You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

January 24, 2025

Draft Guidance on Vietnam’s New Data Law Open for Public Consultation

Subscribe to Updates

Following Vietnam’s adoption of the new Law on Data (“Data Law”) on November 30, 2024, there remained uncertainty as to what impact the new framework would have on businesses in Vietnam and abroad. The government has now released a package of four draft legal documents aimed at guiding the implementation of the Data Law: (1) a decree on the National Data Development Fund (“NDDF Decree”), (2) a decree related to regulations on scientific, technological, and innovation activities and data products and services (“Decree on Specific Activities”), (3) a decree detailing a number of articles and measures to implement the Data Law (“Implementation Decree”), and (4) a decision on the lists of important data and core data. This article will provide an overview of the draft legislation.

1. NDDF Decree

The draft NDDF Decree relates to the establishment, management and use of a National Data Development Fund (“NDDF”), which is a non-profit and non-budgetary state financial fund established and managed by the Minister of the Ministry of Public Security (MPS). The NDDF has legal personality and is fully state owned, operating similarly to a single-member limited liability company. Its main objectives are to support, promote, and invest in artificial intelligence (AI), the Internet of Things (IoT), and other new technologies and innovation.

The NDDF may lend to, invest in, or otherwise support eligible organizations. The draft NDDF Decree also proposes a series of regulations on donations to the NDDF and from the NDDF (through expense support), the lending activities of the NDDF to commercial banks, which will in turn lend to eligible organizations, the investment activities in data products and services innovative start-ups, and other kinds of support.

The government commits to provide VND 1 trillion (approx. USD 40 million) to the NDDF, evidencing the importance the government places on fostering a thriving ecosystem for data product and service development, and its wish to position Vietnam as a center of innovation. However, the NDDF also intends to rely on donations. It remains to be seen whether the NDDF will operate effectively to boost the technology and data-related developments.

2. Decree on Specific Activities

The Decree on Specific Activities focuses on two main matters: regulations related to data products and services, and the creation of a regulatory sandbox to foster innovation.

Data Products and Services

The chapter on data intermediary products and services of the draft Data Law had been stripped down before enactment. The details are now prescribed in this draft decree under Chapter III, covering (i) data intermediary products and services, (ii) data analysis and aggregation services, and (iii) data marketplaces.

Data intermediary activities have now been clarified and include, among others, activities of representing data subjects and data owners to connect, share, exchange, and access data with service users; data management services; data cooperation and sharing services; etc.

Providers of data intermediary products and services between the service users and the state agencies must be fully registered and licensed, while other service providers can request the MPS to appraise them to unlock the same benefits as enterprises operating in high-tech, innovative, creative start-ups and the digital technology industry.

Further, the draft Decree on Specific Activities creates new personal data protection obligations for providers of data intermediary products and services, while personal data is not the main object of the Data Law. Among the new requirements, the obligation to limit the transfer of personal data abroad and ensure that the standard of protection is equivalent to the standard required by relevant laws has been inserted. As the government is currently developing the Personal Data Protection Law (more details here), it is unclear why it is also inserting such provision under the Data Law framework.

Businesses engaged in data intermediary products and services or data analysis and aggregation will need to take into account the personnel requirements that are reinserted in the draft Decree on Specific Activities. The head of the organization must be a Vietnamese citizen and permanent resident, with a university degree, who has directly managed a large scale data center and has at least three years of experience related to data management. This poses a significant issue for industry players, considering talent is scarce on the global scene, and in Vietnam. Further, the requirement for a minimum charter capital has been replaced by a mandatory deposit in a commercial bank operating in Vietnam of VND 5 billion (approx. USD 200,000). It is still unclear whether the cross-border provision of such products and services is possible and whether foreign businesses would be subject to the same requirements. The same requirements will apply to data marketplace service providers, but this is likely to pose lesser problems considering this business activity is restricted to non-business units or state-owned enterprises.

Data analysis and aggregation services are now categorized into four levels depending on the level of human supervision and the role of the products and services in the decision-making process. Licensing requirements will apply to automated decision-making, with or without human supervision, and to products and services using data from national databases. Here again, to unlock incentives, an organization that is not subject to the licensing requirements can request the MPS to conduct an appraisal. Biannual or annual reports on service provision must be sent to the management agency, based on a statutory form.

