SCOPE 01
Classify products, services and models
Review the catalogue, datasheet, enabled functions, HS information and supply model to distinguish cybersecurity licensing, civil cryptography and general compliance obligations.
Cybersecurity Product & Service Licensing in Vietnam
Duong Tri Law provides cybersecurity licensing support in Vietnam, from classification and eligibility review to preparing and following the agreed application. New applications concern cybersecurity products and services under the current regime; older cyberinformation security licences require a separate transition review.
We review the actual product/service, catalogue, model, HS code, cryptographic functions, applicant’s role and shipment plan before defining the route. The engagement sets out what the client must provide, the legal work and deliverables, and any separate technical or corporate work needed.
Business licensing Export/import licensing Civil cryptography Cybersecurity compliance
CONNECTING LEGAL AND TECHNICAL EVIDENCE
What does Duong Tri Law’s licensing support cover?
We review the products, services and available records, identify the relevant permissions and prepare the agreed documents. Filing and authority correspondence are handled within the agreed authorisation. The client remains responsible for accurate technical evidence, actual operating conditions and timely confirmation of the application.
SCOPE 02
Identify readiness gaps
Review the Vietnam entity, foreign-investment position, personnel, technical systems, facilities, standards and available evidence against the applicable category.
SCOPE 03
Prepare the business-licence application
Support the application, personnel records, equipment/facilities explanation and technical/business plans under Decree 332/2026. Required qualifications and operating arrangements must exist in practice.
SCOPE 04
Prepare the export/import application
Reconcile the model, listed category, standards, purpose, end user and commercial evidence for the proposed consignment.
SCOPE 05
Coordinate authority review
Monitor receipt and correspondence, analyse additional-information requests and coordinate explanations and revised records within the agreed scope.
SCOPE 06
Explain the result and continuing duties
Review the licensed scope, product/service changes, later models or consignments and conditions that must be maintained. Separate future filings are scoped when required.
Agreed deliverables: a procedural plan and client checklist; the agreed application package and filing records; the authority’s result and guidance on its scope and continuing conditions. Approval remains the authority’s decision. Professional fees, official charges and third-party costs are identified separately. Engineering, recruitment, testing, certification and customs services are not included unless expressly agreed.
ACTIVITY → APPLICABLE RULES → PROCEDURE
Which cybersecurity licensing route fits your activity?
Start with what the enterprise will actually manufacture, trade, import, export or provide. Identify any listed products, the service delivered to customers and civil cryptography functions before selecting an application.
ROUTE 01
Business in cybersecurity products/services
Assess the business-licence route where the actual products or services fall within Decree 332/2026. A Vietnam-established applicant and category-specific personnel, facilities and operating plans must be assessed.
ROUTE 02
Export or import of cybersecurity products
For Annex II products, assess a separate consignment-based licence, the valid business licence, standards evidence and specific end use. One company’s business licence does not authorise every model or shipment.
ROUTE 03
Civil cryptography products/services
Assess Decree 341/2026 where cryptographic functions fall within its scope. Products combining civil cryptography and cybersecurity functions follow the applicable coordination mechanism; avoid assuming that two independent applications are always required.
ROUTE 04
General cybersecurity compliance
An enterprise outside the regulated product/service business and listed export/import routes may still have information-system, cybersecurity or data obligations. Compliance with those duties is not itself a universal business-licensing requirement.
These are screening routes. A firewall, VPN, HSM, SIEM, security appliance or multifunction software must be assessed through its actual model, enabled functions, technical records and supply arrangement. A trade name alone cannot establish the conclusion.
Four situations to classify before choosing a procedure
| Situation | Information to clarify | Review focus |
|---|---|---|
| Distributing a firewall or gateway | Exact model, enabled functions, encryption and the entity selling the product | Business-licence scope, the export/import list and any civil cryptography or dual-use route. |
| Providing penetration testing or security advice | Actual testing/advisory scope, authorised system access, personnel and contractual responsibilities | The applicable cybersecurity service category and its staffing and operating conditions. |
| Operating a SOC for customers | Who performs monitoring, the infrastructure, staffing, logs and data accessed | Service licensing, technical operation, customer confidentiality and data responsibilities. |
| Using a solution only within your own business | Intended use, direct import and whether any service or product is supplied onward | Do not infer business licensing from software use alone; separately review listed imports, information systems and data duties. |
These examples guide an initial review; they do not replace a classification conclusion for a specific model or contract.
