Vietnam issues new cybersecurity rules for domestic, foreign businesses

Issued on August 19, the decree comprises six chapters and 32 articles, covering cybersecurity protection measures, information security assurance, specialised cybersecurity training, and management of IP address identification for telecommunications and Internet service providers.

According to Article 16, domestic and foreign businesses providing services on telecommunications networks, the Internet, and cyberspace-based value-added services in Vietnam must conduct information security assurance activities in accordance with the article and other relevant regulations of Vietnamese law.

Businesses must verify users' information when digital accounts are registered and authenticate accounts using a mobile phone number in Vietnam. Users without such a number must use their personal identification number or another lawful electronic identification method.

Users conducting commercial livestreaming must authenticate their accounts using their personal identification number. 

Businesses must also apply necessary administrative and technical measures to protect users' information and accounts and allow only verified accounts to post, share information, and use interactive functions.

Regarding information provision for cybersecurity protection, businesses must provide user information to specialised cybersecurity forces under the Ministry of Public Security upon valid requests made in accordance with Vietnamese law for verification, investigation, and handling of legal violations.

Such information must generally be provided within 24 hours of receiving a request. The deadline is reduced to three hours in emergencies involving threats to national security or human life.

Businesses must also restrict access to or remove illegal information, services and applications in Vietnam upon requests from specialised cybersecurity forces. Such requests must be fulfilled within 24 hours, or six hours in emergencies threatening national security.

For repeated violations, accounts, pages, community groups and content channels may face restrictions on visibility in Vietnam or temporary suspension. 

Accounts posting illegal information at least three times within 30 days may be restricted or suspended for up to 60 days, while those posting such information at least 10 times within 90 days may face restrictions or suspension for up to 180 days, depending on the nature and severity of violations.

Indefinite restrictions or account blocking may apply to accounts, pages, community groups, and content channels used to disseminate information infringing Vietnam's national security, continuing violations after being temporarily blocked at least three times, or otherwise serve as tools for cybersecurity violations where permanent blocking is deemed necessary.

An indefinitely blocked account may be restored if the grounds for the measure no longer exist, an error occurred during verification or handling, new circumstances emerge, or competent authorities determine that the account is not being used for cybersecurity violations.

The decree also provides for suspension or termination of services for organisations and individuals posting information covered by specified provisions of the Law on Cybersecurity upon requests from specialised cybersecurity forces.

Businesses must additionally store and manage system logs for State management, information security assurance, and handling of legal violations. 

Logs must include, at minimum, user account information, login and logout times, IP addresses, source ports and records of posted information processing, and must be retained in a retrievable form for at least 12 months.

The decree took effect on August 19.