Vietnam Approves New Law on Cybersecurity

By: Dezan Shira & Associates
Editor: Koushan Das

On June 12, Vietnam’s National Assembly passed the Law on Cybersecurity with a huge majority. The law will be coming into effect on January 1, 2019.  The major provisions in the law include data localization, government control over online content, and setting up local offices in Vietnam. Although the law has been adopted, there are still some issues that lack clarity and more changes are expected to be introduced and implemented before it comes into effect.

 RELATED: Business Advisory Services from Dezan Shira & Associates

Key Provisions

Data Localization

Onshore and offshore service providers will be required to store data of Vietnamese users in Vietnam. Service providers include:

• Firms providing services on a telecom network, internet, and other online value-added services;
• Firms involved in collecting, utilizing, and processing of user’s data including personal information.

Information that needs to be stored locally should include the user’s personal information, online relationships, and all other data generated by the users. Further clarity on issues such as duration of storing user’s data and restrictions on the cross-border transfer of data, may be provided through subsequent decrees and circulars. 

Local office

Offshore entities under the purview of the law need to establish a branch or representative office in Vietnam.

Content control and audits

The Ministry of Information and Communications and the cybersecurity agency under the Ministry of Public Security have the authority to request online and offshore service providers to remove offensive content. They can also conduct an audit of information systems, which can include:

• Digital devices, hardware, software systems;
• Transmitted, processed and stored data.

The government authority will be required to send a notice to the system owner at least 12 hours prior to an audit and will provide the results of the audit, within 30 days from the completion of the audit.

 RELATED: Growing Market Potential of Fintech in Vietnam

Illegal content and acts

Illegal content and acts according to the new law include:

• Article 8: It includes acts such as inciting people against the State, distorting history, gender discrimination, religious offenses, racism, posting untruthful information, and human trafficking. In addition, it includes network terrorism, cybercrimes, and network attacks on information systems critical to national security;

• Article 16: It includes details about the prevention and treatment of information with propaganda contents against the State which can incite riots, disturb public order, cyber humiliate, slander, and affect the socio-economic activities of the State;

• Article 17: It includes network espionage behavior which can violate State secrets, users personal information, and corporate secrets;

• Article 18: This article focuses on using cyberspace in violation of the national security laws, social order, and safety regulations such as selling banned goods, using illegal means of payment, and piracy; and

• Article 29: Focuses on protecting children in cyberspace. 

 RELATED: Startup Ecosystem in Vietnam

Impact

Foreign governments and firms believe that the new law can affect foreign investments and firms operating in the country. According to the Vietnam Digital Communications Association, the new cybersecurity law can reduce GDP growth by 1.7 percent and reduce foreign investment by 3.1 percent.

However, the government believes that this law is necessary for national security and the protection of citizens, as Vietnam lacks a legal framework for cybersecurity issues. Before it comes into effect, further changes may be implemented in the law, as currently, it lacks clarity on a number of issues.

• Previous Article Vietnam Legalizes Sports Betting
• Next Article Overview of the Automobile Industry in Vietnam