THE 2026 LEGAL TRANSITION
How do the former and current licensing terms relate?
Cybersecurity Law 116/2025/QH15 took effect on 1 July 2026, replacing the 2015 Cyberinformation Security Law and the 2018 Cybersecurity Law. Decree 332/2026, effective 19 August 2026, directly regulates business in cybersecurity products/services and the relevant export/import permissions.
NEW APPLICATIONS
Use the current cybersecurity terminology
New applications are assessed under the current framework: a licence for business in cybersecurity products and services, and a separate licence for export/import of listed cybersecurity products.
OLDER LICENCES
Check the stated scope and expiry
The transition rule preserves qualifying cyberinformation security business licences issued before 1 July 2026 until their stated expiry. Older civil cryptography licences have their own applicable transition rules; the original instrument must be reviewed.
EXPANDING OR CHANGING ACTIVITIES
Assess the current route before implementation
A valid older licence should not be assumed to cover additional products, services, models or activities. Review its scope, date and the proposed changes under the applicable current amendment or licensing procedure.
When is a cybersecurity business licence required?
Where the actual products or services fall within Decree 332/2026, identify the licensed categories and eligibility before preparing the application. Terms such as firewall, SOC, penetration testing and security software are starting points; functions, customer contracts and the applicant’s activities establish the relevant review.
Provide an activity description, product or solution materials, the Vietnam applicant’s corporate/investment records, technical staffing and planned launch date. For foreign-invested economic organisations, the remaining investment term in Vietnam must exceed five years from the licence grant date. Category-specific requirements and market access need separate review; foreign ownership alone does not establish eligibility.
Detailed conditions, dossier, timing and fee guide (Vietnamese).
APPLICANT AND PERSONNEL
Check the actual licensed category
The applicant must be established under Vietnamese law. General personnel conditions include technical staff with the prescribed degree or specialist certification and checks on the representative/management or authorised person. Cybersecurity checking or advisory services require at least five qualifying technical staff with specific residence addresses in Vietnam and a Vietnamese legal representative. Monitoring services require at least twelve qualifying staff, dedicated system/information-security responsibility and a Vietnamese legal representative. These category-specific rules do not replace the separate FDI market-access review.
OPERATING READINESS
Facilities and plans must exist in practice
Review equipment, facilities and technology suited to the registered activity, and the required technical/business plans. Service operations need appropriate contingency, customer-confidentiality and quality arrangements. Monitoring-system features and operating processes need evidence. Certain national-security product categories have additional restricted manufacture/trade conditions; do not assume ordinary commercial eligibility.
FORMAL BUSINESS DOSSIER
Prepare the records required by Article 9
The dossier uses Form 03, relevant personal/qualification and personnel records, equipment/facilities/technology explanations, and Forms 07/08 technical/business plans. Personal documents are required as prescribed where the information cannot be retrieved from the system. Special national-security manufacturing cases need the additional assignment/order or qualifying contract evidence. The applicant must confirm the accuracy and lawful basis of the Vietnamese filing.
ROUTE 02
Export/import licensing for cybersecurity products
A business licence does not replace export/import permission. For products within Annex II to Decree 332/2026, review the precise model and obtain the relevant permission for the consignment before carrying out the regulated transaction.
CORE CONDITIONS
Three requirements to check
Business licence: the applicant must hold a valid cybersecurity products/services business licence.
Standards: imported cybersecurity products must meet the applicable international or Vietnamese standards under the standards and technical-regulations framework.
Purpose and end user: both must be specific and must not prejudice national security.
FORMAL DOSSIER OVERVIEW
Align the model, standards and end-use records
Application: Form 04 under Annex I to Decree 332/2026.
