Vietnam’s Cybersecurity Law: A Timeline

July 29, 2016- Vietnam’s National Assembly issued Resolution No. 22/2016/QH14 on the 2016 Adjustment of the Law and Ordinance Development and the 2017 Law and Ordinance Development Program. The Law on Security Cybersecurity was one of the six projects submitted to the National Assembly for opinions at the fourth session. [1]

November 2016- Following the passing of the resolution by the National Assembly, the drafting process of the Cybersecurity Law began. Members of the Drafting Committee included the ministries of public security, information and telecommunications, national defense, planning and investment, and industry and trade. [2]

June 2017- The Ministry of Public Security started to gather public opinions to finalize the draft Cybersecurity Law, which would later be submitted to the government and the National Assembly. [3]

May 29, 2018- Nguyen Sy Dung, former vice chairman of the Office of the National Assembly, said that the draft law’s requirement to “localize” users' general data is unrealistic and lacks feasibility. [4]

May 31, 2018- Many Vietnamese experts claimed that the draft of the Cybersecurity Law contained many unclear concepts. In particular, “the information system for national security,” the most important idea that this law aims to protect, is too general and not specific. [5]

June 7, 2018- Human Rights Watch (HRW) appealed to the Vietnamese government to “veto the Cybersecurity Law.” [6]

Simultaneously, thousands of Vietnamese citizens petitioned to protest the Cybersecurity Law. On Change.org (a popular online platform for creating and signing petitions on various issues to advocate for change and raise awareness), there were at least two petitions opposing this bill; the petitions were able to garner 11,000 signatures by the end of the day. [7]

June 8, 2018- The U.S. Embassy in Vietnam issued a statement: The United States and Canada urged Vietnam to delay the vote on the draft law to ensure it aligns with international standards. [8]

June 9, 2018- Amnesty International sent open letters to executives of Apple, Facebook, Google, Microsoft, and Samsung, calling on these companies to “challenge” the Cybersecurity Law and “inform the Vietnamese government that [they] will not comply with any request or directive that violates basic human rights.” [9]

Morning, June 10, 2018- Thousands of people in many Vietnamese provinces and cities took to the streets to protest against the Law on Special Administrative and Economic Units (the Law on Special Economic Zones) and the Cybersecurity Law, which was submitted to the National Assembly during a meeting in Hanoi. [10]

On the same day, Maj. Gen. Nguyen Minh Duc, a standing member of the National Assembly’s National Defense and Security Committee, told the People’s Public Security newspaper – a mouthpiece of the Ministry of Public Security – that the Cybersecurity Bill does not prevent Vietnam from fulfilling its international commitments. [11]

Evening, June 11, 2018- Luat Khoa Magazine and The Vietnamese Magazine, two online newspapers that took the lead in opposing the Cybersecurity Law, were targeted by denial of service (DDoS) attacks. [12] The attacks lasted about a week, leaving their websites almost paralyzed.

June 12, 2018- The Cybersecurity Law received approval from the National Assembly of Vietnam, with 86.86% of the total lawmakers voting in favor — 423 out of 466. 15 lawmakers voted against the law and 28 abstained from voting. [13]

On the same day, a petition on Change.org called on Vietnam’s state president to veto the Cybersecurity Law because it infringed upon the rights to privacy and confidentiality, impeding freedom of speech and depriving people of the right to internet freedom. The petition received tens of thousands of signatures. [14]

Amnesty International also released a press release in which Clare Algar, its global director, expressed concern about the devastating consequences caused by this law for freedom of expression in Vietnam. [15]

June 14, 2018- France-based press freedom advocate Reporters Without Borders (RSF) said that Vietnam’s Cybersecurity Law is a copy of another Cybersecurity Law that took effect in China in June 2017. A representative of RSF in the Asia-Pacific region regarded the law as a tool to strengthen the Vietnamese government’s control over access to information. The organization also called on Vietnam to abolish the Cybersecurity Law. [16]

June 15, 2018- Lt. Gen. Hoang Phuoc Thuan, director of the Cyber Security Department under the Ministry of Public Security, claimed that there was no possibility that the Cybersecurity Law would enable authorities to monitor all social media accounts. On the contrary, he said that implementing this law has elevated the protection of the rights and interests of organizations and individuals to unprecedented levels. [17]

June 25, 2018- Vietnam’s President Tran Dai Quang signed an order to announce the passing of the Cybersecurity Law. [18]

July 6, 2018- Luat Khoa Magazine sent a letter, signed by concerned Vietnamese Facebook users, to Facebook’s headquarters in California, requesting the social media organization to clarify its stance on its policy in Vietnam following the issuance of the Cybersecurity Law.

