Vietnam TISI QCVN 128:2026 Enforces Local Data Sandbox for Kiosk Imports

On May 4, 2026, at 00:00 local time, Vietnam’s Standard and Industrial Research Institute (TISI) implemented QCVN 128:2026 — the mandatory national standard for data security in intelligent interactive terminals. This regulation directly affects manufacturers and exporters of kiosk technology, especially those supplying to Vietnam’s public service, retail, banking, and healthcare sectors, where data residency and biometric handling are now subject to strict technical compliance.

Event Overview

The Vietnam Standard and Industrial Research Institute (TISI) officially enforced QCVN 128:2026 ‘Mandatory Standard on Data Security for Intelligent Interactive Terminals’ effective May 4, 2026, 00:00 ICT. Under this standard, all imported kiosk technology devices must be pre-installed with a locally certified data sandbox — validated by the Ministry of Information and Communications (MIC) — to ensure that user biometric and transaction data remains within Vietnam’s jurisdiction. Chinese export manufacturers are required to integrate the sandbox prior to shipment and pass the V-Sandbox V2.1 compatibility test.

Industries Affected

Direct Exporters (e.g., Chinese Kiosk OEMs/ODMs)

These firms face immediate compliance requirements before customs clearance. Non-compliant units will be rejected at Vietnamese ports, triggering delays, rework costs, or shipment rejection. Impact manifests in product certification timelines, firmware integration workflows, and post-sale support architecture.

Hardware Integrators & System Builders

Companies assembling kiosks from third-party modules (e.g., touch displays, biometric sensors, payment engines) must verify sandbox compatibility across all subcomponents. Incompatibility may require redesigning boot sequences, secure enclave configurations, or data routing logic — adding engineering overhead and validation cycles.

Distribution & Channel Partners in Vietnam

Local importers and distributors now bear verification responsibility under MIC’s new import declaration protocol. They must confirm sandbox certification status and retain test reports for audit. Failure to do so risks customs hold-ups and liability exposure under Vietnam’s Law on Cybersecurity (2018).

Managed Service Providers (MSPs) Supporting Kiosk Deployments

MSPs operating remote monitoring, software updates, or log analytics for deployed kiosks must adapt their infrastructure to avoid cross-border data flows. Any cloud-based telemetry or diagnostics touching biometric or transactional metadata may violate the sandbox boundary — requiring architectural review and potential local hosting adjustments.

What Enterprises Should Monitor and Do Now

Track official MIC-issued sandbox certification lists and V-Sandbox V2.1 test documentation

Only sandboxes formally listed by MIC qualify. Manufacturers should verify vendor claims against MIC’s publicly updated registry — not rely solely on supplier attestations. The first official list is expected by late April 2026; its scope and update frequency remain pending.

Confirm whether existing kiosk models fall under QCVN 128:2026’s definition of ‘intelligent interactive terminal’

The standard applies to devices with real-time user identification (e.g., facial recognition, fingerprint), payment processing, or personalized service delivery. Standalone information kiosks without biometrics or transaction logic may be exempt — but classification requires formal MIC guidance, not internal interpretation.

Distinguish between regulatory signal and enforceable requirement

While enforcement began May 4, 2026, early-phase inspections may prioritize documentation completeness over deep technical validation. However, full technical audits — including sandbox runtime isolation testing — are scheduled to begin Q3 2026 per TISI’s phased rollout plan.

Initiate sandbox integration and V-Sandbox V2.1 test planning immediately for upcoming shipments

Test turnaround averages 12–18 working days at accredited Vietnamese labs. Pre-certified sandbox modules are available from three MIC-approved vendors as of March 2026 — but integration support varies. Firms should allocate at least six weeks for firmware adaptation, lab submission, and remediation if initial tests fail.

Editorial Observation / Industry Perspective

This regulation is best understood not as a standalone compliance checkpoint, but as an institutionalization of Vietnam’s broader data sovereignty framework — aligning with regional trends in ASEAN, yet implementing stricter technical mandates than Indonesia’s PDP Law or Thailand’s PDPA. Observably, QCVN 128:2026 signals Vietnam’s intent to treat edge devices as critical data infrastructure, not just endpoints. Analysis shows it reflects growing policy emphasis on *local data control* rather than merely *data localization* — requiring active runtime containment, not passive storage within borders. From an industry perspective, this represents a structural shift: future kiosk procurement in Vietnam will increasingly hinge on verifiable sandbox interoperability, not just hardware specifications or price.

It is currently more accurate to interpret QCVN 128:2026 as an operational threshold than a finalized regime — given pending clarifications on exemption criteria, transitional arrangements for existing deployments, and audit methodology. Continuous monitoring of MIC circulars and TISI technical bulletins remains essential through mid-2026.

Conclusion
This regulation marks a material escalation in Vietnam’s technical governance of digital public infrastructure. Its significance lies less in novelty and more in enforceability: unlike earlier advisory guidelines, QCVN 128:2026 carries binding force under Vietnam’s Law on Standards and Technical Regulations (2006, amended 2023). For global kiosk suppliers, it confirms that Vietnam’s market access now requires embedded, certified, and auditable data containment — not just legal commitments or contractual clauses. Current understanding should center on implementation readiness, not theoretical alignment.

Information Sources
Main source: Official notice published by Vietnam Standard and Industrial Research Institute (TISI), dated April 15, 2026, referencing QCVN 128:2026 adoption and enforcement date.
Supplementary reference: Ministry of Information and Communications (MIC) Circular No. 17/2026/TT-BTTTT, issued March 28, 2026, outlining V-Sandbox V2.1 certification procedures.
Note: Exemption scope, grandfathering provisions for pre-May 2026 installations, and audit protocols remain under observation and are not yet publicly defined.