DPO Radio
AesirX ComplianceOne | Vietnam Draft Data Security Law
VIETNAM DATA SECURITY LAW [DRAFT]
Prepare Evidence for National Data Security and Sovereignty
Organize classification, lifecycle controls, data-flow reviews, monitoring, and assurance readiness as the proposal develops.
Why the Draft Data Security Law Matters
Resolution 07/2026/UBTVQH16 added the Draft Law on Data Security to Vietnam's 2026 legislative program for consideration at the National Assembly's second session in October 2026. That schedule is a legislative-program milestone, not an effective date.
On 23 September 2026 the National Assembly Standing Committee gave its opinion on the Government's bill: six chapters and 25 articles. The bill is more specific than the earlier dossier. It links the proposed risk levels to lists that already exist, names one ministry as the focal point for assurance, gives the post-quantum roadmap a narrow scope and a date, and sets a revenue-based maximum fine. Every one of those is still a proposal. The bill's text has not been published, so ComplianceOne reads it from the Government's official report of the meeting.
The Ministry of Public Security policy-codification dossier frames data as a national resource and links data security with digital sovereignty, national security, social order, resilience, and long-term technology autonomy. The material remains a draft and may change before adoption.
The proposal would create a broad operating challenge for organizations processing data in Vietnam or processing Vietnamese data from abroad. Data governance, cybersecurity, privacy, AI, vendor, platform, and infrastructure teams may need coordinated evidence covering classification, controls, storage, transfers, personnel, monitoring, and incidents.
ComplianceOne keeps this work in a clearly identified readiness track. Teams can assess exposure and build reviewable evidence while preserving the difference between proposed rules and current legal obligations.
What the Law Covers
show_des
Dimension
Coverage
Instrument
Draft Law on Data Security: a Ministry of Public Security bill of six chapters and 25 articles, added to the 2026 legislative program by Resolution 07/2026/UBTVQH16 and reviewed by the National Assembly Standing Committee on 23 September 2026 ahead of the October 2026 session. It is not legislation: no instrument number or effective date exists
National data sovereignty
Jurisdiction, national interests, data assets, foreign-platform dependencies, and domestic technology resilience
Level 1 - Ordinary data
Open and routine operational data without sensitive elements, supported by baseline security. The bill proposes that the data owner decides Levels 1 and 2 itself and is responsible for that decision, with no administrative procedure
Level 2 - Internal data
Personal data, trade secrets, and proprietary processes requiring policy, access, and risk controls
Level 3 - Important data
Key-sector and large shared datasets with serious economic, public-interest, or social-order impact. The bill proposes reusing the Data Law's important-data list for Level 3 and its core-data list for Level 4, with no separate list
Level 4 - Core data
Data linked to political life, defense, national security, and the highest strategic interests
Aggregation
Upward reclassification where accumulated data changes the potential impact
Lifecycle security
Collection, creation, storage, transmission, processing, sharing, provision, and destruction
Cross-border data flows
Classification-based screening, impact and recipient assessment, storage, and proposed approval pathways. The bill's Article 17 would restrict transfers by risk level on objective, transparent and non-discriminatory criteri
Assurance and resilience
Monitoring, audit, risk labels, conformity readiness, personnel, training, incidents, and recovery. The bill would bring data inventory, impact assessment, audit and certification under the Ministry of Public Security as a single focal point
Post-quantum roadmap (proposed)
Transition to quantum-resistant cryptography no later than 1 January 2035, only for Level 4 data held by Party, State and armed-forces bodies. The bill proposes no post-quantum date for any other organization
Maximum fine (proposed)
Up to 5% of revenue in Vietnam or of global revenue, depending on the case, for serious violations that cause Level 3 or Level 4 data to be leaked, taken or destroyed. The bill also proposes leniency for small enterprises and innovative start-ups. This is a proposal and is not a fine anyone can face today
Government drafting directions (Resolution 257/NQ-CP, 28 August 2026)
Reconcile the four data-security risk levels with the Data Law importance classification and the cybersecurity-law information-system levels; complete a risk-tiered cross-border transfer mechanism compatible with international commitments; keep the draft consistent with the Cybersecurity, Data and Personal Data Protection Laws; justify the post-quantum cryptography roadmap and a proposed maximum fine of up to 5% of revenue; define emergency-measure conditions, authority and duration in the law itself. Official directions to the drafters — not obligations
For proposed overseas transfers, the draft describes stricter treatment for Important and Core Data. These pathways remain draft readiness considerations and are not presented as final filing procedures.
The Government's 28 August 2026 resolution confirms the direction of travel — a second, risk-based cross-border control layer extending beyond personal-data transfers — and confirms that the draft's overlaps with existing classification schemes are still unresolved. ComplianceOne therefore keeps the three schemes linked but separate, records the inputs a risk-tiered rule would read, and treats the proposed revenue-based penalty and the post-quantum roadmap as proposals under review rather than requirements.
The Standing Committee review on 23 September 2026 moved the draft further in the same direction. The committee that examined the bill asked for the risk levels to work fully with the five information-system security levels under the Cybersecurity Law and with the Data Law's classification. ComplianceOne keeps each level as its own entry and records any link between schemes as a cross-mapping a named person makes. For Levels 1 and 2 it keeps the owner's own decision, with the reason, who made it and when. For Levels 3 and 4 it records which entry on the Data Law list the level rests on. It never copies the Data Law list into the draft levels, and never works out a draft level from the Data Law classification on its own.