Standards evidence: documentation certifying compliance with the relevant international or Vietnamese cybersecurity standards.
End-use evidence: the commercial contract with the end user or documents establishing the applicable research or warranty purpose.
CHECK 01
Annex II and HS classification
Compare the listed description, HS code and actual technical functions. A broad HS heading alone does not resolve model classification or the civil cryptography overlap.
CHECK 02
A consignment-based permission
The export/import licence is issued per consignment with a two-year term. Reconcile the actual delivery plan with the licensed models, quantities, scope and remaining validity.
AUTHORITY PERIOD
5 working days
The Ministry of Public Security considers the valid application within five working days. A refusal must be notified in writing with reasons. Preparation, standards work and correction of incomplete records are separate.
Do not classify by trade name alone: products sold under one name can have different models and enabled functions. We review the datasheet/catalogue and exact model before confirming the proposed licensing route.
DISTINGUISH THE OBLIGATIONS
Cybersecurity licensing, civil cryptography and general compliance
We assess each activity and the applicable legal mechanism. Civil cryptography is separately regulated by Decree 341/2026; information-system or data duties are also distinct from a licence to supply regulated cybersecurity products/services.
ROUTE 01
Cybersecurity products and services
Review Law 116/2025 and Decree 332/2026 for regulated business activities and listed export/import products. The licence-holder and the actual supplier/importer must be identified.
ROUTE 02
Civil cryptography and dual-use functions
Review Decree 341/2026 for regulated civil cryptography. For products combining both functions, the Ministry of Public Security issues the cybersecurity business/export-import licences after obtaining the Government Cipher Committee’s written opinion on the cryptographic functions. Applicable cryptographic standards still need assessment.
ROUTE 03
Compliance without a product/service business licence
Operating SaaS, an e-commerce service or an information system, or processing personal data, can create compliance duties. Those facts alone do not establish that the operator supplies a regulated cybersecurity service. Assess what is actually delivered to customers.
LEGAL AND COMMERCIAL RISKS
Why classify the activity before launch or shipment?
Decree 330/2026 provides the current cybersecurity and personal-data administrative-sanctions framework. The consequences depend on the conduct and can include fines, licence-related measures, suspension or remedial action where the applicable provision allows. No single fine applies to every licensing issue.
RISK 01
Operating outside the licensed scope
Check the regulated categories, applicant conditions and licence scope before offering a new product, contracting for a service or expanding an existing operation.
RISK 02
Importing a model before requirements are ready
Incorrect classification, missing permission or inconsistent model, standards and end-user records can disrupt import and delivery planning. A customer deadline does not replace a required approval.
RISK 03
Missing the civil cryptography layer
Encryption functions require their own review. Assess the dual-use coordination route where relevant instead of assuming one generic security licence resolves every obligation.
ALWAYS LISTENING. ALWAYS FINDING A SOLUTION.
How does Duong Tri Law handle a licensing engagement?
We classify the activity before drafting. The engagement identifies the necessary permissions, missing client evidence, proposed deliverables and sequence of work. Authority approval, technical readiness and the commercial launch date are separate dependencies.
STEP 01
Understand the activity and records
Review the catalogue, model, functions, proposed HS code, supply-chain role, customers, markets and shipment plan. Agree a suitable channel before sharing sensitive architecture, customer data or personnel records.
STEP 02
Identify the applicable framework
Distinguish the cybersecurity business route, consignment export/import route, civil cryptography/dual-use route and general compliance work.
STEP 03
Identify eligibility and evidence gaps
Review corporate/FDI records, qualifying staff, technical systems, business plans, standards and end-user evidence. The client supplies accurate records and implements any required operating changes.
STEP 04
Agree the plan and responsibilities
Confirm the procedures, sequence, checklist, client contacts, legal deliverables, fees and exclusions before detailed drafting or filing.
STEP 05
Prepare and submit the agreed dossier
Prepare and reconcile the relevant application; obtain the client’s confirmation and signatures; provide authorised filing support and coordinate clarification within the agreed scope. Additional or changed work is scoped separately.
