Vietnam is drafting a new Data Security Law. The Ministry of Public Security has prepared it, and it is expected to be submitted to the 16th National Assembly at its second session. The law aims to protect national data sovereignty and to secure data through its whole lifecycle, from collection and storage to processing, transmission and destruction.
The draft is based on risk. Instead of applying the same requirements to all data, it sets five risk levels, from Level 1 (lowest) to Level 5 (highest). The level depends on how likely a security incident is and how much damage it could cause to national defence, national security, public order and the rights of people and organisations. The higher the level, the stricter the rules. Levels 1 and 2 involve little or no administrative procedure. From Level 3, data controllers must carry out impact assessments and periodic audits. Levels 4 and 5 need a data security appraisal before the systems can start operating. These levels do not change who owns the data or has the right to use it.
The draft also tries to reduce duplicate compliance work. Personal data rules stay under personal data protection legislation, data classification stays under the Law on Data, and system security stays under cybersecurity law. It also says the same entity and the same risk issue should be assessed or inspected only once.
For cross-border data transfers, the requirements depend on the risk level. Most low-risk data can move with few procedures, while higher-risk data faces tighter controls. The draft also protects Vietnamese organisations and individuals from foreign requests for direct access to data that bypass lawful channels.
The law also covers AI and new technologies. Organisations working with high-risk data must build in security from the design stage and make sure the data comes from lawful sources and stays intact. Data security checks for AI systems will be part of AI risk assessments, with no separate paperwork. Authorities cannot demand source code or AI model weights, except for criminal investigations.
Responsibility extends to the supply chain. Data controllers must assess risks and limit suppliers’ access before connecting to their systems. Contracts must set out confidentiality duties and penalties for data leaks. Controllers must monitor access and cancel permissions when a risk or incident appears, with tighter control of remote access for high-risk systems.
The state also plans to support sovereign cloud, data infrastructure and secure, sustainable data centres. Incentives are proposed for research in data security and post-quantum cryptography. SMEs and startups will get self-assessment tools, guidance and training, and measures that create monopolies for particular suppliers will be banned.
