Consumer products and retail

June 2026 - Electrical & electronics

Approved – Effective from 1 July 2026

On 12 May 2026, Vietnam’s Ministry of Public Security issued Circular No. 48/2026/TT-BCA, introducing National Technical Regulation QCVN 11:2026/BCA, which establishes baseline cybersecurity requirements for Internet Protocol (IP)-based surveillance cameras. The regulation will take effect on 1 July 2026, replacing both Circular No. 21/2024/TT-BTTTT and QCVN 135:2024/BTTTT.

The regulation applies to both domestic and foreign organizations and individuals involved in the manufacture, import, or distribution of IP surveillance cameras in Vietnam. QCVN 11:2026/BCA specifies mandatory cybersecurity requirements covering the following areas:

• Devices must use either unique passwords for each unit or user-defined passwords generated through mechanisms that are resistant to automated attacks. Authentication methods must implement industry-recognized cryptographic practices.
• Manufacturers are required to publish a vulnerability disclosure policy, including contact information and defined response timelines.
• Cameras must support secure software updates with mechanisms to verify integrity and authenticity. Manufacturers must disclose support periods and provide users with update capabilities.
• Sensitive security parameters must be securely stored within device memory, and hard-coded critical security parameters must be protected from unauthorized access or use.
• All communication channels must employ industry-standard cryptographic protection, and manufacturers must implement lifecycle management processes for critical security parameters.
• Unused network and logical interfaces must be disabled. During initialization, devices should limit the disclosure of security-related information until authentication is successfully completed. Debug interfaces that are physically accessible must be capable of being disabled through software.
• Sensitive personal data exchanged between cameras and related services must be encrypted appropriately. Any external sensing functions must be clearly documented for users.
• Devices must be capable of recovering from network interruptions and power outages, reconnecting in a stable and controlled manner.
• Users must be provided with functionality to delete their data stored on the device.
• Data received from all input sources must be validated before processing.
• Manufacturers must disclose what personal data is collected, the purpose of collection, processing methods, and storage practices. Devices must support user consent and consent withdrawal mechanisms, and data storage settings must allow data retention within Vietnam.
  
  

Conformity assessment requirements will apply to medium- and high-risk products once the Ministry of Public Security publishes the relevant product risk classification list:

• Medium-risk products may undergo self-assessment based on testing results issued by designated testing organizations or recognized international conformity assessment bodies.
• High-risk products must obtain certification from an independent third-party certification body.
• Manufacturers and other responsible organizations must retain conformity assessment records and make them available upon request or during market surveillance activities.
  
  

The Circular will become effective on 1 July 2026. Manufacturers, importers, and distributors of medium- and high-risk IP surveillance cameras will be required to complete a conformity declaration (công bố hợp quy) in accordance with QCVN 11:2026/BCA after the Ministry of Public Security publishes the applicable product risk classification list, as stipulated in Article 2(3) of the Circular and Section 4.1 of QCVN 11:2026/BCA.

References:
[1] Vietnam official publication - Circular no. 48/2026/TT-BCA

 

 

How does this impact you and your business?

Contact us to discuss.

TÜV SÜD has dedicated experts to assist you in the development of consumer products and meeting applicable regulations. Through a global network of laboratories, TÜV SÜD offers a wide range of services that includes chemical tests, physical or mechanical tests as well as inspections to ensure the compliance of your products in target markets.

For enquiries, please contact us at [email protected]