Decree 211/2025/NĐ-CP Regulating Civil Cryptography Activities and Administrative Sanctions

Decree 211/2025/NĐ-CP is a legal document regulating civil cryptography activities and amending Decree No. 15/2020/NĐ-CP on administrative sanctions in the fields of post, telecommunications, radio frequencies, information technology, and electronic transactions, as previously amended by Decree No. 14/2022/NĐ-CP. This Decree was promulgated on July 25, 2025, with many important new points, contributing to the perfection of the legal framework for network information security and civil cryptography in Vietnam.

Notably, Decree 211/2025/NĐ-CP clearly defines violations in the business, export, and import of civil cryptography products and services along with corresponding penalty levels. Fines can reach up to 180 million VND for violations in civil cryptography business activities and 100 million VND for violations regarding the export and import of civil cryptography products, accompanied by supplementary sanctions such as the deprivation of the right to use licenses, suspension of operations, or confiscation of exhibits involved in the violations.

Table of contents

See more: Capacity Profile Of Phuc Gia Laboratory Corporation

I. OVERVIEW ON DECREE 211/2025/NĐ-CP

1. Comprehensive regulations on Civil Cryptography activities

Compared to previously issued documents, Decree 211/2025/NĐ-CP provides detailed regulations on the business, export, and import of civil cryptography products and services, as well as the conformity assessment of these products and services. Specifically:

– Decree 211/2025/NĐ-CP inherits from Decree No. 58/2016/NĐ-CP, clearly defining specific conditions for enterprises to be granted Business Licenses and Licenses for the export and import of civil cryptography products.

– The issuance of the List of civil cryptography products and services (Appendix I) and the List of civil cryptography products for export and import under license (Appendix II) includes significant changes, such as:

The list of civil cryptography products is reduced from 8 groups to 7 groups;
The list of civil cryptography products excluded from management increases from 09 groups to 12 groups;
The List of civil cryptography products for export and import under license has also changed in structure and content compared to the previously issued Decree 32/2023/NĐ-CP.

– Another notable point of the Decree is the regulation on conformity assessment activities for civil cryptography products in Chapter III (consisting of 03 articles). Accordingly, the Government Cipher Committee is assigned as the management authority for these activities, including: Issuing Registration Certificates, Designating conformity assessment organizations, and receiving dossiers for the declaration of conformity for civil cryptography products.

– Additionally, the Government Cipher Committee has the authority to consider and decide on the unilateral recognition of conformity assessment results for civil cryptography products from international conformity assessment organizations. This regulation is a new point included in the Decree based on the Law amending and supplementing several articles of the Law on Standards and Technical Regulations promulgated on June 14, 2025.

“Ministries, ministerial-level agencies, and the Minister of National Defense shall consider and decide on the unilateral recognition of conformity assessment results from international conformity assessment organizations and foreign conformity assessment organizations to serve state management activities” (amending Clause 2, Article 57 of the 2006 Law on Standards and Technical Regulations).

2. Simplification of administrative procedures and enhancement of data inter-connectivity

– Regarding licensing procedures (new issuance, amendment, supplementation, re-issuance, and extension of Licenses for civil cryptography products and services and Licenses for export and import), the Government Cipher Committee shall be responsible for searching certain dossier components on the National Database; it shall not require enterprises to provide them, helping to reduce paperwork and time.

– Additionally, Decree 211/2025/NĐ-CP encourages the online submission of dossiers using digital signatures.

– Processing timelines have been markedly shortened, reducing the time for dossier resolution:

New issuance of Licenses for civil cryptography products and services: 20 working days.
Re-issuance (due to amendment)/supplementation/extension: 10 working days.
Re-issuance due to loss/damage: 4 working days.
Issuance of Licenses for the export and import of civil cryptography products: 7 working days.

3. Strengthening administrative sanctions for violations in Civil Cryptography activities

Decree 211/2025/NĐ-CP supplements Articles 93a, 93b, and Article 114a into Decree No. 15/2020/NĐ-CP, specifically regulating violating acts and corresponding penalty levels, with the following notable points:

(1) Violations of regulations on the business of civil cryptography products and services (Article 93a):

– Fines can reach up to 180 million VND depending on the severity and value of the infringing goods. Specifically:

20 – 30 million VND: Failure to store technical dossiers, failure to secure customer information, or delay in submitting reports for 01 month or more.
30 – 40 million VND: Failure to perform procedures for amending/supplementing licenses when changing names or legal representatives.
40 – 50 million VND: Failure to maintain business conditions, failure to refuse service upon discovering customer violations, or using unlicensed products without declaration.
50 – 60 million VND: Providing false information for licensing, conducting business contrary to license contents, or refusing to provide cryptographic key information when requested.
50 – 180 million VND: Unlicensed business (fines increase according to the value of infringing goods: <50 million → fine of 50–60 million; ≥300 million → fine of 160–180 million).
80 – 100 million VND: Failure to coordinate with functional agencies or failure to stop providing services upon request.
100 – 120 million VND: Business activities that cause harm to national defense, security, or social order.

– Supplementary sanctions may include the deprivation of the right to use Licenses (3-6 months), fixed-term suspension of operations (3-6 months), or confiscation of exhibits and means of violation.

(2) Violations of regulations on the export and import of civil cryptography products (Article 93b):

– Fines can reach up to 100 million VND depending on the severity and value of the infringing goods. Specifically:

20 – 30 million VND: Failure to submit reports or delay ≥01 month.
30 – 40 million VND: Failure to maintain licensing conditions.
40 – 50 million VND: Exporting or importing contrary to license contents.
50 – 60 million VND: Providing false information for licensing; failure to coordinate with functional agencies.
60 – 80 million VND: Unlicensed export or import.
80 – 100 million VND: Failure to temporarily suspend operations when requested or exporting/importing that causes harm to national defense, security, or social order.

– Supplementary sanctions may include the confiscation of exhibits and means of violation.

(3) Expansion of sanctioning authority (Supplementing Article 114a)

Decree 211/2025/NĐ-CP stipulates the authority to impose administrative sanctions by the Cipher Inspectorate and the Head of the Government Cipher Committee, enhancing law enforcement capabilities and ensuring network information security.

Expanding the sanctioning authority of functional forces to include Chairmen of People’s Committees at all levels, Inspectorates, People’s Public Security, Border Guard, Coast Guard, Market Surveillance, and Customs.
Supplementing sanctioning authority for the Cipher Inspectorate and the Head of the Government Cipher Committee, as well as Chairmen of People’s Committees at the commune, ward, and provincial-level special zone levels, and Commune-level Police Chiefs.

Simultaneously, Decree 211/2025/NĐ-CP also adjusts fine levels according to the percentage of the maximum fine in each field, in accordance with the Law amending and supplementing the Law on Handling of Administrative Violations 2025.

4. Effect for Implementation

Decree 211/2025/NĐ-CP takes effect from September 09, 2025; accordingly, the following documents shall cease to be effective as of the date this Decree takes effect:

Decree No. 58/2016/NĐ-CP providing detailed regulations on the business of civil cryptography products and services and the export and import of civil cryptography products;
Decree 53/2018/NĐ-CP amending and supplementing Decree No. 58/2016/NĐ-CP;
Decree 32/2023/NĐ-CP amending and supplementing Decree 53/2018/NĐ-CP.