AesirX ComplianceOne | Vietnam Draft Data Security Law

Why the Draft Data Security Law Matters

Resolution 07/2026/UBTVQH16 added the Draft Law on Data Security to Vietnam's 2026 legislative program for consideration at the National Assembly's second session in October 2026. That schedule is a legislative-program milestone, not an effective date.

The Ministry of Public Security policy-codification dossier frames data as a national resource and links data security with digital sovereignty, national security, social order, resilience, and long-term technology autonomy. The material remains a draft and may change before adoption.

The proposal would create a broad operating challenge for organizations processing data in Vietnam or handling data connected with Vietnam. Data governance, cybersecurity, privacy, AI, vendor, platform, and infrastructure teams may need coordinated evidence covering classification, controls, storage, transfers, personnel, monitoring, and incidents.

ComplianceOne keeps this work in a clearly identified readiness track. Teams can assess exposure and build reviewable evidence while preserving the difference between proposed rules and current legal obligations.

What the Law Covers

Dimension

Coverage

National data sovereignty

Jurisdiction, national interests, data assets, foreign-platform dependencies, and domestic technology resilience.

Level 1 - Ordinary data

Open and routine operational data without sensitive elements, supported by baseline security.

Level 2 - Internal data

Data requiring organizational protection through access, governance, and risk controls.

Level 3 - Important data

Data requiring heightened protection because of its potential economic, public-interest, or social-order impact.

Level 4 - Core data

Data linked to national defense, national security, and other strategic national interests.

Aggregation

Upward reclassification where accumulated data changes the potential impact.

Lifecycle security

Collection, creation, storage, transmission, processing, sharing, provision, and destruction.

Cross-border data flows

Classification-based screening, impact and recipient assessment, storage, and proposed approval pathways.

Assurance and resilience

Monitoring, audit, risk labels, conformity readiness, personnel, training, incidents, and recovery.

The policy dossier proposes a four-level classification model that may change during the legislative process.

For proposed overseas transfers, the draft describes stricter treatment for Important and Core Data. These pathways remain draft readiness considerations and are not presented as final filing procedures.