Data marketplace service providers include providers of data auction services, but also services to provide an environment for data trading and exchange and data-related product and services, and other services related to bidding, offering, introducing, representing, supporting and other activities related to data trading. Such data marketplace service providers must ensure that the channels to receive information and the use of the services are continuous 24/7, and publicly display service charges, prices, terms of use, and applicable conditions. They must also report biannually or annually to the management agency. All data products on the data marketplace must be authenticated with data origins. Organizations and individuals are responsible for the contents they post on data marketplaces and cannot auction at a price lower than the input fee for data products and services, ensuring fair competition. It is still unclear how private organizations will be able to leverage their data with these new marketplaces.

Regulatory Sandbox

Th draft Decree on Specific Activities also suggests the establishment of the necessary regulatory framework for a sandbox for research and application of science, technology, and innovation in the construction, development, protection, administration, processing and use of data as foreshadowed by Article 24.4 of the Data Law. This sandbox would be created to promote research and create a testing environment to assess the risks, costs and benefits of innovative products and services while limiting the risk to users of such products and services.

Participating in the sandbox is subject to being granted a certificate of testing activities – details of the application procedure being further described in the draft decree. The right to participate in the sandbox does not equal the right to provide the innovative products and services on the market. For any organization that is not allowed to participate in the sandbox, they are still encouraged to innovate but must do so within the applicable regulations at the time.

The draft Decree on Specific Activities sets out the obligations and the rights of the participating organizations, but also creates exemptions from liability with the aim to encourage innovation and creativity. The Ministry of Science and Technology is notably tasked to formulate detailed regulations on such exceptions, and other mechanisms and policies to foster innovation in Vietnam.

The government’s intention appears to be giving priority to innovative solutions in AI, cloud computing, blockchain, data communication, IoT, big data and other modern technologies. The draft decree notably suggests incentives to attract talent and FDI in these sectors.

3. Implementation Decree

The draft Implementation Decree provides clarification on many outstanding issues pursuant to the Data Law, notably (i) the mandatory provision of data to state agencies upon request, (ii) the cross-border transfer of data, and (iii) data protection measures.

Mandatory Provision of Data to State Agencies

The procedure applicable to the provision of data to state agencies upon request has been clarified to a certain extent. The draft Implementation Decree sets out that ministers, heads of ministerial level agencies, and presidents of provincial-level People’s Committees are competent to request data from organizations, ensuring such requests are emanating from a high-level rank. Such requests must be made in writing, unless it is impossible, and must specify the data requested, the purpose, the processing period, the legal basis for the request, the time limit to provide the data and the sanction for not providing such data. The data handover must be recorded in minutes. However, the organization receiving the request has the right to request amendment or withdrawal of the request. The extent of the data that can be requested has not been further limited or clarified, but the requesting agencies must respect the lawful purpose of the data manager and data owner and must protect business secrets and personal secrets.

Cross-Border Transfer of Data

With an aim to clarify what is included in the definition of “core” and “important” data, the Implementation Decree provides criteria to determine the category of the data, based on its degree of impact on a specific field, group, or region that may have an impact on national defense, security, foreign affairs, macroeconomics, social stability, or public health and safety (excluding trade secrets).

“Core data” will notably comprise some sensitive governmental information like guidelines and policies of the Vietnamese Communist Party and the state on domestic and external relations; strategies and plans to protect the fatherland; organization and operations of the armed forces; data on plans for collection, exchange, and issuance of money; data on natural resources and the environment, and newly discovered microbial strains and varieties related to human health and life; processes to produce medicinal herbs and rare biological drugs; and data on inspection, examination, denunciation and prevention of corruption.

“Important data” will notably comprise information that may affect national security, the Vietnamese Communist Party, the state and the socialist regime, major overseas projects, safety of overseas energy sources, security of international cooperation, infrastructure of important economy sectors; and the life, health, honor, dignity, property, and legitimate rights of organizations and individuals. The latter being very broad, as further discussed in section (4) regarding the Decision below. Due attention should be paid to the development of the Implementation Decree and the Decision to ensure that it does not impede the free flow of data, considering Vietnam’s commitment not to restrict data flows under numerous international treaties and agreements.

The transfer of core and important data outside of Vietnam is subject to additional requirements, notably the data owner must conduct a risk assessment and establish an impact assessment dossier. For core data, the transfer can only be made once the “satisfactory assessment results” have been obtained from the MPS or the Ministry of National Defense, as the case may be. For important data, the transfer can be made when the assessment is submitted and the transferor has not received objection from the authorities within the regulated timeline, but the MPS and the Ministry of National Defense can request the data transferor to stop the transfer if the impact assessment is not sufficiently supplemented following such request from the authorities. An important point to note is that the draft Implementation Decree also restricts the disclosure of data domestically by imposing other impact assessment requirements, with stricter regulations being proposed for the sharing of core and important data.

