Businesses may be required to provide user information within 3 hours at the latest.

According to the draft Law on Cyber Security 2025, in case of emergency, domestic and foreign enterprises providing network services in Vietnam must provide user information within 3 hours at the latest.

Enterprises must apply data protection measures in accordance with Vietnamese law. Illustrative photo

The submission on the draft Law on Cyber Security 2025 (merging the Law on Cyber Security 2018 and the Law on Network Information Security 2015) has just been sent by the Ministry of Public Security to the Ministry of Justice for appraisal.

The draft focuses on protecting cyberspace sovereignty , national security and social order and safety, while also regulating the prevention and handling of cyber security violations.

In addition, the draft also aims to facilitate organizations, businesses and individuals in complying with the law, minimizing administrative procedures, while protecting legitimate rights and promoting a safe digital environment and sustainable digital economic development.

According to the draft, domestic and foreign enterprises providing services on telecommunications networks, the internet, and value-added services in Vietnam are responsible for verifying information when users register for digital accounts.

These businesses must also provide user information to the specialized cybersecurity force under the Ministry of Public Security within 24 hours of a written request, email, or phone call, or within 3 hours in case of emergency that threatens national security or human life.

Enterprises must prevent sharing and delete information containing illegal content on their services, application stores or information systems no later than 24 hours from the time of request from the Ministry of Public Security and no later than 6 hours in case of emergency threatening national security.

Enterprises must store personal information of service users and data generated by service users during the use process for up to 2 years after the user ends the use of the service.

Foreign enterprises that collect, exploit, analyze, and process data on personal information, data on service user relationships, and data created by service users in Vietnam must apply data protection measures in accordance with legal regulations and store this data in Vietnam. These enterprises must establish branches or representative offices in Vietnam.

MR. PHUONG

Source: https://www.sggp.org.vn/doanh-nghiep-co-the-phai-cung-cap-thong-tin-nguoi-dung-cham-nhat-trong-3-gio-post808202.html