Against the backdrop of the rapid growth of the digital economy, data security is not only an inherent business need but also a mandatory legal obligation for all enterprises. With the Cybersecurity Law 2025 (Law No. 116/2025/QH15) officially taking effect on 01 July 2026, Vietnam’s legal framework for managing risks in cyberspace has been further completed and strengthened. One of the most strictly regulated areas at present is Civil Cryptography (‘MMDS’). This continues to be classified as a conditional business sector, requiring strict compliance by organizations and enterprises engaged in the manufacture, trading, import and export of relevant products and services.
Decree No. 211/2025/ND-CP has provided an updated and detailed list of civil cryptographic products subject to sector-specific management, together with new licensing regulations. In practice, many enterprises, particularly those operating in software technology, telecommunications, and related sectors, remain uncertain about the distinction between ordinary products and regulated products, thereby exposing themselves to the risk of administrative violations and applicable sanctions.
Accordingly, under the latest legal instruments, how is MMDS defined? More importantly, when is an enterprise required to obtain a License for Trading in Civil Cryptographic Products and Services? This article provides a detailed analysis of the applicable regulations to help enterprises gain a comprehensive understanding and conduct their business in compliance with the law.
1. What Is Civil Cryptography?
From a legal perspective, under the latest provision of Clause 20, Article 2 of the Cybersecurity Law 2025 (Law No. 116/2025/QH15), the term is expressly defined as follows:
“Civil cryptography means cryptographic techniques and cryptographic products used to secure or authenticate information that does not fall within the scope of state secrets, thereby ensuring information security for agencies, organizations and individuals.”
2. License for Trading in Civil Cryptographic Products and Services
The License for Trading in Civil Cryptographic Products and Services is a conditional business license issued by the Government Cipher Committee to regulate the trading of civil cryptographic products and civil cryptographic services. An enterprise may be granted a License for Trading in Civil Cryptographic Products and Services upon satisfying all prescribed conditions regarding facilities, technical personnel, management personnel, technical infrastructure, business plans, warranty plans and technical plans for MMDS products.
Accordingly, the authority responsible for receiving and processing applications for licenses to trade in and import civil cryptographic products is the Department of Civil Cryptography Administration and Cryptographic Product Certification – Government Cipher Committee.
3. Civil Cryptographic Products, Civil Cryptographic Services and the List of Civil Cryptographic Products and Services
To accurately determine its licensing obligations, an enterprise must first understand the relevant concepts and classification of goods and services under Decree No. 211/2025/ND-CP.
(i) Civil Cryptographic Products and Services
- MMDS products: These are described as systems, devices, modules and integrated circuits, and software specially designed to protect information through cryptographic techniques using “symmetric cryptographic algorithms” or “asymmetric cryptographic algorithms”. Accordingly, MMDS products may be understood as products capable of generating cryptographic keys, or securing stored data and data exchanged over the Internet by means of cryptographic keys. Such products may take the form of software or hardware and are designed to encrypt or authenticate information in order to enhance the security of data within information systems.
- MMDS services: Commercial activities providing information protection services, testing and assessment services, and security and network information security consulting services using civil cryptographic products.
(ii) List of Civil Cryptographic Products and Services
Pursuant to Appendix I issued together with Decree No. 211/2025/ND-CP, the list of goods and services that must have a License for Trading when supplied to the market is divided into two specific groups:
List of MMDS products: Comprising 07 groups of essential equipment and software:
- Products for generating, managing or storing cryptographic keys
- Products for securing data at rest
- Products for securing data exchanged over networks
- Products for securing IP traffic
- Products for securing analog and digital voice communications
- Products for securing radio communications
- Products for securing fax and telegraph communications
List of MMDS services: Comprising 03 types of services:
- Information protection services using MMDS products
- Testing and assessment services for MMDS products
- Security and network information security consulting services using MMDS products
(iii) In addition, Decree No. 211/2025/ND-CP clearly lists groups of technology products incorporating cryptographic functions that are not subject to the business licensing requirements or specialized import and export licensing requirements. Specifically, the following products:
- Operating systems, Internet browsers, and software incorporating pre-installed cryptographic components (where information protection through cryptographic techniques is not the principal function), as well as common devices (such as tablets, digital cameras, DVD players, etc.) with built-in or pre-installed cryptographic functions. Such functions are not the principal functions, and users may install and use them without assistance from the supplier
- Mobile phone lines without end-to-end encryption capabilities
- Smart cards and readers/writers used solely for general access and specially manufactured, with the capability only to protect personal information.
