Việt Nam’s New Proposal on Firewall: What the MPS Draft Reveals

Việt Nam will “focus on building a firewall.” This was among the notable statements made by Public Security Minister Lương Tam Quang on Feb. 7, following the closing session of the Communist Party’s 14th Congress. [1]

​While international observers have long regarded Việt Nam as maintaining strict Internet censorship, the explicit goal of constructing a “national firewall” is relatively new. Senior Communist Party and state officials had never previously used the term publicly prior to the minister’s recent remarks.

​Now, newly enacted laws and several recent draft legal documents offer some indication of how such a firewall system could operate.

On the Proposed Firewall

On Dec. 10, 2025, the 15th National Assembly of Việt Nam adopted a new cybersecurity law, which will take effect on July 1, 2026. Drafted under the lead authority of the police, the Ministry of Public Security (MPS), this legislation consolidates the 2018 Cybersecurity Law and the 2015 Law on Information Security. [2]

​This new framework introduces several additions to the Internet control measures of the country, most notably the plan to build a national firewall. Point d, Clause 2, Article 10 of the 2025 Cybersecurity Law explicitly states that authorities will “study the development of a national firewall system.” [3] This marks the first appearance of such language in a Vietnamese legal document.

​The term “firewall” surfaced again roughly two months later when the MPS released another draft text for public comment, titled “Draft National Standard: Cybersecurity—Firewall—Basic Technical Requirements.” [4]

​In the draft, the MPS describes the firewall as a network of mandatory monitoring and filtering functions applied to Internet activities. Under the proposal, a compliant firewall device must filter traffic, conduct deep packet inspection (DPI), and allow the full extraction of data streams passing through the monitoring system of the ministry.

​Notably, the technical design requires the firewall to include SSL/TLS inspection capabilities. This means the system would be able to decrypt encrypted data to read user content before re-encrypting and transmitting it onward.

SSL/TLS are encryption protocols that secure data transmitted between a user’s device and a website’s server, typically indicated by a web address beginning with “https” rather than “http.” [5]

​Beyond data interception, the system would be required to link user identities to establish individualized control policies. This includes incorporating web-filtering functions based on blacklists capable of holding at least 100,000 domain names. 

The draft defines these blacklists as compilations of IP addresses, domain names, and URL resource identifiers restricted under information security policies, with the stated aim of blocking online activities or data flows deemed “undesirable.”

​Additionally, the cybersecurity system requires each network device to log all user connection sessions, recording the time, source address, destination address, protocol, matched signature, and enforcement action taken. Online behavior would then be analyzed and categorized into “risk levels.”

Based on these risk scores, the firewall would automatically apply control policies and issue alerts to cybersecurity authorities when thresholds are exceeded. Finally, the Cybersecurity Law grants the police oversight of IP address identification for every internet user.

Notably, the cybersecurity system would require each network device to log all user connection sessions. The required logs must include the time, source address, destination address, protocol, matched signature, and enforcement action taken. 

Telecom Data Access Mandates

During the nationwide Lunar New Year holiday, the police quietly sought public comment on a new draft decree guiding the implementation of the Cybersecurity Law.

Intended to replace the current Decree 53/2022/ND-CP, the document converts existing legal provisions into detailed regulations, most notably regarding the mandatory identification of user IP addresses. [6] [7]

​Under the proposal, telecommunications and internet service providers must establish systems to continuously record and store IP identification data linked directly to subscriber profiles. This data must be kept in full for a minimum of 12 months and is divided into two primary categories: basic user identification and system log data.

​Basic user information encompasses the full name, organizational details, citizen identification number, subscriber name or code, registered installation address, and physical device location.

Meanwhile, system log data must capture source and destination IP addresses, connection ports, synchronized session start and end times, gateway and session IDs, alongside complete network address translation (NAT) mapping information.

​The core mandate of the draft dictates that these providers must implement technical systems capable of feeding this IP identification data directly to the cybersecurity force of the MPS.

Specialized Cybersecurity Force

​To effectively manage and monitor user data, the recent MPS draft decree outlines plans to continue expanding the specialized cybersecurity force already established under the Cybersecurity Law.

​Members of this unit will be responsible for monitoring, extracting intelligence, and controlling online content in compliance with national security protection requirements. Furthermore, they will be granted the authority to oversee and supervise the national cyberspace system, the information systems of political agencies, and other assigned information systems.

​Despite these broad mandates, the police have noted that Việt Nam currently faces a severe shortage of roughly 700,000 cybersecurity personnel. To address this gap, the government has spent recent years organizing multiple competitions and recruitment drives, offering various incentives to attract cybersecurity talent from both home and abroad. [8]

User Data Centrally Stored in Việt Nam

Data localization is a cornerstone of this framework. All described user data must be housed entirely within Việt Nam at the National Data Center, a facility operated by the MPS. [9] This is mandated under both the Cybersecurity Law and Decree 53/2022/ND-CP.

Companies are also required to surrender user service information to the specialized cybersecurity force within 24 hours of a police request. For “emergency cases,” this window narrows to just three hours, ensuring nearly real-time access for investigation and verification purposes.

***

The MPS has spearheaded several additional legal frameworks that provide the essential foundation for the national cybersecurity system. While some of these statutes have already been passed by the National Assembly, others are still in the public consultation stage, reflecting an accelerated legislative agenda. These include:

• The Draft Decree on inspection and assessment of technical security equipment [13];
• The Law on Personal Data Protection (effective Jan. 1, 2026) [10];
• The Draft Resolution on the development of digital citizenship [11], and
• The Draft Decree outlining measures to prevent and combat violations involving fake or false information [12].

---

Sùng Chính wrote this article and published it in Luật Khoa Magazine on Feb. 28, 2026. The Vietnamese Magazine owns the copyrights to its English translation.