Vietnam’s Cybersecurity Law (No. 116/2025/QH-15) officially entered into force on 1 July 2026. Its key provisions cover cybersecurity protection, data protection, the management of critical information systems, and the development of the cybersecurity industry, while also establishing a regulatory framework for cybersecurity products and services.
Under the law, cybersecurity products include civil cryptography products, cybersecurity testing and evaluation products, cybersecurity monitoring products, products designed to prevent attacks and intrusions, and other cybersecurity products. Cybersecurity services include cybersecurity testing and evaluation services, information security services that do not use civil cryptography, civil cryptography services, cybersecurity consulting services, cybersecurity monitoring services, cybersecurity incident response services, data recovery services, services for preventing and combating cyberattacks, and other cybersecurity services.
Enterprises providing cybersecurity products or services are required to obtain the relevant business licenses and ensure that their products or services comply with the applicable technical regulations. As the national authority responsible for cybersecurity, the Ministry of Public Security (BCA) will be responsible for developing national cybersecurity standards, managing the quality of cybersecurity products and services, and registering, designating, and overseeing the operations of cybersecurity conformity certification bodies. Implementing regulations are expected to be issued in due course.
In line with the implementation of the Cybersecurity Law, the BCA also issued Circular No. 48/2026/TT-BCA, introducing QCVN 11:2026/BCA, a new cybersecurity technical standard for IP surveillance cameras. The standard took effect on 1 July 2026 and replaces QCVN 135:2024/BTTTT, which was previously issued by the Ministry of Information and Communications (MIC).
Primarily based on ETSI EN 303 645 and ETSI TS 103 701, QCVN 11:2026/BCA specifies technical requirements and test methods covering 11 categories of baseline cybersecurity requirements for IP surveillance cameras, including initial passwords, vulnerability management, software updates, and secure communications.
The conformity declaration requirements under QCVN 11:2026/BCA have not yet taken effect. They will become applicable only after the BCA issues the list of medium- and high-risk products and goods under its management.
GCC will continue to monitor regulatory developments relating to Vietnam’s cybersecurity framework and provide timely updates.