- Products specially designed to: prevent software copying; prevent access to readable or publicly disclosed encrypted storage media; or provide one-time protection of audio/video copyright
- Products used solely for identity authentication (without encryption); or TPM (Trusted Platform Module) integrated circuits used to identify devices, authenticate information and protect passwords
- Applications of specialized cryptographic techniques for: remote access and device administration; wireless access protection; or monitoring, preventing and detecting cyberattacks
- Storage drives using SED (Self-Encrypting Drive) encryption technology that are widely used.
- Special-purpose devices limited to end-use applications in the medical field.
4. When Is an Enterprise Required to Obtain an MMDS License?
Under the regulations, an enterprise is required to obtain a License for Trading in Civil Cryptographic Products and Services issued by the Government Cipher Committee when engaging in activities involving the categories of products and services included in the sector-specific management list discussed above. This legal obligation specifically arises in two cases: (i) conducting the manufacture, assembly or development of hardware or software containing cryptographic functions, or commercializing such products in the market; and (ii) providing professional services relating to civil cryptography, including information protection, testing, assessment and security consulting services.
However, although the list of MMDS products and functions is specified in detail in Appendix I to Decree No. 211/2025/ND-CP, accurately determining in practice which products are subject to the business licensing requirement is not straightforward. Due to the highly technical nature of cryptography, this assessment requires a close combination of specialized knowledge, practical experience and a thorough understanding of the relevant legal regulations.
5. Conclusion
Given this complexity, enterprises trading in information technology equipment and software or providing services incorporating MMDS functions should exercise particular caution when reviewing product functions. To avoid unnecessary legal risks, such as administrative penalties, early consultation with technical experts and experienced legal advisory organizations is an essential preparatory step. The involvement of professional advisors not only helps enterprises accurately classify products under Decree No. 211/2025/ND-CP, but also ensures that the licensing process is conducted smoothly, efficiently and cost-effectively.
About the Author & Ecosystem: The article is legally supported by CDLAF and by the expertise of CFT Solutions – a company specializing in Finance – Tax – Accounting. We provide comprehensive management solutions that help enterprises control risks and optimize resources.
📩 BOOK A CONSULTATION WITH CDLAF’S LEGAL TEAM
Do not let procedural errors disrupt your business plans. Contact CDLAF today to receive a preliminary risk assessment from our team of Lawyers and E-commerce Legal Experts:
Hotline/Zalo: [+84 909 668 216]
Email: info@cdlaf.vn
Why choose CDLAF’s service?
- We provide effective and comprehensive legal solutions that help you save money and maintain compliance in your business;
- We continue to monitor your legal matters even after the service is completed and update you when there are any changes in the Vietnamese legal system;
- Our system of forms and processes related to labor and personnel is continuously built and updated and will be provided as soon as the customer requests it;
- As a Vietnamese law firm, we have a thorough understanding of Vietnam’s legal regulations, and grasp the psychology of employees, employers, and working methods at competent authorities;
- CDLAF’s team of lawyers has many years of experience in the field of labor and enterprises, as well as human resources and financial advisory.
- Strict information security procedures throughout the service performance and even after the service is completed.
You can refer for more information:
- Transferring Employees to Perform Other Works: Key Considerations for Enterprises
- Lawful Labor Discipline: Procedures and Key Notes for Enterprises
- Non-Compete Agreements In Employment Relationships: Are They Enforceable In Vietnam?
- Determining “Serious Damage” in Disciplinary Dismissal
- What Must Social Networks and Online Platforms Do to Comply with the Personal Data Protection Law 2025?
