You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

January 24, 2025

Draft Guidance on Vietnam’s New Data Law Open for Public Consultation

Subscribe to Updates

Following Vietnam’s adoption of the new Law on Data (“Data Law”) on November 30, 2024, there remained uncertainty as to what impact the new framework would have on businesses in Vietnam and abroad. The government has now released a package of four draft legal documents aimed at guiding the implementation of the Data Law: (1) a decree on the National Data Development Fund (“NDDF Decree”), (2) a decree related to regulations on scientific, technological, and innovation activities and data products and services (“Decree on Specific Activities”), (3) a decree detailing a number of articles and measures to implement the Data Law (“Implementation Decree”), and (4) a decision on the lists of important data and core data. This article will provide an overview of the draft legislation.

1. NDDF Decree

The draft NDDF Decree relates to the establishment, management and use of a National Data Development Fund (“NDDF”), which is a non-profit and non-budgetary state financial fund established and managed by the Minister of the Ministry of Public Security (MPS). The NDDF has legal personality and is fully state owned, operating similarly to a single-member limited liability company. Its main objectives are to support, promote, and invest in artificial intelligence (AI), the Internet of Things (IoT), and other new technologies and innovation.

The NDDF may lend to, invest in, or otherwise support eligible organizations. The draft NDDF Decree also proposes a series of regulations on donations to the NDDF and from the NDDF (through expense support), the lending activities of the NDDF to commercial banks, which will in turn lend to eligible organizations, the investment activities in data products and services innovative start-ups, and other kinds of support.

The government commits to provide VND 1 trillion (approx. USD 40 million) to the NDDF, evidencing the importance the government places on fostering a thriving ecosystem for data product and service development, and its wish to position Vietnam as a center of innovation. However, the NDDF also intends to rely on donations. It remains to be seen whether the NDDF will operate effectively to boost the technology and data-related developments.

2. Decree on Specific Activities

The Decree on Specific Activities focuses on two main matters: regulations related to data products and services, and the creation of a regulatory sandbox to foster innovation.

Data Products and Services

The chapter on data intermediary products and services of the draft Data Law had been stripped down before enactment. The details are now prescribed in this draft decree under Chapter III, covering (i) data intermediary products and services, (ii) data analysis and aggregation services, and (iii) data marketplaces.

Data intermediary activities have now been clarified and include, among others, activities of representing data subjects and data owners to connect, share, exchange, and access data with service users; data management services; data cooperation and sharing services; etc.

Providers of data intermediary products and services between the service users and the state agencies must be fully registered and licensed, while other service providers can request the MPS to appraise them to unlock the same benefits as enterprises operating in high-tech, innovative, creative start-ups and the digital technology industry.

Further, the draft Decree on Specific Activities creates new personal data protection obligations for providers of data intermediary products and services, while personal data is not the main object of the Data Law. Among the new requirements, the obligation to limit the transfer of personal data abroad and ensure that the standard of protection is equivalent to the standard required by relevant laws has been inserted. As the government is currently developing the Personal Data Protection Law (more details here), it is unclear why it is also inserting such provision under the Data Law framework.

Businesses engaged in data intermediary products and services or data analysis and aggregation will need to take into account the personnel requirements that are reinserted in the draft Decree on Specific Activities. The head of the organization must be a Vietnamese citizen and permanent resident, with a university degree, who has directly managed a large scale data center and has at least three years of experience related to data management. This poses a significant issue for industry players, considering talent is scarce on the global scene, and in Vietnam. Further, the requirement for a minimum charter capital has been replaced by a mandatory deposit in a commercial bank operating in Vietnam of VND 5 billion (approx. USD 200,000). It is still unclear whether the cross-border provision of such products and services is possible and whether foreign businesses would be subject to the same requirements. The same requirements will apply to data marketplace service providers, but this is likely to pose lesser problems considering this business activity is restricted to non-business units or state-owned enterprises.

Data analysis and aggregation services are now categorized into four levels depending on the level of human supervision and the role of the products and services in the decision-making process. Licensing requirements will apply to automated decision-making, with or without human supervision, and to products and services using data from national databases. Here again, to unlock incentives, an organization that is not subject to the licensing requirements can request the MPS to conduct an appraisal. Biannual or annual reports on service provision must be sent to the management agency, based on a statutory form.

