Establishing a shield for digital assets: Key highlights of the Draft Law on Data Security
Entering an era of comprehensive digitalization, data is no longer merely discrete information files; it has become a strategic national asset intrinsically tied to economic vitality and national security. Consequently, cybersecurity is no longer confined to safeguarding physical hardware or transmission lines. Instead, the strategic focus is shifting decisively toward securing the data flow itself.
The Draft Law on Data Security was introduced to complete this legal shield while establishing a pragmatic approach: enforcing rigorous controls over high-risk areas while minimizing administrative burdens on routine operations.
Why is a dedicated legal framework for Data Security essential?
Recent threat intelligence reveals that sophisticated cyberattacks have pivoted toward stealthy, deep infiltration to exfiltrate critical data. Simultaneously, illicit personal data trafficking, cyber fraud, and ransomware attacks have grown increasingly complex, compelling organizations and authorities to bolster their proactive defense and early response capabilities.
Vietnam's legal system currently includes the Cybersecurity Law, the Law on Data, the Law on Personal Data Protection, and various sector-specific regulations. Nonetheless, there remains a critical gap: an overarching framework to safeguard data throughout its entire lifecycle—from collection, storage, processing, and sharing to secure disposal. Sensitive operations such as large-scale data aggregation, AI model training on confidential datasets, and cross-border data transfers urgently require explicit, standardized benchmarks.
To realize Resolution No. 57-NQ/TW dated December 22, 2024, issued by the Politburo on breakthrough advancements in science, technology, innovation, and digital transformation, the draft law was structured into 6 chapters and 29 articles. This legislation establishes a dedicated framework, clearly delineates stakeholder obligations, and specifies security measures commensurate with defined threat levels.
5-tier risk classification model
The centerpiece of this draft law is a risk-based governance model categorizing data into 5 risk levels, evaluated by incident probability and potential impact on national security, social order, and the lawful rights of organizations and individuals:
Levels 1 and 2 (Low risk): Enterprises face virtually no additional complex administrative procedures.
Level 3 (Medium risk): Data controllers must conduct impact assessments and undergo periodic security audits.
Levels 4 and 5 (High and Critical risk): Systems are mandated to undergo in-depth data security evaluations before being commissioned for official operation.
This tiered approach channels defense resources into mission-critical systems rather than spreading capabilities thin, avoiding a one-size-fits-all model that creates wasteful expenditures and unnecessary compliance burdens on daily operations.
The draft also clarifies that risk classification does not alter the legitimate ownership or exploitation rights of data stakeholders. Protecting national data sovereignty does not mean the State will seize or assert ownership over non-public sector data. This establishes a clear boundary between state security governance and the lawful property rights of citizens and enterprises.
End-to-end supply chain security and streamlined inter-agency procedures
To prevent data loss and leakage, technical safeguards must be maintained continuously across every link of the lifecycle: risk assessments, encryption, identity and access management (IAM), regular backups, rapid incident response, and secure data sanitization upon decommissioning.
Cross-border data transfers: Routine data can flow seamlessly, whereas high-risk data will be subject to rigorous oversight. The draft also establishes protective mechanisms for domestic entities and individuals against direct extraterritorial data requests that bypass formal mutual legal assistance channels.
Service supply chain security: Enterprises must strictly manage third-party technology vendor risks, enforce least privilege access, integrate binding confidentiality clauses into contracts, and immediately revoke privileges upon detecting anomalies. For high-risk systems, external vendor remote access and administrative operations will be heavily restricted.
"Single-window" mechanism to prevent overlap: The government will exercise unified administration, prioritizing post-market surveillance (ex-post inspections) and reserving pre-approvals (ex-ante evaluations) strictly for high-risk cases. If an organization is subject to concurrent appraisal and reporting requirements under the Cybersecurity Law, the Law on Data, or the Law on Personal Data Protection, it only needs to submit a single dossier to a single authority. Validated compliance under one regulatory framework will be recognized across others without duplicative reviews.
Empowering AI and stimulating domestic tech innovation
Amid the rapid expansion of AI, the draft law mandates that emerging tech ecosystems implement security controls from the design phase (Security by Design) while ensuring the integrity and legality of source training data. AI data security evaluations will be incorporated into the broader AI system risk assessment rather than split into cumbersome, separate workflows.
Crucially, to protect trade secrets and preserve competitive advantages for startups, regulatory authorities are prohibited from demanding source code or proprietary AI model weights, except in extraordinary circumstances directly serving criminal investigations.
Beyond regulatory controls, the draft law outlines supportive policies to foster an autonomous domestic data security industry through tax incentives and investment attraction for sovereign cloud infrastructure, secure data centers, advanced cryptography, quantum key distribution (QKD), and post-quantum cryptography (PQC). Small and medium-sized enterprises (SMEs) and innovative startups will also receive targeted assistance to elevate their data protection posture.
Shifting from reactive firefighting to proactive, root-level defense through risk tiering is the guiding compass of the Draft Law on Data Security. Balancing national security requirements with administrative reform will bolster digital trust, accelerate technological sovereignty, and build a resilient launchpad for the future data economy.
Optimized cybersecurity solutions from IPSIP Vietnam
As the Law on Data Security matures with stringent standards for risk tiering and supply chain governance, partnering with a trusted domestic technology provider becomes a strategic imperative. This is where IPSIP Vietnam’s tailored solutions deliver measurable value, enabling organizations to transform regulatory compliance into a secure competitive advantage.
With over 15 years of industry experience as a professional IT and cybersecurity service provider, IPSIP Vietnam delivers an end-to-end defense ecosystem: from 24/7 Security Operations Centers (SOC 24/7), 24/7 Network Operations Centers (NOC 24/7), and secure Cloud management to Penetration Testing (Pentest). Embracing the strategy of leveraging AI against AI-driven threats, IPSIP's infrastructure integrates advanced artificial intelligence to automate the triage of thousands of security alerts, detect anomalies early, and isolate threats in real time before lateral movement can occur.
Partnering with IPSIP allows enterprises to seamlessly satisfy periodic security audit mandates (for Level 3 data) and rigorous pre-deployment security appraisals (for Level 4 and 5 systems) as prescribed in the draft law. Rather than incurring heavy capital expenditures to build an internal security team from the ground up, organizations can leverage IPSIP’s team of internationally certified security experts. As a result, digital assets are shielded by a resilient defense posture while maintaining strict regulatory compliance, empowering businesses to execute digital transformation with confidence.
Shifting from reactive firefighting to proactive, root-level defense through risk tiering is the guiding compass of the Draft Law on Data Security. Balancing national security requirements with administrative reform will bolster digital trust, accelerate technological sovereignty, and build a resilient launchpad for the future data economy.
Reference: The People's Deputies Newspaper
