Comments
While there are a number of updates, these do not address key concerns such as the importation of civil encryption products for self-use and the advance ruling on civil encryption products.
In more detail
1. Certain documents no longer required when applying for a Business License
The Draft Decree no longer requires an applicant to submit the education and professional certificates of the management/operation/technical staff, but the human resources requirement remains unchanged. Therefore, the removal of such documents is not significant. In addition, the copy of the Enterprise Registration Certificate or Investment Registration Certificate, which is also not a significant document, is no longer required.
2. Conformity Certificate (Type Approval Certificate) now optional in Export/Import Permit applications
Though not specified in the relevant provision, the Business License is still a condition when applying for an Export/Import Permit. However, the Conformity Certificate for civil encryption products is now optional.
3. Acceptance of Conformity Certificate issued by foreign testing agencies
The Draft Decree presents a new section on Conformity Certification. The most notable change is that NACIS may now accept test results from foreign labs. However, it is still the NACIS's discretion to decide if testing results by foreign labs are acceptable as the Draft Decree does not provide specific rules or procedure, or refer to any specific legislations, for the foreign lab recognition.
4. Administrative penalty
The Draft Decree sets forth the maximum monetary fine at VND 200 million, which is four times the threshold in Decree No. 58/2016/ND-CP. The Draft Decree also provides additional penalties and remedial measures such as the forcible confiscation of products.
5. List of products subject to the Business License requirement
The list basically remains unchanged. However, there are some changes in the list of products not subject to the Business License. In particular, the Draft Decree adds a number of products not subject to the Business License. The Draft Decree still does not explicitly clarify if the list of products not subject to the Business License also applies to the Export/Import Permit.
6. List of products subject to Export/Import Permit
Please find below the non-exhaustive comparison table of certain products:
| Products |
Current encryption function under Decree No. 32/2023/ND-CP |
New encryption function under the Draft Decree |
| Smartphones |
The product has at least one of the following functions: analog or digital voice security; wired voice security. |
The product uses security protocols (ZRTP, SRTP, WebRTC, SIPS) or VPN channels (IPSec, SSL/TLS, L2TP) to secure audio, images and video. In particular, symmetric encryption algorithms, asymmetric encryption algorithms, digital signature algorithms, and cryptographic hash functions are used. |
| Computer/laptops |
The product has at least one of the following functions: generate cryptographic keys; manage or store cryptographic keys; ensure IP stream security and channel security. |
The product uses secure VON technology (IPSec VPN, TLS VPN) to ensure safety and security of data transmission and reception on the IP network environment. In particular, symmetric encryption algorithms, asymmetric encryption algorithms, digital signature algorithms, and cryptographic hash functions are used to secure and authenticate information transmitted and received on the IP network environment. |
