Vietnam’s Draft Data Security Law: what should businesses prepare for?
On October 26, 2026, Vietnam’s 16th National Assembly reviewed the Draft Data Security Law, which aims to protect data throughout its lifecycle, from collection and storage to processing, transmission and destruction. The draft emphasizes risk-based management, third-party controls, cross-border data activities and proactive incident prevention. Businesses should begin reviewing their data, access rights, vendors and monitoring capabilities.
The draft law, developed under the leadership of the Ministry of Public Security, comes as data increasingly becomes a critical asset for the digital economy, national digital transformation and enterprise operations. Rather than focusing only on the security of IT systems, the draft aims to protect the confidentiality, integrity and availability of data from the moment it is created or collected until it is stored, used, transmitted, shared and destroyed.
This could represent an important shift in how businesses approach security. Organizations may need to move beyond asking whether their systems are secure and instead determine which data is being protected, who can access it and what risks arise at each stage of the data lifecycle.
Why is Vietnam developing a Data Security Law?
Vietnam already has multiple laws governing data and cybersecurity, but each framework addresses a different area. The Cybersecurity Law focuses on the security of information systems and cyberspace, while the Data Law governs activities such as data creation, management, exploitation, sharing and classification.
The Draft Data Security Law is intended to address another dimension: protecting the security of data itself throughout its lifecycle, regardless of which system stores it or which operating model processes it.
Under the current draft, data security is viewed through three core attributes:
Confidentiality: preventing unauthorized access or disclosure.
Integrity: preventing unauthorized modification, destruction or interference.
Availability: ensuring data remains accessible and usable when required.
These principles are familiar in modern information security, but the draft places them directly around the data being protected rather than only around the systems that hold it.
How is the Data Security Law different from the Data Law and personal data protection rules?
One notable aspect of the draft is its attempt to clarify the boundaries between existing legal frameworks and reduce regulatory overlap.
Under the current direction:
Personal data continues to be governed by rules on processing principles, conditions and data subject rights under personal data protection legislation.
Data governance, exploitation, sharing and classification remain within the scope of the Data Law.
Security of information systems continues to fall under cybersecurity legislation.
Security of data throughout its lifecycle is the central focus of the Draft Data Security Law.
The draft also introduces a principle intended to minimize duplicated procedures, so that the same object or risk issue is not repeatedly assessed for the same purpose.
For businesses, this is important because the introduction of a new law does not necessarily mean every organization will need to build an entirely separate compliance framework from scratch.
Risk-based management is set to become a central principle
A major theme throughout the draft is managing data security according to risk level. This means not all data would be subject to the same level of control.
Lower-risk data may be allowed to move and be processed with fewer restrictions, while data that could cause significant harm if lost, leaked, altered or made unavailable would require stronger protection.
This approach shifts the focus from “protect all data in the same way” to “identify which data matters most, determine the associated risks and apply proportionate controls.”
For businesses, this makes data inventory, data classification and risk assessment increasingly important foundations. If an organization does not know what data it holds, where it is stored or who uses it, it will be difficult to determine which protections are appropriate.
Data must be protected throughout its entire lifecycle
The Draft Data Security Law does not focus only on stored data. Protection is expected to extend across activities such as:
Collection → Creation → Storage → Processing → Transmission → Sharing → Use → Destruction
This is particularly relevant for businesses using Cloud, SaaS, distributed systems or multiple external service providers.
For example, one dataset may be entered by a customer on a website, transferred into a CRM platform, synchronized to the Cloud, downloaded by an employee, shared with a partner, backed up to another system and eventually deleted or archived.
If a business protects only the primary database but overlooks transmission, backup, sharing or third-party access, the same data may still be exposed elsewhere. An effective data security program therefore needs to understand the data flow, not only the final storage location.
Cross-border data activities will be managed based on risk
Cross-border transfer and processing of data are also important topics in the draft. The current direction is to apply different levels of control depending on the risk associated with the data.
Lower-risk data is expected to face fewer unnecessary procedures, while higher-risk data would be subject to stricter security controls.
This is particularly relevant for organizations that:
use overseas Cloud infrastructure;
rely on international SaaS platforms;
share data with foreign parent companies or subsidiaries;
outsource data processing outside Vietnam;
operate multinational systems;
use data to train or operate AI systems.
Businesses therefore need visibility into which data leaves Vietnam, which providers process it and where that processing takes place.
Third parties and the data supply chain will require greater attention
One of the most relevant issues for businesses is that data security responsibilities do not stop at internal systems. The draft takes a broader view of risk across the supply chain of data products and services.
Before giving a vendor access to data, a data controller may need to assess the associated risks and restrict access to what is necessary. Security obligations and responsibilities in the event of a breach should also be clearly addressed in contracts.
Businesses should also be able to:
monitor vendor access;
limit which data external parties can view;
detect abnormal activity;
revoke access when contracts end;
respond when an incident occurs.
