies, Organizations, and Individuals<\/strong><\/p>\n<ul style=\"list-style-type: disc;text-align: justify\">\n<li>The Government uniformly manages cybersecurity nationwide.<\/li>\n<li>Ministry of Public Security is the focal point; Ministry of National Defense manages military\u2011related cybersecurity.<\/li>\n<li>Responsibilities of system administrators: monitoring connections, reporting incidents.<\/li>\n<li>Responsibilities of service providers: risk warnings, incident response, IP identification, data provision upon request.<\/li>\n<li>Responsibilities of individuals: securing accounts, providing information when required, complying with cybersecurity laws.<\/li>\n<\/ul>\n<p style=\"text-align: justify\"><strong>Chapter VIII \u2013 Implementation Provisions<\/strong><\/p>\n<p style=\"text-align: justify\">Amends and supplements multiple related laws to align with the concept of \u201ccybersecurity.\u201d<\/p>\n<p style=\"text-align: justify\">The Law takes effect on July 1, 2026.<\/p>\n<p style=\"text-align: justify\">The 2015 Cyberinformation Security Law and the 2018 Cybersecurity Law are repealed.<\/p>\n<p style=\"text-align: justify\">Transitional provisions for system classification and business licenses.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>SUMMARY OF THE CYBERSECURITY LAW 2025 BY CHAPTER Chapter I \u2013 General Provisions Defines the scope of regulation and subjects of application. Explains key concepts: cybersecurity, data security, cyberattacks, cyberterrorism, cyberespionage, cybersecurity threats, etc. Outlines the State\u2019s policies on cybersecurity: prioritizing resources, developing human capital, international cooperation. Provides principles for cybersecurity protection: compliance with the [&#8230;]\n","protected":false},"author":78,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-1588","post","type-post","status-publish","format-standard","hentry","category-legal-updates"],"_links":{"self":[{"href":"https:\/\/lawpage.vn\/en\/wp-json\/wp\/v2\/posts\/1588","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lawpage.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lawpage.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lawpage.vn\/en\/wp-json\/wp\/v2\/users\/78"}],"replies":[{"embeddable":true,"href":"https:\/\/lawpage.vn\/en\/wp-json\/wp\/v2\/comments?post=1588"}],"version-history":[{"count":0,"href":"https:\/\/lawpage.vn\/en\/wp-json\/wp\/v2\/posts\/1588\/revisions"}],"wp:attachment":[{"href":"https:\/\/lawpage.vn\/en\/wp-json\/wp\/v2\/media?parent=1588"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lawpage.vn\/en\/wp-json\/wp\/v2\/categories?post=1588"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lawpage.vn\/en\/wp-json\/wp\/v2\/tags?post=1588"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}