Data marketplace service providers include providers of data auction services, but also services to provide an environment for data trading and exchange and data-related product and services, and other services related to bidding, offering, introducing, representing, supporting and other activities related to data trading. Such data marketplace service providers must ensure that the channels to receive information and the use of the services are continuous 24/7, and publicly display service charges, prices, terms of use, and applicable conditions. They must also report biannually or annually to the management agency. All data products on the data marketplace must be authenticated with data origins. Organizations and individuals are responsible for the contents they post on data marketplaces and cannot auction at a price lower than the input fee for data products and services, ensuring fair competition. It is still unclear how private organizations will be able to leverage their data with these new marketplaces.

Regulatory Sandbox

Th draft Decree on Specific Activities also suggests the establishment of the necessary regulatory framework for a sandbox for research and application of science, technology, and innovation in the construction, development, protection, administration, processing and use of data as foreshadowed by Article 24.4 of the Data Law. This sandbox would be created to promote research and create a testing environment to assess the risks, costs and benefits of innovative products and services while limiting the risk to users of such products and services.

Participating in the sandbox is subject to being granted a certificate of testing activities – details of the application procedure being further described in the draft decree. The right to participate in the sandbox does not equal the right to provide the innovative products and services on the market. For any organization that is not allowed to participate in the sandbox, they are still encouraged to innovate but must do so within the applicable regulations at the time.

The draft Decree on Specific Activities sets out the obligations and the rights of the participating organizations, but also creates exemptions from liability with the aim to encourage innovation and creativity. The Ministry of Science and Technology is notably tasked to formulate detailed regulations on such exceptions, and other mechanisms and policies to foster innovation in Vietnam.

The government’s intention appears to be giving priority to innovative solutions in AI, cloud computing, blockchain, data communication, IoT, big data and other modern technologies. The draft decree notably suggests incentives to attract talent and FDI in these sectors.

3. Implementation Decree

The draft Implementation Decree provides clarification on many outstanding issues pursuant to the Data Law, notably (i) the mandatory provision of data to state agencies upon request, (ii) the cross-border transfer of data, and (iii) data protection measures.

Mandatory Provision of Data to State Agencies

The procedure applicable to the provision of data to state agencies upon request has been clarified to a certain extent. The draft Implementation Decree sets out that ministers, heads of ministerial level agencies, and presidents of provincial-level People’s Committees are competent to request data from organizations, ensuring such requests are emanating from a high-level rank. Such requests must be made in writing, unless it is impossible, and must specify the data requested, the purpose, the processing period, the legal basis for the request, the time limit to provide the data and the sanction for not providing such data. The data handover must be recorded in minutes. However, the organization receiving the request has the right to request amendment or withdrawal of the request. The extent of the data that can be requested has not been further limited or clarified, but the requesting agencies must respect the lawful purpose of the data manager and data owner and must protect business secrets and personal secrets.

Cross-Border Transfer of Data

With an aim to clarify what is included in the definition of “core” and “important” data, the Implementation Decree provides criteria to determine the category of the data, based on its degree of impact on a specific field, group, or region that may have an impact on national defense, security, foreign affairs, macroeconomics, social stability, or public health and safety (excluding trade secrets).

“Core data” will notably comprise some sensitive governmental information like guidelines and policies of the Vietnamese Communist Party and the state on domestic and external relations; strategies and plans to protect the fatherland; organization and operations of the armed forces; data on plans for collection, exchange, and issuance of money; data on natural resources and the environment, and newly discovered microbial strains and varieties related to human health and life; processes to produce medicinal herbs and rare biological drugs; and data on inspection, examination, denunciation and prevention of corruption.

“Important data” will notably comprise information that may affect national security, the Vietnamese Communist Party, the state and the socialist regime, major overseas projects, safety of overseas energy sources, security of international cooperation, infrastructure of important economy sectors; and the life, health, honor, dignity, property, and legitimate rights of organizations and individuals. The latter being very broad, as further discussed in section (4) regarding the Decision below. Due attention should be paid to the development of the Implementation Decree and the Decision to ensure that it does not impede the free flow of data, considering Vietnam’s commitment not to restrict data flows under numerous international treaties and agreements.

The transfer of core and important data outside of Vietnam is subject to additional requirements, notably the data owner must conduct a risk assessment and establish an impact assessment dossier. For core data, the transfer can only be made once the “satisfactory assessment results” have been obtained from the MPS or the Ministry of National Defense, as the case may be. For important data, the transfer can be made when the assessment is submitted and the transferor has not received objection from the authorities within the regulated timeline, but the MPS and the Ministry of National Defense can request the data transferor to stop the transfer if the impact assessment is not sufficiently supplemented following such request from the authorities. An important point to note is that the draft Implementation Decree also restricts the disclosure of data domestically by imposing other impact assessment requirements, with stricter regulations being proposed for the sharing of core and important data.