STEP 06
Hand over the result and compliance points
Provide the authority’s result and retained filing records. Explain the authorised categories, conditions to maintain, reporting, future changes and later model/consignment reviews. Approval remains the authority’s decision.
After grant: maintain conditions and plan later changes
Maintain the licensed conditions and operate within the authorised categories. Decree 332/2026 requires an annual Form 09 report to the Ministry of Public Security before 31 January of the following year, covering the preceding calendar year, and ad hoc reports when requested. Monitoring providers have additional connection/information-exchange duties with the competent security system. Review company-information, personnel, product/service and operational changes before implementation; separately assess the appropriate amendment, renewal or consignment procedure. Later filings and ongoing compliance management are separate unless agreed.
DECREE 332/2026 AUTHORITY PERIODS
Who issues the licences, and how long does review take?
The Ministry of Public Security issues the cybersecurity business and export/import licences under Decree 332/2026. These are authority review periods for the relevant complete, valid file, not a guaranteed end-to-end service timetable.
BUSINESS LICENCE
28 working days
Authority assessment runs from receipt of a complete, valid dossier. Client preparation, qualifications, technical arrangements and addressing missing records take separate time. A new business licence has a ten-year term under the current decree.
EXPORT/IMPORT LICENCE
5 working days
Consideration runs from the valid application. The permission is consignment-based with a two-year term. It does not make all future models or shipments automatically eligible.
FILING METHODS
Direct · Post · Online public service
The business application is one Vietnamese-language dossier submitted to the Ministry of Public Security through the permitted channel. Original signatures/seals or valid digital signatures must meet the applicable filing requirements.
Confirm the scope before estimating the project
Multiple models, foreign-investment questions, dual-use functions, standards evidence and translation/formality requirements can affect the work. We separate professional fees, current official charges and third-party costs. The authority initially checks dossier validity within three working days; where supplementation is requested, the applicant must respond within the applicable ten-working-day period. Complete records and client response time therefore matter.
Business appraisal fees and import licence charges are separate
Circular 152/2026/TT-BTC applies from 9 October 2026. Appraisal for initial grant/reissue of a cybersecurity business licence is VND 8,000,000 for one product or service category, plus VND 2,000,000 for each additional category. The import licence charge is VND 200,000 for an initial grant or VND 100,000 for reissue per grant. These are different fee categories; neither is Duong Tri Law’s professional fee. Check the actual procedure and current schedule before payment.
Detailed grant/change/renewal fee guide (Vietnamese); official fee schedule.
FOLLOW THE RELEVANT ROUTE
Related services and specialist resources
After classification, use the relevant procedure or legal service. Specialist resources without an EN counterpart are clearly labelled Vietnamese; the service scope and key requirements are summarised above.
01Cybersecurity business-licence guide (Vietnamese) →Detailed conditions, formal documents and procedural guidance for the regulated business route.
02Civil cryptography licensing →Review cryptographic functions, business/export-import permission, conformity and dual-use coordination.
03Technology, Internet and data guide (Vietnamese) →Other technology procedures that may need review alongside the cybersecurity route.
04Technology/distribution contract review →Review distribution rights, product scope, service levels, responsibilities and implementation conditions within the agreed legal scope.
02Civil cryptography licensing →Review cryptographic functions, business/export-import permission, conformity and dual-use coordination.
03Technology, Internet and data guide (Vietnamese) →Other technology procedures that may need review alongside the cybersecurity route.
04Technology/distribution contract review →Review distribution rights, product scope, service levels, responsibilities and implementation conditions within the agreed legal scope.
CURRENT LEGAL FRAMEWORK
Key legislation for cybersecurity licensing
The current framework differs materially from the former 2015 Cyberinformation Security Law regime. Use rules effective for the actual application and activity; older provisions should be relied on only where an applicable transition rule permits.
PRIMARY LEGISLATION
Cybersecurity Law 116/2025/QH15
Effective 1 July 2026: the statutory framework for cybersecurity products/services, civil cryptography and transition from the former laws.
