Internet & Online Safety - Vietnam

Passed by the National Assembly on 10 December 2025 with 91.75% approval and entering into force 1 July 2026, this eight-chapter, 45-article law consolidates the 2015 Cyber-Information Security Law and the 2018 Cybersecurity Law into a single framework. It grants the Ministry of Public Security lead authority over cybersecurity governance, digital ID verification, and removal of illegal online content.

Effective 25 December 2024, Decree 147/2024/ND-CP requires social media platforms with ≥100,000 monthly Vietnamese visitors to authenticate users via Vietnamese phone numbers or national ID cards, store Vietnamese user data locally for a minimum of 24 months, provide data to authorities on demand, and remove content the government classifies as illegal within 24 hours (with a 90%+ compliance rate required for flagged content).

The 2018 Cybersecurity Law (Article 16–17) and its 2025 successor broadly prohibit online content that criticises or opposes the Socialist Republic, 'distorts revolutionary history', undermines national unity, or spreads 'untruthful' information. Authorities can demand takedown within 24 hours; Facebook restricted 834 pieces of content in the latest reporting period — a reported 983% increase — and Meta and Google comply with approximately 95% and 90% of government requests respectively.

Decree 147/2024 requires parents or guardians to register and supervise social media accounts for children under 16. Decision 88/QD-BTTTT (2025) from the Ministry of Information and Communications further introduces content classification and identity-verification requirements for minors. The incoming Cybersecurity Law 2025 expands digital identity requirements that will apply to minor account registration from July 2026.

Building on Decree 13/2023/ND-CP (Vietnam's first personal data protection decree, effective 1 July 2023), a new Law on Personal Data Protection entered into force on 1 January 2026. It expands obligations to foreign organisations processing Vietnamese citizens' data, mandates 72-hour breach notification, requires explicit consent as the primary legal basis for processing, and introduces stricter cross-border data transfer rules.

Vietnam's Freedom on the Net 2025 report (Freedom House) rates the country 'Not Free', noting systematic blocking of politically sensitive websites, arrests for online speech, and coercion of platforms into compliance. The 2025 Cybersecurity Law further tightens liability by designating the Ministry of Public Security as lead cybersecurity enforcer with powers to compel platform cooperation on content identification and user data disclosure.