Legal review: 15 October 2026 · Đọc tiếng Việt
State bodies with information systems supporting their activities, and organisations with systems in Vietnam providing online services to individuals and businesses, should assess their security level dossier obligations. The assessment concerns each system and its functions, data and governance. A company’s industry label or the existence of a website alone does not answer the question.
The familiar Vietnamese search term is hồ sơ cấp độ an toàn thông tin. The current framework uses cybersecurity terminology: Cybersecurity Law No. 116/2025/QH15 took effect on 1 July 2026, and Decree No. 331/2026/ND-CP on information system cybersecurity protection took effect on 19 August 2026. New projects must consider this framework and its transition provisions.
1. The legal test comes before the industry list
Article 2 of Decree 331 applies to bodies, organisations and individuals involved in building, establishing, managing, operating, upgrading or expanding information systems in Vietnam supporting either:
- IT applications in the activities of state bodies and organisations; or
- IT applications providing online services to individuals and businesses.
Other relevant organisations and individuals are encouraged to apply the Decree. Article 28 addresses system classification, preparation of the proposed security level dossier and appraisal. The system owner, operator, dedicated cybersecurity unit and contractors have different roles. Their involvement does not mean each must submit a separate dossier for the same system.
2. Which organisations should check their obligations?
The following practical list maps organisational examples to Articles 2, 3 and 9. It is not a statutory register of company names or an unconditional rule that every entity in a sector has the same obligations.
| Organisation | Systems to examine | Applicability test |
|---|---|---|
| Ministries, central and local state bodies and organisations | Document management, internal administration, databases, public portals and online administrative services | Systems supporting IT use in state activities fall within the relevant limb of Article 2, including internal systems. |
| Public service institutions, including public hospitals, schools, institutes and centres | Administration, professional records, healthcare, admissions, education and online services | Confirm the institution’s status, system owner and connection to state activities or online service delivery. |
| Banks, financial institutions and payment, securities and insurance service providers | Customer applications, transaction portals and systems directly providing or supporting online services | Check systems in Vietnam against the online service test, sector rules and any higher level criteria. |
| Telecom and IT businesses, digital platforms and software-as-a-service providers | Service platforms, customer accounts and information processing or storage services | Assess the actual online service under Articles 2 and 3. Small scale is not an automatic exemption. |
| E-commerce operators and businesses selling goods or services through websites and apps | Ordering, transactions, accounts, payments and online customer service functions | Analyse actual functions. A simple promotional website should not automatically be treated as equivalent to an online marketplace. |
| Private healthcare, education and other specialist service providers | Online bookings, healthcare or education services and patient or learner portals | Check the online service limb. Holding internal employee data alone does not establish this particular obligation. |
| Digital infrastructure providers and operators | Shared networks, databases, data centres, cloud, electronic authentication/certification, digital signatures and interconnection | Apply Article 2 and the system types in Article 9. Distinguish the provider’s infrastructure from each customer’s own system. |
| Industrial, energy, transport and other construction facility owners or operators | Industrial control systems monitoring and controlling important facility components | Check the Decree’s scope, construction classification, sector rules and national security system designation. Not every factory automatically has the same status. |
| State-invested, private and foreign-invested businesses | Each system, classified by function and intended users | Ownership is not the sole test. Relevant online service systems in Vietnam must be assessed on their actual characteristics. |
| Developers, outsourced operators, consultants and solution providers | Systems they build, support or operate for a client | Responsibilities follow their legal and contractual role. Outsourcing does not automatically discharge the system owner’s accountability. |
3. Does an internal accounting or HR system always require a dossier?
No blanket answer is appropriate. A private company using a purely internal accounting or HR application must first check Article 2, system connections, sector rules and any specific applicable designation. Where it falls outside the mandatory scope, adopting the framework may be voluntary. Separate personal data, confidentiality and cybersecurity duties still require consideration.
Conversely, a small business providing online services cannot assume that having few users removes its dossier obligations. Scale and data affect the proposed level; the scope test is a separate first step.
4. When should the review start?
- New systems and upgrades: incorporate classification and protection planning into the design, investment documentation or IT service leasing plan. Article 30(6) requires the approved protection plan to be fully implemented before a new, expanded or upgraded system enters operation.
- Existing systems without appropriate documentation: inventory the systems, identify accountable units and assess the operating-system procedure in Article 20.
- Material changes: review changes to functions, scale, data, technology, connections and risk under Article 10. Where reclassification is necessary, Article 25 applies.
- Cloud and outsourced IT: review the leasing plan, actual architecture and contract. A supplier’s documents do not automatically cover the customer’s system.
Under Article 45 of Law 116, systems classified under the former law retain their assigned level but must meet the new conditions, standards and protection measures within 12 months from 1 July 2026. Article 39 of Decree 331 separately provides a six-month appraisal and approval transition under Decree 85/2016/ND-CP for systems already undergoing investment or construction before 1 July 2026. This is not a general grace period for all businesses.
5. How KM UNION coordinates legal and technical work
A useful dossier must match the actual owner, system boundaries, data and implementation plan. A template with the company name changed may miss sensitive data, shared infrastructure, contractor responsibilities and operational requirements.
KM UNION reviews legal applicability, supports the legal documentation and internal rules, and coordinates with capable IT and information security/cybersecurity providers holding the licences required for the specific regulated services. Technical surveys, assessments and solution design are allocated to appropriately qualified providers. The engagement defines the work, responsibilities and deliverables in writing.
For an initial review, prepare a system list, service description, owner and operator details, deployment locations, data categories, the number of relevant data subjects and existing approvals. Detailed configurations, network diagrams and sensitive information should be shared only through an agreed secure process.
Legal sources
Luật An ninh mạng 116/2025/QH15; Nghị định 331/2026/NĐ-CP; Nghị định 332/2026/NĐ-CP.
Reviewed on 15 October 2026. This article provides general information, not advice for a particular system or dossier. English explanations are for reference; the authoritative Vietnamese legal texts apply. Contact KM UNION to agree a formal advisory scope.
Related articles
- Vietnam Security Level Dossier: Documents and Approval Process
- Vietnam Information Security Level 2 vs Level 3: The 2026 Criteria
- Beyond the Security Level Dossier: Legal and Technical Compliance