This matters because many data breaches do not originate inside the organization that owns the information. The weakness may instead exist in a service provider, support account or external integration.
How does the draft approach AI?
AI is increasingly becoming a high-risk environment for data processing. The draft proposes integrating data security assessments for AI systems with broader AI risk-assessment mechanisms rather than creating a completely separate review process.
The current direction also does not require businesses to routinely hand over source code or model weights, except in specific circumstances related to criminal investigations. This suggests an attempt to balance data security oversight with the protection of business secrets and proprietary technology.
For organizations deploying AI, the more practical questions include:
What data is the AI system using?
Is the data sensitive?
Which users are allowed to submit data to AI tools?
Is the data transferred to third parties?
Does the system retain prompts or uploaded files?
Could generated outputs expose confidential information?
What should businesses prepare before the Data Security Law is finalized?
The bill is still under consideration by the National Assembly, so businesses should not treat the current draft as a final set of legal obligations. However, many of its directions reflect sound data governance practices that organizations can begin implementing now.
1. Build a data inventory
Businesses should identify what data they hold, where it is stored, who uses it, who it is shared with, whether any of it is transferred overseas and how long it is retained.
If the organization does not already have a data inventory, this should be one of the first steps.
2. Classify data according to importance
Not every file requires the same level of protection. Businesses can begin with categories such as Public, Internal, Confidential and Restricted/Critical to determine the appropriate level of control.
Classification also helps organizations prioritize security investment for the assets that would create the greatest impact if exposed.
3. Review access rights
Businesses should be able to answer one basic question: Who can access which data, and why?
Particular attention should be given to Admin accounts, employees who have changed roles, former employees, service accounts, vendor access, remote access and Cloud identities. The principle of Least Privilege should be applied so permissions remain aligned with legitimate business needs.
4. Assess vendors and third parties
Vendor contracts should clearly define the categories of data being accessed, the purpose of processing, security measures, retention periods, incident notification requirements, breach responsibilities and procedures for deleting or returning data.
Vendor access should also be reviewed periodically and revoked once the service relationship or business need ends.
5. Protect data with technical controls
Critical data should be protected across multiple states, including storage, transmission, backup, Cloud use and third-party sharing.
Encryption, key management, access controls and activity logging should be prioritized according to the risk level of each dataset.
6. Prepare detection and incident response procedures
Businesses should determine in advance who receives alerts, who has authority to isolate systems, who assesses affected data, where logs are stored, which providers need to be contacted and which evidence must be preserved.
An incident response plan that exists only on paper but has never been tested or exercised is unlikely to perform well during a real event.
How can businesses strengthen data protection?
There is no single technology that can address every data security requirement. Depending on the type of data, the level of risk and the operating environment, businesses need multiple layers of control covering data protection, access management, monitoring and incident response.
Several technical measures can help organizations turn data protection policies into practical controls.
Encrypt critical data
For highly sensitive information, IPSIP Vietnam’s Enterprise Data Encryption solution can help protect data across Cloud environments and reduce the risk of unauthorized reading or use if data is copied or exposed.
Encryption is particularly relevant for information that must remain confidential during storage, transmission or processing across multiple systems.
Control privileged accounts and remote access
The draft places emphasis on limiting vendor access and applying stronger controls to systems with higher levels of risk.
In this area, PAM & Bastion can support privileged account management, scoped access, session control and activity recording for administrators and external parties.
This type of control is especially relevant for organizations operating multiple servers, Cloud environments, administrative accounts or vendor remote-access connections.
Continuously monitor and detect incidents
For systems containing important data, protection is not only about preventing access. Businesses also need to detect abnormal behavior early.
IPSIP Vietnam's SOC 24/7 can support centralized security monitoring, alert validation, abnormal behavior detection and incident response coordination within an agreed scope.
SOC services are particularly relevant for organizations that require continuous monitoring, traceability and incident handling, especially across Cloud environments, multiple branches or extensive third-party connections.
These measures do not replace legal or compliance governance. Their role is to provide technical controls that allow data protection policies to be implemented and verified in real operating environments.
IPSIP Vietnam's expert perspective: where should businesses start?
Organizations should not apply the same level of security to all data. Information that could cause. Access should be granted according to legitimate need and revoked quickly when no longer required, especially for administrators, vendors and remote users.
Businesses need the ability to detect incidents, trace activity and respond before a limited security event develops into a large-scale data breach.
How should businesses view the draft law?
Vietnam’s Draft Data Security Law signals a shift from a system-centered view of cybersecurity toward a broader model focused on protecting data itself throughout its lifecycle and according to risk.
For businesses, this is not only about preparing for a potential new compliance obligation. Knowing where data is stored, who can access it, which third parties process it and how quickly the organization can detect an incident directly affects both breach prevention and business continuity.
While the draft continues through the legislative process, organizations can begin strengthening their data governance foundations now, while continuing to monitor the final law and subsequent implementation guidance before determining specific compliance obligations.
References