Further, notwithstanding the category of data being transferred abroad, the data transferor must ensure the protection of the legitimate rights and interest of the data subject, national defense and security, and national interests and public interests. It must also enter into an agreement with the recipient, in which mandatory content has finally been clarified.

Data Protection Measures

Additional guidance is also provided on the measures to implement risk management related to data processing with lists of technical and organizational measures being proposed. This has long been requested by the private sector to better understand the expectations of the authorities in terms of data protection. Consequently, core and important data are subject to additional security measures. This multi-layered approach to data protection aligns with international standards and ensures that measures are implemented in accordance with the sensitivity of the related data.

In addition, the draft Implementation Decree provides that, when the data owner needs to transfer data in the context of merger, reorganization, or bankruptcy, such data owner needs to prepare a plan for such transfer and to notify impacted users via phone call, text message, email, or notice.

It is worth noting that many of the measures being imposed are inspired by best practices in personal data protection (e.g., record of processing activities, access controls, training of employees, proper deletion and destruction procedures, etc.). Although one would understand why such measures would be relevant in the case of core and important data, the requirements would be very burdensome for “ordinary” data processing. The scope of application of the Data Law (and its future guiding decrees) will cover any organization participating in or related to digital data activities. As digital data is simply data in digital form, the application scope is very broad, and the obligations far-reaching.

4. Decision on Lists of Important Data and Core Data

The draft decision lists out types of important data and core data for the implementation of the Data Law, especially the regulations on cross-border data transfer discussed above. There are 24 types of core data and 18 types of important mentioned in the decision. Enterprises will need to pay special attention to the following types of important data, among others, to ensure future compliance:

  • Data in the field of healthcare (e.g., data on the health records and biometrics of Vietnamese citizens, if 10,000 or more people are involved);
  • Data in the field of finance and budget (e.g., data on insurance contracts, insurance amounts, insurance claim records, and insurance claim amounts for 10,000 or more customers);
  • Data in the field of information and communication (e.g., data that can be used for social mobilization, internet behavior data of more than 100,000 users, etc.);
  • Basic personal data of 1 million or more people, other sensitive personal data of 10,000 or more people.

Next Steps

The draft decrees are open for public consultation until March 17, 2025, while the timeline is unclear for the draft decision. This might be the last opportunity for the private sector to advocate for a more business-friendly regulatory framework, as the Data Law is entering into force on July 1, 2025, and the guiding decrees and decision are expected to follow the same timeline.

