The Quiet Passing of Việt Nam’s 2025 Cybersecurity Law

Seven years after nationwide protests against the Cybersecurity Law, the National Assembly has passed a revised version via an unprecedented fast-tracked procedure. This new law retains the original intent to tighten internet control while further expanding police authority.

June 2018 marked a legislative turning point for two reasons: 

1. Việt Nam introduced its first law that directly restricts citizens’ online activities. 
2. This move sparked consecutive days of mass demonstrations across multiple regions in defiance of the law.

Despite widespread opposition, on June 12, 2018, the National Assembly passed the Cybersecurity Law with 86.86% of deputies voting in favor. [1][2]

On the morning of Dec. 10, the National Assembly once again approved the revised Cybersecurity Law with an even higher consensus of 91.75%. [3] Several key distinctions set this new version apart from its contested predecessor.

A Fast-Tracked Procedure

The revision of the Cybersecurity Law was completed in just five months. This timeline spans from July 10, when the National Assembly Standing Committee added the bill to the 2025 legislative agenda, to the approval vote on Dec. 10. [4][5]

In April 2025, the Ministry of Public Security proposed this fast-track process to merge the 2018 Cybersecurity Law with the 2015 Law on Network Information Security. [6][7][8] Consequently, the Ministry released the draft for public consultation for only 20 days starting June 26. [9] Notably, this consultation period occurred before the bill was even officially added to the 2025 legislative agenda. [10]

This stands in stark contrast to the original 2018 Cybersecurity Law, which underwent a drafting process of nearly two years, from July 29, 2016, to June 12, 2018. [11] This draft was also published for public comment for two full months starting June 8, 2017. [12]

Currently, the fast-tracking of lawmaking has become increasingly “inflated.” Numerous major laws are being revised at breakneck speed, justified by the goal of streamlining the state apparatus. [13]

Notable Changes

During the drafting of the 2018 Cybersecurity Law, the bill faced strong opposition from the public, domestic experts, and international organizations. Widespread protests broke out across multiple provinces on June 10–11, 2018, continuing for several days. These demonstrations stemmed from a simple demand for “freedom,” as protesters believed the law would restrict online freedom of expression and the right to privacy. [14]

Immediately after the National Assembly passed the law on June 12, 2018, a Change.org petition gathered tens of thousands of signatures calling on the president to reject the promulgation order. [15][16] 

The petition argued that the law hindered freedom of speech, violated the confidentiality of communications, stripped citizens of internet freedom, and granted excessive power to cybersecurity forces. Organizations such as Amnesty International (AI), Human Rights Watch (HRW), Reporters Without Borders (RSF), and the U.S. Embassy in Việt Nam raised similar concerns. [17][18][19][20]

However, the 2025 revised Cybersecurity Law not only failed to incorporate these recommendations but actually went further, proposing even stricter measures to manage and monitor citizens’ online activities. [21][22]

The revised Cybersecurity Law, comprising 8 chapters and 45 articles, introduces several significant new provisions proposed by the Ministry of Public Security. Effective July 1, 2026, the law mandates the following:

• Online service providers are required to identify the IP addresses of all organizations and individuals using their services and supply this information to cybersecurity authorities upon request. [23]
• The Ministry of Public Security assumes full authority over cybersecurity, replacing the shared model with the Ministry of Information and Communications. This consolidation follows the Ministry’s assumption of responsibilities previously held by the Ministry of Science and Technology under Decree 55/2025 and Decree 02/2025. [24][25]
• State-owned enterprises, agencies, and organizations within the political system are encouraged to prioritize Vietnamese-made cybersecurity products.
• Heads of agencies managing information systems critical to national security must undergo competency assessments and obtain cybersecurity certification.
• Strict prohibitions are placed on a wide range of acts, including: propagating anti-state rhetoric; spreading distorted information about the government; falsifying history; insulting national leaders; using AI to fabricate videos or voices (deepfakes); and engaging in online fraud. [26]

These regulations reinforce a broader trend of tightening control. The latest Freedom House report rates Việt Nam’s online environment as “Not Free” with a score of 22/100, citing the Vietnamese Communist Party’s strict management of digital spaces. [27] 

Furthermore, in June 2025, the Asian Forum for Human Rights and Development condemned the censorship of Telegram and other platforms as violations of privacy and free expression. [28]

A 2023 iMAP report found that between July 1, 2022, and June 30, 2023, 11.39% of access attempts to 2,329 websites were blocked by major telecom providers Viettel, VNPT, and Mobifone, mostly targeting political criticism and human rights content. [29] Similarly, RSF has consistently ranked Việt Nam among the lowest globally for press freedom. [30] These trends indicate that Việt Nam is increasingly diverging from international digital freedom standards.

The Vanishing Public Voice

There is a sharp contrast in public engagement between the two drafting periods of the Cybersecurity Law. Unlike the volatile atmosphere of 2018, the recent revision elicited virtually no visible response, despite the introduction of many stricter provisions. There were no petitions, no protests, and no organized pushback. [31]

This silence mirrors the recent rapid constitutional amendment process aimed at streamlining the state apparatus, [32] revealing a constitutional climate in 2025 that differs entirely from that of 2013. [33] It is clear that the public has become increasingly absent from the legislative process, a trend effectively illustrated by the amendment of the Cybersecurity Law. [34]

Legislation Without Representation

The revised Cybersecurity Law was passed during the National Assembly’s 10th session, which approved a record-breaking 49 draft laws and 4 resolutions. [35][36][37] This follows the 9th session, which passed 34 laws, constitutional amendments, and numerous resolutions. [38] 

Faced with such a massive workload handled via fast-track procedures, the public struggles to engage. Even National Assembly Chair Trần Thanh Mẫn has criticized the government for pressuring the legislature into this rapid-fire lawmaking. [39]

Yet, volume is not the primary reason for the public’s disengagement. The core issue is that citizen opinions are rarely acknowledged. Legislative activities operate under the principle of “ensuring the comprehensive and direct leadership of the Communist Party of Việt Nam.” [40] Once the Party sets a direction, laws are revised accordingly, often quickly, with public feedback framed as uniformly supportive.

True public sentiment is better reflected in rare instances of backlash, such as the reaction to Directive No. 20/CT-TTg and Decree No. 168/2024/NĐ-CP. [41][42] For the Cybersecurity Law, however, silence prevails. Ordinary citizens are left with no choice but to brace for compliance when the new provisions take effect on July 1, 2026.

Trường An wrote this article in Vietnamese and published it in Luật Khoa Magazine on Dec. 11, 2025. The Vietnamese Magazine has the copyrights for its English translation.