July 8, 2018- Many Catholic communities in Central Vietnam took to the streets to peacefully protest against the Cybersecurity Law. [20]

July 17, 2018- Change.org petitioned the National Assembly to postpone the implementation of the Cybersecurity Law and to amend it. Many civil organizations in Vietnam signed the document in support. [21]

August 2018- The Department of Cybersecurity and High-Tech Crime Prevention was established by merging the Cybersecurity Department (under the Security General Department) and the High-Tech Crime Prevention Department (under the Police General Department). Maj. Gen. Nguyen Minh Chinh was appointed as the head of this new government agency. [22]

September 5, 2018- During a U.S. Senate Intelligence Committee hearing, Sheryl Sandberg, COO of Meta, the parent company of Facebook, said that aside from a few exceptions, Facebook does not place its servers in Vietnam. She insisted that the company never leaked sensitive user information to the Vietnamese government. [23] [24]

September 7, 2018- The Ministry of Public Security issued Decision No. 5117/QD-BCA to establish a drafting board and an editorial team to develop governmental decrees in guiding the implementation of the Cybersecurity Law. [25]

October 2018- The Ministry of Public Security published the complete draft decree detailing articles of the Cybersecurity Law to gauge public opinion. [26]

December 13, 2018- The Financial Times reported that Facebook, Google, and other technology corporations urged Vietnam to abolish the requirement that tech companies store data in the country. [27]

December 21, 2018- The European Union delegation to Vietnam raised concerns about the Cybersecurity Law with the Vietnamese government. [28]

January 1, 2019- The Cybersecurity Law came into effect. [29]

August 15, 2022- The Vietnamese government issued Decree No. 53/2022/ND-CP, detailing several articles of the Cybersecurity Law. In particular, it stipulates that foreign companies must comply with censorship requirements and provide user data to the Vietnamese government when there is an alleged violation of the Cybersecurity Law. Otherwise, the Minister of Public Security will require these companies to store user data and have to open their physical offices in Vietnam.

The above Decree took effect on October 1, 2022. [30]

November 15, 2022- Nhan Dan Newspaper, the mouthpiece of the Vietnamese Communist Party, published an article stating that the Cybersecurity Law, the Law on Cyber Information Security, the Law on Protection of State Secrets, and the 2015 Penal Code had collectively formed a relatively complete legal system on cyber security, providing a legal basis to help authorities perform their duties in cyberspace. [31]

April 17, 2023- The Vietnamese government issued Decree No. 13/2023/ND-CP on protecting personal data. [32]

May 8, 2023- Deputy Minister of Information and Telecommunications Nguyen Thanh Lam said that by the end of 2023, the ministry will advise and submit to the government another decree. In this new decree, all social media users must authenticate their identity. [33]

June 19, 2023- The Washington Post reported that Facebook has an internal list of “inviolable” officials of the Vietnamese Communist Party, suggesting that content that criticizes these officials is banned on Facebook. [34]

July 17, 2023- The Ministry of Information and Telecommunications announced a new draft decree to replace Decree No. 72/2013/ND-CP on the management, provision, and use of internet services and online information and Decree No. 27/2018/ND-CP, which was issued to amend and supplement Decree 72/2013/ND-CP. [35]

Many new requirements are present in this draft. For example, it requires social media users in Vietnam to authenticate their mobile phone numbers. At the same time, the government can order tech companies to temporarily or permanently block a social network account, community page, or group that allegedly violates the law. [36]

Trong Phung wrote this article in Vietnamese, which was published in Luat Khoa Magazine on July 20, 2023. Dat Le translated the article into English.