DRAFT LAW ON INFORMATION SECURITY 2025: A CONSOLIDATED STEP TO STRENGTHEN CYBERSECURITY

The Ministry of Public Security is soliciting public opinion on the Draft Law on Information Security 2025, which aims to merge the 2018 Law on Cybersecurity and the 2015 Law on Cyberinformation Security. This is considered a move to unify state management and enhance the effectiveness of cybersecurity protection amid the rise of high-tech crime.

The draft expands the definition of "service provider" to cover numerous sectors, from social networks and online games to banking, e-wallets, e-commerce, and logistics. These entities will be required to:

Verify user identity, and detect and handle fake accounts;

Remove violating content within 24 hours;

Report cyberattacks within 24 hours;

Retain data and cooperate with investigative authorities upon request.

Notably, the Ministry of Public Security is granted the authority to freeze accounts, block websites, or seize evidence during investigations.

According to the draft, information systems will be classified into three levels, reduced from the previous five. Among these, Level 3 systems are designated as critical national information systems, covering sectors like finance, banking, energy, healthcare, and communications, and must adhere to a regime of periodic inspection, assessment, and reporting.

For cybersecurity products and services, the draft adds regulations on technical standards, requiring certification of conformity before they can be offered on the market.

Other notable new points include:

Abolishing the requirement for foreign service providers to establish a representative office in Vietnam, but still mandating compliance with the Law on Personal Data Protection, which takes effect on January 1, 2026;

Introducing the concept of "digital assets," creating a legal basis for managing blockchain-based transactions;

Adding regulations on preventing and combating high-tech crime, and strengthening the obligation of organizations and businesses to coordinate in monitoring, preventing fraud, and providing information to state agencies.

The draft is open for public comment until July 2025 and is expected to be submitted to the 15th National Assembly during its October 2025 session. If passed, the Law will take effect on January 1, 2026. Concurrently, the Government will issue a decree providing detailed regulations and implementation guidance, including penalties for administrative violations in cyberinformation security.

The 2025 Law on Information Security is expected to consolidate a unified legal framework, enhance the effectiveness of cybersecurity management, protect the legitimate rights and interests of organizations and individuals, and foster the healthy and sustainable development of Vietnam's digital economy.