How ComplianceOne Supports the Draft Data Security Law
Teams can inventory datasets, assign accountable owners, record the proposed Level 1-4 classification with rationale, and trigger reassessment when aggregation or use changes potential impact. Each information system can be linked to the highest data level it processes and the security evidence used to support that alignment.
Lifecycle reviews connect collection, storage, transmission, sharing, and destruction controls with policies, access decisions, responsible personnel, training, monitoring, incidents, and recovery. Department contributors can provide evidence while central reviewers retain decision and approval history.
Cross-border screening can branch according to classification, destination, recipient conditions, personal-data overlap, and proposed authority pathways. Security impact and recipient assessments remain connected to approval readiness and post-transfer monitoring.
AI training-data legality, algorithm transparency, deepfake and misuse controls, controlled testing, and certification readiness can be linked without duplicating the separate AI Law operating workflows. The same approach preserves connections with the Data Law, personal data protection law, Cybersecurity Law, the electronic identification and authentication draft, Electronic Transactions, telecommunications, and e-commerce rules.
Related Modules
Data Discovery
Identifies datasets, sources, systems, owners, and material changes.
Explore Data Discovery
Data Classification
Records Level 1-4 rationale, aggregation review, and approval history.
Explore Data Classification
Data Mapping
Connects lifecycle stages, storage, recipients, systems, and cross-border flows.
Explore Data Mapping
Monitoring Programs
Coordinates recurring review, control testing, training, and assurance evidence.
Explore Monitoring Programs
Incident Operations
Preserves detection, containment, recovery, decisions, and closure evidence.
Explore Incident Operations
Audit TrailCompare the Difference
Without Structured Framework Operations
With ComplianceOne
Dataset inventories lack consistent ownership and classification rationale.
Every dataset has an owner, proposed classification, rationale, and review history.Aggregated data keeps an outdated lower classification.Aggregation and material changes can trigger upward reassessment.System security evidence is disconnected from the highest data level processed.System controls remain linked to the highest data level and supporting evidence.Cross-border reviews miss classification, recipient, or personal-data context.Transfer readiness joins classification, impact, recipient, approval, and monitoring records.Policy, personnel, training, monitoring, AI, and incident evidence remains fragmented.Draft status, legislative milestones, sources, and later changes remain traceable.Built for Compliance Operations
The proposal is held as eighteen separate readiness records rather than a single watch item, so an organization can see which parts of it would reach it. Data classification accounts for five of them. Two cover the four-level scheme and the aggregation rule that can push a dataset into a stricter level than any of its parts. The other three cover the cross-mapping between schemes, the owner's own decision for Levels 1 and 2, and the Data Law list entry behind Levels 3 and 4.
Two requirements concern algorithms rather than datasets: proposed algorithm transparency and the legality of AI training data. Those are tracked against the same readiness record as an organization's existing AI governance work, so a proposal that would change how models are documented does not arrive as an unconnected surprise.
Because the proposal may still change, readiness records are organization-created working documents. The platform holds no government form, fine amount, procedure, or effective date for this draft, and the October 2026 legislative session is recorded as a milestone to watch — never as a compliance deadline.
Related Content
See Data Security Compliance in Action
See how ComplianceOne structures classification, lifecycle, transfer, monitoring, and incident evidence without overstating the draft's legal status.
Ronni K. Gothard Christiansen - Technical Privacy Engineer & CEO
Technical Compliance Expert, 32+ Years Open Source Advocate, X-BoD Open Source Matters Inc.
People Also Ask
No. The National Assembly Standing Committee reviewed the bill on 23 September 2026, and it is scheduled for the October 2026 session. Neither date is an effective date, and the bill's text has not been published.
The proposal describes Ordinary, Internal, Important, and Core Data, with progressively stronger security and data-flow controls based on potential impact. The bill reviewed on 23 September 2026 proposes that data owners decide Levels 1 and 2 themselves, with no administrative procedure. Levels 3 and 4 would reuse the Data Law's lists of important and core data rather than a new list.
Only if the bill is enacted as reviewed, and only for Level 4 data held by Party, State and armed-forces bodies. For that data it proposes completing the move to quantum-resistant cryptography by 1 January 2035. It proposes no post-quantum date for anyone else. ComplianceOne can hold an inventory of your cryptographic assets as readiness material, but it starts no clock from that inventory.
The draft proposes reassessing lower-level data when accumulation or aggregation increases potential harm to national security, social order, public interests, or individual rights.
It proposes classification-based controls, including stronger screening and approval pathways for Important and Core Data. ComplianceOne treats these as readiness considerations until final law and procedures are verified.
It connects dataset inventory, classification, lifecycle controls, system alignment, transfer assessments, personnel, training, monitoring, AI evidence, incidents, and source-traceable review history.
Next Steps
Start a Compliance Pilot
Test data classification, lifecycle, transfer, and monitoring readiness with your team.
Discuss Your Compliance Needs
Map the draft proposal to your datasets, systems, providers, AI use, and existing Vietnam duties.
The evolution of Aesir is Aesir + 
(the Norse symbol for Necessity)"Needed in order to achieve a particular result"
♥Join the AesirX Privacy Newsletter. Stay Informed. Stay Compliant.