Cybersecurity Law — official source
Cybersecurity Law — official source
BUSINESS AND EXPORT/IMPORT
Decree 332/2026/ND-CP
Effective 19 August 2026: regulated products/services, applicant conditions, business-licence dossiers, procedures and consignment export/import licensing.
Decree 332/2026 — official source
Decree 332/2026 — official source
ADMINISTRATIVE SANCTIONS
Decree 330/2026/ND-CP
Effective 19 August 2026: administrative sanctions in cybersecurity and personal-data protection. Consequences depend on the actual conduct and applicable provision.
Decree 330/2026 — official source
Decree 330/2026 — official source
CIVIL CRYPTOGRAPHY
Decree 341/2026/ND-CP
Effective 1 September 2026: the separate civil cryptography framework, including the licensing coordination mechanism for dual-use products.
Decree 341/2026 — official source
Decree 341/2026 — official source
Official source: Read Decree 332/2026 on the Government legislation portal. For an actual filing, also check the current forms, official charges, standards and public-service instructions. Circular 152/2026 has applied to the specified fee/charge categories since 9 October 2026.
FREQUENTLY ASKED QUESTIONS
Questions about cybersecurity licensing in Vietnam
These answers support an initial discussion. The actual model, functions, contract, applicant and supply arrangements determine the required review.
Are cyberinformation security and cybersecurity licences the same current legal term?
New applications use the current cybersecurity products/services framework under Law 116/2025 and Decree 332/2026. Cyberinformation security is a useful older search term and appears on existing licences, but should not be presented as an alternative current regime for a new application. Review an older instrument’s scope, expiry and transition position.
Is a cyberinformation security business licence issued before 1 July 2026 still valid?
The statutory transition preserves qualifying licences until the expiry stated on them. That does not automatically authorise additional products, services or activities. Review the original licence and proposed change before implementation.
Does a business licence allow us to import every model?
No. Match each product to Annex II to Decree 332/2026. A listed product requires the relevant consignment export/import permission, with standards and specific end-use evidence. Review any civil cryptography or dual-use functions as well.
What conditions apply to an export/import application?
The applicant needs a valid cybersecurity products/services business licence. Imported products must meet the applicable standards requirements, and the purpose and end user must be specific and must not prejudice national security. The formal dossier uses Form 04 with the required standards and end-use records.
How long does a new business-licence review take?
Decree 332/2026 gives the Ministry of Public Security 28 working days from receipt of a complete, valid dossier to assess and consider grant. That excludes client preparation and remediation; it is not a guaranteed overall completion date.
What is the period and term for export/import permission?
The authority considers the valid application within five working days. The licence is issued per consignment with a two-year term. Check the licensed products and transaction details against the shipment plan.
Does domestic distribution avoid business licensing?
Not automatically. Assess whether the product and actual sale or supply activity fall within Decree 332/2026. A distributor cannot infer exemption merely because it does not manufacture the product or import directly.
What if a security product also uses encryption?
Review its actual functions under Decree 341/2026. For dual-use civil cryptography/cybersecurity products, the Ministry of Public Security licensing route includes the Government Cipher Committee’s written opinion on cryptographic functions. Do not select procedures from the marketing name alone.
Does every SaaS provider need a cybersecurity business licence?
No automatic conclusion follows from using SaaS or having cybersecurity/data duties. Determine whether the service actually supplies a regulated cybersecurity product or service, and separately review its information-system, data and contractual obligations.
What information is needed to define the work and fee?
Start with the product/service, catalogue or datasheet, exact models, supply-chain role, proposed activities, HS information, standards, encryption functions, existing licences and launch/shipment date. Identify the Vietnam applicant and any foreign-investment issues. Agree a secure intake channel before providing detailed technical or personal records.
UNSURE WHICH ROUTE APPLIES?
Discuss the model, activity and proposed licensing scope
Send a short overview of the products/services, exact models, available technical materials, applicant and intended business or shipment date. We will clarify the legal questions, client inputs, proposed deliverables, exclusions and fees before proceeding. Detailed architecture and other sensitive records should follow an agreed intake arrangement.