Related Professionals

Industries

Technology

Location

RELATED INSIGHTS​ 

December 11, 2025
On December 10, 2025, the National Assembly of Vietnam passed a new Cybersecurity Law, which will take effect on July 1, 2026. The new Cybersecurity Law was developed based on the consolidation of the 2018 Cybersecurity Law and the 2015 Law on Network Information Security. While the final approved version of the new Cybersecurity Law has not yet been published, according to official reports, the following notable requirements are confirmed to be included: The new Cybersecurity Law dedicates a specific article to prohibited acts related to cybersecurity, under which it strictly prohibits posting or disseminating information online that propagandizes against the Socialist Republic of Vietnam. The law also prohibits, among other things, (i) the appropriation, trading, seizure, or intentional disclosure of information classified as state secrets, work secrets, business secrets, personal secrets, family secrets, and private life; (ii) intentionally eavesdropping, recording, or filming online conversations without authorization; and (iii) the use of artificial intelligence (AI) or new technologies to conduct prohibited acts. The Ministry of Public Security (MPS) has the authority to require enterprises providing telecommunications, internet, and online services, as well as system administrators, to remove information violating cybersecurity laws from systems under their management. The MPS is also assigned responsibility for ensuring information security in cyberspace and data security, establishing mechanisms for IP address identity management, verifying digital account registration information, and issuing warnings and sharing information on cybersecurity threats. Information systems are classified into five levels (similar to the 2015 Law on Network Information Security) based on the degree of harm to national security and social order if an incident occurs. The MPS is the lead agency assisting the government in state management of cybersecurity. The Ministry of National Defense is responsible for managing military information systems, and the Government Cipher Committee manages cryptographic and cipher
Read More
December 4, 2025
Thailand has expanded the circumstances under which state agencies may bypass competitive bidding procedures to address urgent security challenges. On November 28, 2025, Thailand’s Ministry of Finance published the Ministerial Regulation Determining Cases of Procurement by Specific Method (No. 6) B.E. 2568 in the Royal Gazette, introducing a new pathway for procuring supplies and services needed to address cyber and military threats that may affect the stability of government agencies or the nation. For technology vendors, cybersecurity firms, and defense contractors, this regulatory change creates immediate opportunities to engage directly with government buyers facing urgent security challenges. New Fast-Track Category for Security Threats The regulation amends Thailand’s Public Procurement and Supplies Management Act B.E. 2560 (2017) to add a new category of procurement that qualifies for the “specific method”—a noncompetitive, direct selection process. Previously, agencies could use this expedited method only in limited circumstances, such as emergencies, cases with proprietary technology requirements, or national security operations. The new provision explicitly covers procurement of supplies related to preventing or resolving cyber or military threats that could impact the stability of a state agency or the country. This addition recognizes the urgent nature of modern security challenges, where competitive bidding timelines may leave agencies vulnerable during critical threat windows. State agencies dealing with active cyberattacks, preparing defensive measures against anticipated threats, or responding to military security concerns can now move directly to negotiate with qualified vendors rather than conducting lengthy public tender processes. Vendor Considerations Vendors offering cybersecurity solutions now have a regulatory avenue to work directly with government clients when stability concerns are present. These solutions include threat detection systems, anti-ransomware tools, incident response services, firewalls, and security consulting. Similarly, defense contractors providing military equipment or specialized security supplies can pursue direct engagement channels where traditional procurement methods would create
Read More
December 3, 2025
Thailand’s Civil Court has issued a regulation targeting the use of artificial intelligence (AI) in the preparation of pleadings and other documents submitted to the court. Effective November 17, 2025, the regulation aligns with September 2025 guidance from the president of the Supreme Court, and aims to safeguard accuracy, transparency, and public confidence in civil adjudication. The regulation applies to all parties submitting pleadings or any documents to the Civil Court that are prepared using AI tools or contain AI-generated content. It subjects AI used for these purposes to strict requirements on verification, disclosure, and accountability. Core Obligations The regulation imposes four principal obligations: Lawyers who use AI remain subject to duties of honesty, responsibility to the court, professional standards, and legal ethics, including the duty to assess the appropriateness of the AI tool for the work. Parties and lawyers must verify the accuracy and completeness of all facts, legal provisions, and citations in AI-generated content before submission. Parties and lawyers must disclose to the court any AI-generated content by clearly marking the beginning and end of the AI-generated portion with prescribed statements (see below). Additionally, a certification confirming the use of AI must be provided at the end of the pleading or document, stating that AI was used for certain portions and that the party has reviewed and certifies the accuracy of factual and legal content. Parties and lawyers bear the same full legal and ethical responsibility for AI-generated content as they do for personally authored documents; they cannot evade responsibility or avoid liability by citing AI-related errors. Likewise, parties must ensure that any AI-generated content is truthful, accurate, and unbiased. Prescribed Disclosure Language Each instance of AI-generated content must be preceded by the statement “[The following content was prepared using artificial intelligence]” and must end with “[End
Read More
November 24, 2025
A recent warning from the Central Bank of Myanmar (CBM) against cryptocurrency use upholds the country’s ongoing strategy of enforcing strict prohibitions on unauthorized cryptocurrency activities while also promoting the controlled development of a central bank digital currency (CBDC). The CBM’s warning, issued November 16, 2025, reminded the public of announcements in May 2019 and a notification in May 2020 confirming that all online and offline cryptocurrency transactions are strictly prohibited. The CBM also clarified that no financial institution in Myanmar is authorized to deal with digital currencies. The warning highlighted global risks, such as money laundering, scams, tax evasion, hacking, and severe financial losses caused by price volatility and insufficient regulation. The CBM urged the public to use only legitimate banking channels and avoid illegal cryptocurrency activities. The warning comes five months after the CBM issued a notification announcing the formation of the Central Committee for the Issuance of a Central Bank Digital Currency. This committee includes senior CBM officials, representatives from relevant ministries and the banking sector, and technology experts. Its main role is to research CBDC models, test secure digital payment systems, and ensure that any future implementation aligns with Myanmar’s monetary policy and financial stability objectives. Taken together, these two actions illustrate the CBM’s continued pursuit of its dual strategy to promote innovation through CBDC development while prohibiting cryptocurrency use. Businesses should note that while CBDC pilot programs may appear in the future, cryptocurrencies remain off-limits.
Read More