Article
Vietnam data law 2024: what it covers and who it affects
Published
Vietnam data law 2024 is a draft Law on Data that the National Assembly is debating right now. It would be a new national law on data. It covers how data is collected, shared, stored and sent abroad, and it sets stricter rules for two new groups called core data and important data. The draft has not been passed yet, so details may still change. This note explains what the draft says and which organisations should pay attention.
Sources: Vietnam News Agency report on the National Assembly debate, published by Quan Doi Nhan Dan (En.qdnd.vn), November 2024; Linklaters DigiLinks, "Vietnam's Draft Data Law: Key Takeaways for Multinational Companies", 29 August 2024.
Where the draft stands
The Ministry of Public Security wrote the draft and put it out for public comment in mid-2024. The government then sent it to the 15th National Assembly, which is holding its eighth session this autumn. Lawmakers discussed the bill in the hall on 8 November 2024.
Deputy Minister of Public Security Nguyen Ngoc Lam told deputies that the draft has seven chapters and 67 articles. He said the ministry counted 69 existing laws that touch on databases. Those laws refer to 33 national databases and 39 specialised databases. The goal is to bring order to this patchwork and to make better use of public data for the economy.
Sources: En.qdnd.vn, "Lawmakers debate draft Data Law on Nov. 8", November 2024; VnEconomy, "Draft Law on Data regulates the establishment of National Data Center", 26 October 2024; KPMG Vietnam, "Vietnam draft Data Law", July 2024.
What the draft covers
The draft is wide. It deals with personal data and with data that is not personal, such as business and government records. It sets principles for handling data and for state management of data. It also covers international cooperation on data and a list of banned acts.
The draft also sets rules for data services. Selling, brokering and analysing data have had little regulation in Vietnam so far. Linklaters notes that the draft is seen as one answer to the illegal sale of personal information. The draft defines many types of data processing, including sharing, analysis, access, transfer, encryption, copying and deletion. This shows the ministry wants to regulate data use in business and in government.
Sources: Linklaters DigiLinks, 29 August 2024; KPMG Vietnam, "Vietnam draft Data Law", July 2024; En.qdnd.vn, November 2024.
Core data and important data
The draft creates two special groups. Core data is data with wide coverage across sectors, groups and regions. If it were misused, it could directly harm political security. It includes data tied to national security, key economic activity and essential public services.
Important data is information that could put national security, the economy, social stability or public health at risk if it were leaked, changed or destroyed. Lawyers who have studied the draft point out that both ideas look like those in China's data laws. They also warn that these groups are hard to define. The draft leaves the exact lists to later rules, so firms cannot yet know which of their data will count.
Sources: Linklaters DigiLinks, 29 August 2024; KPMG Vietnam, "Vietnam draft Data Law", July 2024.
Sending data abroad
Moving core data or important data out of Vietnam would need approval from the right authority, such as the Prime Minister's Office or the Ministry of Public Security. The sender would also need to pass a government security assessment or sign a standard contract set by the state.
Linklaters says the draft does not yet explain how the assessment would work or what the standard contract must say. Firms that move data between Vietnam and a head office abroad are waiting for guidance. Until it arrives, they cannot plan how this would affect their group contracts.
Sources: Linklaters DigiLinks, 29 August 2024; KPMG Vietnam, "Vietnam draft Data Law", July 2024.
The National Data Center and data sharing
The draft sets out how to build a National Data Center. It would act as a hub to store, combine, analyse and coordinate data for ministries, agencies and local governments. The draft also covers a national integrated database and a data development fund.
Linklaters reports that public and private bodies could use data held there under set conditions. These include approval from the centre and, in some cases, the consent of the person the data is about. The draft also lets agencies request data from firms and individuals only in special cases, such as an emergency. KPMG notes that the agency must use the data only for the stated purpose and delete it when it is no longer needed.
Sources: VnEconomy, 26 October 2024; Linklaters DigiLinks, 29 August 2024; KPMG Vietnam, July 2024.
Who is affected, and what to do now
The draft applies to agencies, organisations and individuals that take part in data activities in Vietnam. It does not clearly say whether it reaches firms based abroad. Many observers expect that it will, following Vietnam's recent legal trend.
The groups most likely to feel it are these:
- Foreign and local firms that hold large amounts of customer or business data.
- Companies that send data to group offices or cloud services outside Vietnam.
- Businesses that buy, sell or analyse data as a service.
- Technology and platform firms that may be asked to share data with agencies.
Because the text is still a draft, the practical step is to prepare. Map where your data is kept, note what flows across the border, and review your contracts with overseas partners. Then watch for the final text and the guiding rules that follow it. This note is general information and not legal advice.
Sources: Linklaters DigiLinks, 29 August 2024; KPMG Vietnam, July 2024.