The draft Data Security Law, prepared by the Ministry of Public Security, aims to establish national data sovereignty and protect data throughout its entire lifecycle. It is expected to be submitted to the 16th National Assembly at its second session.

The proposed legislation covers a broad range of issues, from general principles and specific protection mechanisms to security resources and state management responsibilities. Several core provisions define the overall approach of the proposed law.

At the heart of the draft is a risk-based regulatory model, reflecting an approach increasingly adopted by countries and international organizations in data governance and cybersecurity. Rather than imposing identical requirements on all types of data, the framework would tailor compliance obligations to the actual risks that data processing activities could pose to society.

From a legal perspective, this approach applies the principle of proportionality, a fundamental concept in modern legal systems under which the extent of government intervention should correspond to the level of risk being addressed.

The principle is intended to avoid two undesirable extremes: insufficient oversight of increasingly sophisticated data security threats, and blanket controls that waste government supervisory resources while imposing unnecessary compliance costs on organizations handling low-risk data.

Scope of regulation and relationship with existing legislation

The draft clarifies how the proposed Data Security Law would interact with other legislation.

Rules governing the principles and conditions for processing personal data, along with the rights of personal data subjects, would continue to fall under personal data protection legislation.

The development, governance, exploitation, sharing and classification of data according to its importance would remain subject to the Law on Data.

Cybersecurity protection for information systems would continue to be governed by cybersecurity legislation, while the proposed Data Security Law would focus on protecting the security of data itself throughout its lifecycle.

This division is intended to prevent organizations and businesses from having to complete overlapping administrative procedures for the same regulatory matter.

The draft also establishes a principle that the same entity and risk-related issue should be subject to assessment, appraisal or inspection only once.

Five levels of data security risk

The proposed legislation establishes five data security risk levels, ranging from Level 1, the lowest, to Level 5, the highest.

Risk classifications would be determined by the likelihood of security incidents and the potential damage they could cause to national defense, national security, public order and safety, as well as the lawful rights and interests of organizations and individuals.

The higher the risk level, the stricter the protection obligations.

Data classified at Levels 1 and 2 would generally involve little or no administrative procedures. From Level 3 upward, data controllers would be required to conduct impact assessments and periodic audits.

Data at Levels 4 and 5 would require a data security appraisal before the relevant systems could officially begin operations.

Under the draft, risk-level classification would not replace data classification under existing data legislation. Nor would it alter the ownership, management, exploitation or usage rights of organizations and individuals.

This distinction is designed to ensure that data security regulations do not interfere with legitimate property rights associated with data.

Lifecycle protection and cross-border data transfers

The draft seeks to protect data throughout its entire lifecycle, from collection and storage to processing, transmission and eventual destruction.

It also proposes tighter controls on cross-border data transfers, with requirements differentiated according to risk levels to safeguard national data sovereignty.

Under the proposed framework, protection and oversight requirements would increase in proportion to the risks associated with the data.

Most low-risk data would be allowed to flow relatively freely, with administrative procedures kept to a minimum. Higher-risk data, meanwhile, would face correspondingly stricter controls.

The draft also introduces mechanisms to protect domestic organizations and individuals against foreign requests for direct access to data that bypass lawful channels.

These provisions are intended to uphold national sovereignty and security while remaining consistent with international practices on mutual legal assistance.

The development and adoption of the Data Security Law are presented as more than an effort to fill a gap in Vietnam's legal framework.

The legislation represents a strategic shift in national data governance, moving away from a reactive approach focused on responding to incidents toward proactive prevention and risk management from the outset.

It is also intended to strengthen national data sovereignty during digital transformation while building trust and creating opportunities for individuals, businesses and the domestic data protection industry to contribute to Vietnam's digital economy.

Preventing, monitoring and responding to data security incidents

The draft establishes a framework for proactively preventing, monitoring and responding to data security incidents.

It seeks to equip state authorities with the tools needed to respond promptly to serious incidents while strictly limiting the scope and conditions under which intervention measures may be applied.

Under the proposed principles, measures that restrict rights would be permitted only when supported by clear grounds.

Authorities would be required to prioritize the least restrictive measures, specify their duration and provide mechanisms for reporting and oversight.

Organizations and individuals would retain the right to submit petitions, lodge complaints, initiate legal proceedings and seek compensation if measures were applied unlawfully.

Data security requirements for emerging technologies and AI

The proposed law also addresses data security challenges associated with emerging technologies and artificial intelligence.

Organizations and individuals involved in researching, developing or deploying new technologies and AI systems that process high-risk data would be responsible for incorporating security protections from the design stage.

They would also have to ensure that the data used in these systems came from lawful sources and maintained its integrity.

To avoid overlapping regulatory procedures, data security assessments for AI systems would be integrated into risk assessment processes under AI legislation.

Separate documentation and independent security appraisal procedures would not be required.

The draft further stipulates that competent authorities would not be allowed to demand the handover of source code or AI model weights, except when necessary for criminal investigations.

This provision is intended to balance regulatory oversight with the protection of businesses' trade secrets and proprietary technologies.

Data security responsibilities across supply chains

The draft extends data security responsibilities across the entire supply chain of data-related products and services, rather than limiting them to an organization's internal operations.

Data controllers would be required to assess risks and restrict suppliers' access to data before establishing connections with their systems.

Contracts would need to clearly define confidentiality obligations and penalties for data leaks.

Data controllers would also be responsible for proactively monitoring access and revoking permissions when risks or security incidents were detected.

For high-risk data processing systems, the proposed framework calls for tighter controls over remote access by service providers.

The approach is designed to ensure that security risks are managed across intermediaries and third parties involved in data processing, which are often vulnerable points in existing data security arrangements.

Developing infrastructure, technology and skilled personnel

The draft outlines state policies to promote the development of data security infrastructure, technologies and human resources while aligning these efforts with national security objectives.

Priority would be given to sovereign cloud computing, data infrastructure and secure, environmentally sustainable data centers capable of withstanding disruptions and recovering from incidents.

The proposed policies also include investment and tax incentives for research and development in data security technologies, security cryptography and post-quantum cryptography.

Small and medium-sized enterprises and innovative startups would receive support to improve their data security capabilities through self-assessment tools, guidance, training and shared services.

At the same time, the draft establishes a principle prohibiting measures that create monopolistic positions for particular products or suppliers.

This is intended to maintain fair competition as Vietnam develops its domestic data security industry.

Taken together, the proposed provisions reflect an effort to strengthen national security and data sovereignty while minimizing disruption to lawful production and business activities.

The draft Data Security Law is expected to provide a legal foundation for the development of Vietnam's data economy and broader digital economy in the years ahead.

Ngan Anh