Duty LXD-6351
Serves under-18s, in Vietnam
Law on Children, responsibility to protect children in the internet environmentsince 3 lines
Law No. 102/2016/QH13, Article 54 · Read the law's page
- Applies to any agency, organization or individual that manages or provides information and communications products and services, or organizes activities, in the Internet environment.
- Apply measures ensuring safety and privacy for children, meaning persons below the age of sixteen.
- Follow the specific requirements the Government sets under clause 3 of the article.
Cybersecurity Law, Incident Response and Reporting Dutiessince 4 lines
Law No. 116/2025/QH15 (Law on Cybersecurity), arts. 40(1)(c), 41(2)-(4) · Read the law's page
- As the manager of an information system, connect its cybersecurity monitoring to the National Cybersecurity Centre of the Ministry of Public Security, or to the Ministry of National Defence's centre for a military system, and report a cybersecurity incident to that specialised force.
- As an enterprise providing a service on a telecommunications network, the Internet, or another value-added service in cyberspace in Vietnam, warn users of the cybersecurity risks in the service and give guidance on preventive measures, and keep an emergency response plan ready to address cybersecurity weaknesses, risks and incidents.
- When a cybersecurity incident occurs, implement that plan immediately and simultaneously report it to the specialized cybersecurity protection force; the Law states no fixed number of hours for this report.
- Apply technical measures to secure data processing, including personal-data processing, consistent with this Law, Vietnam's law on data, and its Law on Personal Data Protection.
- This duty binds now: Law No. 116/2025/QH15 took effect .
Cybersecurity Law, Information System Classification and Protection Measuressince 5 lines
Law No. 116/2025/QH15 (Law on Cybersecurity), arts. 8, 10 · Read the law's page
- This duty binds now: Law No. 116/2025/QH15 took effect , and Decree No. 331/2026/ND-CP, which sets the classification criteria, has applied since .
- Determine which of the five statutory levels your information system falls into, based on the damage an incident or a cybersecurity-law violation could cause to lawful rights and interests, public interests, social order and safety, or national security.
- At level 1 or level 2, perform every Article 10(1) task (determine your system's level, assess and manage its cybersecurity risk, supervise and inspect its protection activities, apply protection measures, follow the reporting regime, and raise cybersecurity awareness), and choose which Article 10(2) measures to apply based on your own needs and capacity.
- At level 3 or level 4, and not on the Prime Minister's list of information systems critical to national security, perform every Article 10(1) task and, without discretion, promulgate cybersecurity design-and-operation rules, apply management measures meeting national cybersecurity standards, back up and store data protecting the system's components, inspect and supervise compliance, monitor the system, and respond to and remedy incidents; file a dossier proposing your system's level and put it into operation only once that level is approved.
- This duty does not describe a system the Prime Minister has placed on the list of information systems critical to national security: that class carries the full Article 10(1) and 10(2) obligation set plus its own appraisal, certification and annual self-inspection regime under Articles 9 and 11, gated on a government designation rather than a declared activity.