Online safety & content laws in Vietnam (2026)

The National Assembly passed a consolidated cybersecurity statute replacing both the 2018 Cybersecurity Law and the 2015 Network Information Security Law, unifying Vietnam's cyber-safety framework for the first time. Key additions include a 6-hour emergency takedown window for illegal content, a nationwide ban on AI-generated deepfakes for illegal purposes, mandatory child-safety technical filters on platforms, and the Ministry of Public Security designated as sole national cybersecurity authority.

Vietnam's first dedicated Personal Data Protection statute elevated data-privacy rules from decree level to primary legislation, superseding Decree 13/2023. It applies extraterritorially to any entity processing data of Vietnamese citizens, shortens breach notification to 72 hours from detection, and authorises fines of up to 5% of annual revenue for cross-border data-transfer violations.

Replacing the decade-old Decree 72/2013, this decree (effective 25 December 2024) requires all social-media platforms to verify Vietnamese user accounts via national phone number or ID, mandates removal of government-designated illegal content within 24 hours, and extends data-localisation obligations to any foreign cross-border service attracting 100,000 or more monthly visits from Vietnam for six consecutive months.

Effective 1 July 2023, Decree 13 was Vietnam's first dedicated data-protection legal instrument, introducing GDPR-style consent requirements, a 72-hour breach-notification obligation to the Ministry of Public Security's Cybersecurity Department, and explicit cross-border data-transfer conditions — applying to any entity processing personal data of Vietnamese users regardless of where processing occurs.

Effective 1 October 2022, Decree 53 operationalised the data-localisation mandates of the 2018 Cybersecurity Law, requiring foreign platforms (social networks, e-commerce, cloud, video) with a material Vietnamese user base to store specified personal data domestically for a minimum 24 months and to establish a Vietnamese branch or representative office within 12 months of a ministerial request.

Vietnam's landmark cybersecurity statute required foreign internet companies to store data on Vietnamese users in-country, remove content on state request, and cooperate with authorities on investigations. The law drew widespread international criticism for broad restrictions on online speech and sparked public protests inside Vietnam; it became the central instrument for enforcement actions against dissidents until superseded in 2026.

Vietnam's first dedicated network-security statute established the regulatory framework for protecting information systems and critical infrastructure, civil cryptography, and technical standards — creating the institutional scaffolding that the 2018 Cybersecurity Law would build on. It imposed security requirements on ISPs and data centres and gave authorities powers to order takedowns of information systems used for illegal purposes.

The government's first comprehensive internet-governance instrument regulated internet services, social networks, online games, and blogs for over a decade; it banned posting content deemed harmful to national security, social order, or traditional Vietnamese values and required foreign platforms serving Vietnamese users to maintain at least one domestic server. Its longevity — and the enforcement controversies it generated — shaped the push for Decree 147/2024.

Vietnam's foundational IT statute established the first legal framework for electronic transactions, internet services, software, digital content, and network infrastructure. It set out rights and obligations for IT users and service providers and created the legislative baseline from which all subsequent internet safety, cybersecurity, and data-protection laws in Vietnam were developed.