Further, notwithstanding the category of data being transferred abroad, the data transferor must ensure the protection of the legitimate rights and interest of the data subject, national defense and security, and national interests and public interests. It must also enter into an agreement with the recipient, in which mandatory content has finally been clarified.

Data Protection Measures

Additional guidance is also provided on the measures to implement risk management related to data processing with lists of technical and organizational measures being proposed. This has long been requested by the private sector to better understand the expectations of the authorities in terms of data protection. Consequently, core and important data are subject to additional security measures. This multi-layered approach to data protection aligns with international standards and ensures that measures are implemented in accordance with the sensitivity of the related data.

In addition, the draft Implementation Decree provides that, when the data owner needs to transfer data in the context of merger, reorganization, or bankruptcy, such data owner needs to prepare a plan for such transfer and to notify impacted users via phone call, text message, email, or notice.

It is worth noting that many of the measures being imposed are inspired by best practices in personal data protection (e.g., record of processing activities, access controls, training of employees, proper deletion and destruction procedures, etc.). Although one would understand why such measures would be relevant in the case of core and important data, the requirements would be very burdensome for “ordinary” data processing. The scope of application of the Data Law (and its future guiding decrees) will cover any organization participating in or related to digital data activities. As digital data is simply data in digital form, the application scope is very broad, and the obligations far-reaching.

4. Decision on Lists of Important Data and Core Data

The draft decision lists out types of important data and core data for the implementation of the Data Law, especially the regulations on cross-border data transfer discussed above. There are 24 types of core data and 18 types of important mentioned in the decision. Enterprises will need to pay special attention to the following types of important data, among others, to ensure future compliance:

  • Data in the field of healthcare (e.g., data on the health records and biometrics of Vietnamese citizens, if 10,000 or more people are involved);
  • Data in the field of finance and budget (e.g., data on insurance contracts, insurance amounts, insurance claim records, and insurance claim amounts for 10,000 or more customers);
  • Data in the field of information and communication (e.g., data that can be used for social mobilization, internet behavior data of more than 100,000 users, etc.);
  • Basic personal data of 1 million or more people, other sensitive personal data of 10,000 or more people.

Next Steps

The draft decrees are open for public consultation until March 17, 2025, while the timeline is unclear for the draft decision. This might be the last opportunity for the private sector to advocate for a more business-friendly regulatory framework, as the Data Law is entering into force on July 1, 2025, and the guiding decrees and decision are expected to follow the same timeline.

