Vietnam's Decree 328/2026/ND-CP on preventing and combating fake and false information took effect on 5 October 2026. It was issued on 19 August alongside the government's new decrees implementing the new Cybersecurity Law. Read with Decree 333, which sets out when foreign platforms must store data locally and open an office in Vietnam, it forms one of the most consequential platform-governance regimes in Southeast Asia.
The strongest case for the rules
The case for acting is real. Fabricated health claims, investment scams and impersonation spread fast, and victims rarely have a quick remedy against a platform headquartered abroad. Regulators say they cannot enforce local law against companies with no local address and slow responses. A defined process for verifying, labelling and warning about falsehoods is arguably better than the ad hoc takedown demands such systems often rely on. A labelling-first approach also leaves the content visible with a correction attached. It is less blunt than deletion.
Decree 328 has some of that structure. According to the decree text on LuatVietnam, Article 8 sets a six-step process: detect, fact-check, label, publicise and warn, block or remove, then apply handling measures. Article 10 requires labelling within 24 hours of a conclusion that content is false. VietnamNet reports that the label reads "FAKE NEWS, FALSE INFORMATION". It adds that serious cases are published immediately and ordinary ones within 12 working hours.
Where the design goes wrong
The definition is the problem. Article 3 defines the core term as information that is "untrue or only partly true" and that infringes on national security, reputation, social order or others' lawful rights, per the LuatVietnam text. "Partly true" content that harms "reputation" can cover satire, contested economic forecasts, criticism of officials and good-faith errors. Under such a definition, the decisive question is who decides. In this decree the answer, as the LuatVietnam text and a provincial government summary both describe, is the agency that directly verifies the content. It then labels its own finding. The reports I reviewed describe no independent review, appeal route or right to respond before a label is applied.
Criminal referral raises the stakes. VietnamNet reports that if verification reveals signs of a criminal offence, authorities must pass the case to the bodies that run criminal proceedings. It also says violators' identities may be disclosed and that sharing or commenting on unverified information can carry legal consequences. A compulsory referral rule paired with a broad definition gives ordinary users a reason to stay silent. That chilling effect is a cost to speech, and it also weakens the public's ability to correct real errors.
Platforms are told to police in advance. The same summary says internet, telecom and social network providers, including cross-border ones, must apply controls to detect and handle false information. They must also give users a way to report violations and keep a 24/7 contact point for the authorities. Proactive review duties push firms to over-remove, because deleting is always cheaper than defending a borderline post to a regulator.
Decree 333 puts localisation behind the speech rules
The localisation side is where the leverage sits. According to DFDL's analysis, Decree 333, effective 19 August 2026, requires a foreign enterprise to store data in Vietnam and establish a branch or representative office after "three written requests within a maximum six-month period" about cybersecurity violations that go unremedied. The enterprise then has 12 months from the Ministry of Public Security's decision to comply, and the minimum retention period is 24 months. DFDL also reports that three or more violations within 30 days can bring access restrictions or an account lock of up to 60 days. Ten or more in 90 days can extend that to 180 days, and serious or repeated cases can be restricted indefinitely.
A companion measure, Decree 327, raises the pressure. VnEconomy reports that it lets authorities block access to foreign systems with no local office or that refuse local data storage. Standard data and information requests carry a 24-hour deadline, and emergencies a deadline of no more than three hours.
The design is a ladder of coercion. A platform that does not remove content labelled false within the window risks a violation. Enough violations trigger a localisation order, and non-compliance with that order risks blocking. Because Decree 328 defines the underlying speech violation so loosely, the ladder can be climbed on contestable judgments.
What proportionate regulation would look like
The evidence from other jurisdictions is that localisation rarely delivers what its backers promise. Storing data in-country does not by itself make it more secure, and it can concentrate sensitive data in a single, more attractive target. Costs fall hardest on mid-sized services that cannot afford a local office, so the practical result is fewer services for Vietnamese users rather than more accountable ones.
Vietnam could keep the legitimate core of these rules and fix the weak points:
- Narrow the definition. Limit "false information" to verifiable statements of fact that cause concrete, demonstrable harm. Exempt opinion, satire and good-faith error.
- Add independent review. Require an agency other than the one making the finding to confirm a label, and give the author a right to respond.
- Make urgent deadlines the exception. Reserve three-hour windows for imminent physical harm such as fraud in progress, not for contested speech.
- Tie localisation to data risk. Base any storage order on a defined security need, not on a count of unanswered requests.
The pro-innovation reading of this package is not that Vietnam should do nothing about scams and disinformation. It is that precise, reviewable powers protect both citizens and the digital economy better than open-ended ones. Foreign platforms that now weigh the compliance cost of a Vietnam presence will be reading the first enforcement actions closely. Those actions will show whether Decree 328's labels are applied to fraud and falsehood, or to criticism.