Vietnam's Government has issued three decrees implementing its 2025 Cybersecurity Law: Decree 332/2026/ND-CP on cybersecurity products and services, Decree 333/2026/ND-CP detailing the law's provisions, and Decree 341/2026/ND-CP on civil cryptography. According to DFDL's legal update, Decrees 332 and 333 took effect on 19 August 2026 and Decree 341 on 1 September 2026. The official Official Gazette record confirms Decree 333 was issued and took effect on 19 August 2026.
The case for the state's approach
The strongest argument for these rules is practical. Investigators need evidence quickly, and when a platform's logs and user records sit abroad, a request can stall for weeks. Vietnam also faces real online fraud and cyber-intrusion risks, and governments are entitled to expect that a service with millions of Vietnamese users can be reached by a regulator. Decree 333 answers that concern with specific timelines rather than open-ended discretion, which is more than many jurisdictions offer.
What actually changed on localisation
The localisation rules are narrower than the headlines suggest, and that is the decree's most defensible feature. As Duane Morris reports, Vietnam-incorporated companies carry an automatic obligation to store personal information of users in Vietnam and user-generated data such as account names, service-use times, credit-card information, email addresses, recent login and logout IP addresses and telephone numbers. The general minimum storage period is 24 months, and system logs must be kept for at least 12 months.
Offshore providers face a conditional test. Localisation applies only when three cumulative conditions are met: the service is involved in cybersecurity-law violations, the Ministry of Public Security has issued three written cooperation requests within six months, and the enterprise fails to remedy the problem or obstructs the measures. A foreign firm that is then ordered to open a branch or representative office has 12 months to comply, per Duane Morris and DFDL. DFDL also notes that storage arrangements are acceptable so long as data can be retrieved and promptly provided to a competent authority.
This builds on Decree 53/2022, which CMS described as taking effect on 1 October 2022 with similar 24-month storage and branch-office requirements. A graduated, evidence-triggered mechanism is better than a blanket mandate, because it lets compliant foreign services keep serving Vietnamese users from regional infrastructure.
Where the burden grows
The concerns lie elsewhere. Decree 333, which Vietnam News Agency summarised as having six chapters and 32 articles, requires domestic and foreign companies to verify user information at registration and to authenticate accounts using Vietnamese mobile numbers or personal identification. Businesses must answer cybersecurity authority requests within 24 hours, or 3 hours in emergencies. VietnamPlus adds that illegal content must be removed or restricted within 24 hours, or 6 hours in urgent national-security cases, and that commercial livestream users must provide personal identification.
These provisions matter for speech. Tying accounts to phone numbers or government identity weakens pseudonymity, which protects dissidents, whistleblowers and ordinary users alike. Account locks of up to 60 days for three violations in 30 days, rising to 180 days for ten violations in 90 days, mean that enforcement depends on how "illegal content" is defined. The sources I reviewed do not set out the full statutory definition, so the real impact will turn on how the Ministry of Public Security applies it. A 3-hour or 6-hour deadline also leaves little room for a platform to assess whether a takedown request is lawful, which pushes services toward over-removal.
Licensing as a market-entry cost
Decree 332 adds business licensing. According to Duane Morris, licences are valid for 10 years, the licensed entity must be established under Vietnamese law, and it must employ qualified technical personnel. Assessment and consultancy firms need at least 5 qualified staff in Vietnam, and monitoring services at least 12. Both categories require a Vietnamese-national legal representative. Import and export of cybersecurity products needs a separate licence valid for two years. Decree 341 separately licenses civil cryptography for 10 years, with the Government Cipher Board as the administering body, per DFDL.
Local-incorporation and nationality requirements protect domestic firms more than they improve security. Vietnam's own cybersecurity sector would benefit from competition with international vendors, especially as AI-assisted attacks raise the stakes for defenders everywhere. Serious incidents must also be reported within 24 hours, with a full report within 72 hours, according to Duane Morris. That is a reasonable standard on its own.
A proportionate path forward
Regulators should publish the criteria that count as a cooperation request and a failure to remedy, because those two steps determine whether localisation stays an exception. They should treat Decree 333's identity-verification rules as a trade-off to be justified rather than assumed, and consider accepting verified identity at the platform level instead of mandatory phone-number linkage. Finally, they should let foreign vendors serve the market through partnerships rather than requiring a Vietnamese legal representative for every category.
The decrees give businesses more clarity than the earlier framework did, and the conditional localisation test is a genuine improvement over blanket mandates. The costs now sit in identity mandates, short takedown clocks and licensing barriers, and those are where the evidence from implementation should be watched most closely.