Related Professionals

Industries

Technology

Location

RELATED INSIGHTS​ 

June 23, 2026
On May 26, 2026, Thailand’s Department of Land Transport (DLT) published for public consultation a draft amendment to the Ministerial Regulation on Electronic Ride-Hailing Vehicles that would, for the first time, allow juristic persons (legal entities) to register vehicles as electronic ride-hailing cars—a right that currently belongs exclusively to natural persons, limited to one person per one vehicle. If finalized in its current form, the regulation would significantly expand the supply side of Thailand’s ride-hailing market by enabling corporate fleet operators to enter the space. The public comment period is open through June 24, 2026. Key Principles Under the Draft Regulation Under the proposed amendment, juristic persons that maintain a fleet of at least 50 vehicles will be permitted to register vehicles as electronic ride-hailing cars. This represents a fundamental shift from the current framework, which restricts registration to individual natural persons on a one-person-one-car basis. Vehicle Specifications Corporate-owned ride-hailing vehicles must meet the following requirements: Be brand new from the factory, or no more than two years old from first registration with no more than 20,000 km of use. Not be a vehicle that has been reconstructed or repaired after involvement in a serious accident affecting safety—a standard consistent with public transport vehicles (RorYor. 6). Be classified as small, medium, or large in accordance with ministerial or director-general specifications. The vehicles may be equipped with safety devices such as interior or exterior cameras (video/photo recording) and can retain the original factory color of the vehicle body (no mandatory color change is required). License Plates Corporate ride-hailing vehicles will use license plates of the same size, characteristics, and color as those for private passenger vehicles not exceeding seven seats (RorYor. 1), rather than public transport plates. Potential Impact The government has stated that the regulation is intended to: Promote
Read More
June 23, 2026
On May 14, 2026, Thailand published a ministerial regulation in the Government Gazette to prescribe measures for prevention and suppression of technology crimes. The regulation creates a comprehensive procedural framework for returning money and digital assets to victims of technology crimes. It will take effect 90 days after publication (in mid-August 2026), giving affected entities a limited window to prepare. Mandatory Reporting Obligations for Financial Institutions When a deposit account, e-money account, or digital asset wallet is frozen in connection with a technology crime, the relevant financial institution or business operator must report transaction data to the Anti-Money Laundering Office (AMLO) via AMLO’s designated electronic system. Required data elements include account numbers (sender and receiver), names, identification or passport numbers, legal entity registration numbers, phone numbers, remaining balance, damage amount, transaction reference numbers, and the bank case ID. Institutions that already share data through the information-sharing system under the emergency decree are deemed to have satisfied this reporting obligation, creating an incentive for platform participation. When the Royal Thai Police or the Department of Special Investigation seize or freeze assets related to technology crimes, they must provide AMLO with investigation reports, complaint evidence, money-trail data, and account statements. Notification and Claims Process Once the AMLO secretary-general approves verified reports of a technology crime, the account information of persons connected to the crime will be published in the Government Gazette, triggering a 90-day window for victims to file claims and for related persons to file objections. Officers will also publish details on AMLO’s electronic media and send registered mail to identified victims, which will be deemed received after 7 days domestically or 15 days internationally. Victims have 90 days from the date the crime is published in the Government Gazette to file claims through AMLO’s electronic system. Claims must include
Read More
June 15, 2026
The surge in AI development has led to a desperate demand for large, high-quality training data. However, real-world data can be expensive to collect, difficult to access, and often subject to strict privacy and regulatory constraints. Synthetic data, which consists of artificially generated records that replicate the statistical properties of real-world data without reproducing specific individuals’ information, provides an appealing solution by generating artificial datasets at scale without relying on identifiable personal information. It combines speed, cost efficiency, and regulatory compliance, making it a sensible alternative for organizations seeking to reduce risks while maintaining data utility. When properly anonymized, synthetic datasets may fall outside the scope of laws such as the EU’s General Data Protection Regulation (GDPR) or Thailand’s Personal Data Protection Act (PDPA), reducing compliance burdens while still supporting high-quality model training. However, relying on synthetic data without rigorous legal due diligence could be a strategic mistake. It replaces one set of known risks (scraping, direct privacy liability) with a new set of complex liabilities. The narrative that synthetic data is a “silver bullet” for privacy and IP compliance is dangerous and could be misleading. While synthetic data addresses data scarcity, it also introduces new legal uncertainties. Legal counsel should anticipate downstream risks arising from compromised data sources. Models trained on unlawfully obtained data may need to be decommissioned, even if their outputs appear lawful. What is synthetic data? Synthetic data refers to artificially generated information created using AI techniques such as deep learning and generative models. Instead of copying real records, it reproduces the statistical patterns and relationships found in the original dataset. Synthetic data generally falls into three categories: Fully synthetic data – Entirely new data points generated from learned patterns. The model studies the structure of the original data and produces records that resemble real-world
Read More
June 11, 2026
Thailand’s Electronic Transactions Development Agency (ETDA) has released a revised draft Electronic Transactions Act (ETA) for public hearing from May 12, 2026, to June 15, 2026. This is not merely an amendment to certain provisions of the current ETA, but a comprehensive redrafting of the entire act. The revised draft ETA introduces several significant changes from the current framework, with practical implications for businesses operating in Thailand. Unified Coverage of Public and Private Sectors The current law segregates government transactions into a separate chapter with distinct rules. The draft ETA eliminates this division, defining “transaction” to encompass civil and commercial juristic acts as well as administrative procedures, administrative contracts, and other acts of government agencies. Enhanced E-Signature Definition The definition of “electronic signature” is broadened to expressly include biometric data and refocused on identifying the signatory and demonstrating intent regarding the content of the electronic data. Shift in Burden of Proof When a party challenges the reliability of electronic data created using a “trusted electronic method” or a method prescribed by the ETDA, the burden of proof and the cost of proving unreliability shifts to the challenger. Introduction of New Digital Method Concepts The draft ETA introduces several new digital method concepts that are not currently recognized under the existing ETA framework. These include: Electronic timestamping (e-timestamp) Electronic registered delivery Electronic company seals Electronic stamp duty compliance Electronic identity authentication and verification Electronic transferable records (electronic bills of lading, promissory notes, and similar negotiable instruments) Recognition of Automated Systems and Electronic Contracting The draft ETA expressly recognizes the legal validity and enforceability of contracts formed through automated systems, including contracts concluded entirely between automated systems or between an automated system and a person. A party may not deny the binding effect of such contracts solely because no human review
Read More