LexLint

Know the law where your app runs.

Law / Vietnam

Cybersecurity Law, Incident Response and Reporting Duties

Law No. 116/2025/QH15 (Law on Cybersecurity), arts. 40(1)(c), 41(2)-(4)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

In force 77 days, effective 1 July 2026.

A vulnerability and incident reporting rule binding public and private bodies.

As of 16 September 2026.

What it requires

  • This duty binds now: Law No. 116/2025/QH15 took effect 1 July 2026.
  • As the manager of an information system, connect its cybersecurity monitoring to the National Cybersecurity Centre of the Ministry of Public Security, or to the Ministry of National Defence's centre for a military system, and report a cybersecurity incident to that specialised force.
  • As an enterprise providing a service on a telecommunications network, the Internet, or another value-added service in cyberspace in Vietnam, warn users of the cybersecurity risks in the service and give guidance on preventive measures, and keep an emergency response plan ready to address cybersecurity weaknesses, risks and incidents.
  • When a cybersecurity incident occurs, implement that plan immediately and simultaneously report it to the specialised cybersecurity protection force. The Law states no fixed number of hours for this report, unlike the 24-hour and 72-hour clocks the same enterprise faces under Article 25(2) for a content-takedown or a user-information request, which are a content-moderation duty this row does not carry.
  • Apply technical measures to secure data processing, including personal-data processing, consistent with this Law, Vietnam's law on data, and its Law on Personal Data Protection.

If you get it wrong

Private right of actionNo

Penalty structure

Decree No. 330/2026/ND-CP, art. 21 sets four individual fine tiers, doubled for an organisation under art. 7(1): VND 10,000,000 to 20,000,000 for a contact-point or dossier failure (art. 21(1)); VND 20,000,000 to 30,000,000 for failing to report a detected incident or failing to deploy and report incident response (art. 21(2)); VND 30,000,000 to 50,000,000 for failing to consolidate and report incident developments, failing to designate an incident-response unit or team, failing to develop an incident-response plan, or incompletely implementing an Article 41 coordination request (art. 21(3)); and VND 50,000,000 to 70,000,000 for a further set of coordination, staffing and log-preservation failures (art. 21(4)), the figure this row's fixed_cap states once doubled for an organisation.

Rule
Fixed only
As of
16 September 2026
Currency
VND
Fixed cap
140,000,000

Who enforces it

Enforcement body

The specialised cybersecurity protection force of the Ministry of Public Security, or of the Ministry of National Defence for a military information system.

Settledness

As of
16 September 2026
Open questions
Does Article 41(3)'s undated, "immediately" reporting clock acquire a fixed number of hours once a further implementing decree or circular addresses it, the way Decree No. 331/2026/ND-CP fixed the classification criteria Article 8(2) left to the Government?

What it reaches

Obligation class

Reporting, Security, Governance

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 40(1)(c) requires any information system manager, at any level, to report a cybersecurity incident to the specialised cybersecurity protection force.

Article 41 layers a parallel duty on any domestic or foreign enterprise providing a telecommunications, Internet, or other value-added cyberspace service in Vietnam: keep an emergency response plan for cybersecurity weaknesses, risks and incidents, implement it and report an incident the moment it occurs, and apply technical measures to secure data processing, including personal-data processing.

When LexLint raises it

  • crawls_web
  • trains_models
  • deploys_chatbot
  • automated_outreach
  • high_risk_decisions
  • processes_voice
  • processes_biometrics
  • serves_minors
  • operates_social_platform
  • ships_mobile_app
  • distributes_software_product

Read the law

English translation, LuatVietnam, Law No. 116/2025/QH15

Back to the example  ·  Lint your app