Updated: 23 September 2026<\/p>\n
Anyone searching for an ATTTM licence in 2026 should note the legal transition. Existing licences fall under transitional rules, while new applications must be assessed under Cybersecurity Law No. 116\/2025\/QH15 and Decree No. 332\/2026\/ND-CP, effective from 19 August 2026.<\/p>\n
Articles 3\u20135 of Decree No. 332 define product, service and business categories requiring licences. Classification must reflect functions and deliverables. Buying software for internal use differs from selling products; general technology consulting is not automatically a listed cybersecurity service.<\/p>\n
A business offering cybersecurity testing, consulting or monitoring should check the corresponding descriptions and conditions. Its dossier should explain what customers receive, technical scope, data access and operations rather than only use commercial package names.<\/p>\n
Article 6 sets general conditions, including establishment under Vietnamese law, technical staff with suitable qualifications or certifications, and facilities. Foreign-invested businesses must also assess the relevant conditions in that article.<\/p>\n
Article 7 sets conditions for product manufacturing and business activities; Article 8 addresses services. Testing and consulting require at least five technical staff, while the relevant monitoring category requires at least 12. Read these figures alongside professional standards, representative requirements, plans and other conditions; headcount alone is insufficient.<\/p>\n
Article 9 requires an application using Form No. 03, staff and qualification records, facilities documentation, a technical plan using Form No. 07, a business plan using Form No. 08 and other documents corresponding to the requested scope. Background and personnel forms use Nos. 05 and 06 as applicable.<\/p>\n
One Vietnamese-language dossier is submitted to the Ministry of Public Security online with a digital signature, in person or by post. Evidence of conditions should be consistent across employment contracts, qualifications, assignments, infrastructure and implementation plans.<\/p>\n
Article 9 provides three working days for checking validity and 10 working days for requested supplementation. The appraisal and decision period is 28 working days from receipt of a complete valid dossier, as prescribed. Do not advertise a guaranteed licence in 28 days without the valid-dossier condition and related stages.<\/p>\n
Under Article 5, licences are valid for 10 years. Articles 10\u201312 regulate replacement, reissuance and renewal. Renewal applicants should note Article 12's advance submission requirements, including the 60-day deadline. Business licensing and product import procedures are separate and must both be checked where imports occur.<\/p>\n
Article 45 of the Cybersecurity Law allows licences issued before 1 July 2026 to continue until their stated expiry under transitional conditions. Article 21 of Decree No. 332 also addresses transitional contracts and dossiers. Check issue date, expiry, authorised scope and planned new activities.<\/p>\n
Access logs, accounts and incident investigation data may relate to individuals. Cybersecurity monitoring providers must assess their processing role, access limits, retention periods and independent data uses. A cybersecurity business licence does not replace these obligations.<\/p>\n
If logs are transferred to an overseas analytics platform, also assess Article 20 of the Personal Data Protection Law. If services include civil cryptography products, classify functions and apply the coordination mechanism under Decree No. 341. Technical scope, business plans and data contracts should therefore be reviewed together.<\/p>\n
Customers selecting a provider can compare the licence scope with the service purchased, then clarify accessible data and incident responsibilities. The civil cryptography and data transfer articles explain two issues commonly arising in security service contracts.<\/p>\n
Can vendor certification replace a licence? No. It may evidence some competence but does not replace the competent authority's licensing decision.<\/strong><\/p>\n How are products combining civil cryptography and cybersecurity handled? Article 4(5) of Decree No. 341 provides for Ministry of Public Security licensing of dual-use products with civil cryptography and cybersecurity functions after consultation with the Government Cipher Committee. Classify the product correctly before preparing the dossier.<\/strong><\/p>\n Cybersecurity Law No. 116\/2025\/QH15<\/a><\/p>\n Decree No. 332\/2026\/ND-CP on cybersecurity products and services businesses<\/a><\/p>\n Decree No. 341\/2026\/ND-CP on civil cryptography<\/a><\/p>\n Personal Data Protection Law No. 91\/2025\/QH15<\/a><\/p>\n Decree No. 356\/2025\/ND-CP implementing personal data protection requirements<\/a><\/p>\n Sources checked through 23 September 2026.<\/em><\/p>\n Article 05 Overseas Cloud and CRM Services and Vietnam Data Transfer Filings<\/a><\/p>\n Article 06 Personal Data Breaches and Vietnam 72 Hour Notification Rules<\/a><\/p>\n Article 09 Certification for Personal Data Processing Services in Vietnam<\/a><\/p>\nLegal sources<\/h2>\n
Related articles<\/h2>\n