VietnamLaw on Cybersecurity, unauthorized access prohibition
Law No. 24/2018/QH14 (Law on Cybersecurity), art. 8(3), art. 9
A computer misuse rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Do not illegally access a telecom network, a computer network, an information system, or a database belonging to another person.
- Do not distribute software, or use a tool, that obstructs, disrupts, or harms the operation of a telecom network, computer network, information system, or database.
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Article 9 provides that a person who breaches the Law shall, depending on the nature and seriousness of the breach, be disciplined, be subject to a penalty for an administrative offence, or be criminally prosecuted, and must pay compensation for any loss or damage caused; the Law itself states no fine amount or imprisonment term, leaving these to administrative decrees and a Penal Code provision not described here.
Who enforces it
Enforcement body
The Ministry of Public Security's Cybersecurity Task Force, with the Ministry of National Defence responsible for military information systems (arts. 30, 37).
What it makes you log
Logging duty
Article 8(3) of the Law on Cybersecurity forbids producing or deploying tools or software that obstruct or disrupt a telecom network, the Internet, a computer network or an information system, spreading a harmful program, and illegally accessing another person's network, system or database; article 9 sends a breach to discipline, an administrative penalty or criminal prosecution. Neither requires anyone to create, keep, produce or review a log or record. Outside the cited provisions, article 26(2)(b) obliges a domestic or foreign service provider to keep system logs for investigations for a period the Government sets, and article 26(3) obliges providers handling Vietnamese users' personal and relationship data to store it in Vietnam for a period the Government sets; the row does not cite article 26, so none of that is coded. The two cited articles state no territorial clause, so no hook is recorded.
- Kind
- None
- As of
What this law does
Article 8(3) strictly prohibits producing or using tools to obstruct or disrupt the operation of a telecom network, the Internet, a computer network, an information system, or an e-facility, distributing software that harms such a system, or illegally accessing a telecom network, a computer network, an information system, or a database of another person.
The prohibition's own wording turns on access being illegal rather than on defeating a specific security measure, so whether it reaches a scraper reading a public, unauthenticated page is unsettled rather than confirmed either way, and no reported case addresses the point.
Article 9 provides that a breach of the Law is, depending on its nature and seriousness, disciplined, subject to an administrative penalty, or criminally prosecuted, with compensation owed for any loss caused, but the Law itself states no fine amount or imprisonment term for this prohibition, leaving those to administrative decrees and the Penal Code. Law No. 116/2025/QH15 on Cybersecurity ended the effect of this Law on .
The new Law restates the prohibition on illegally accessing another person's telecom network, computer network, information system, information processing and control system, database or electronic device in its Article 7.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .