Vietnam: Draft law on data security – What enterprises must prepare for

Vietnam.vn reports that on October 26, Minister of Public Security General Luong Tam Quang presented the draft Law on Data Security to the National Assembly on behalf of the Prime Minister[2]. The portal says the draft comprises 6 chapters and 29 articles[2].According to Vietnam.vn, data owners determine the risk level themselves, apply appropriate protective measures, and are responsible for the results, primarily through a post-audit mechanism[2]. The outlet reports that level 1 and level 2 data require virtually no administrative procedures[3], while from level 3 onwards, data managers must conduct impact assessments and periodic audits[3].For cross-border transfers, Vietnam.vn reports that level 3 data is self-assessed by the data owner, while level 4 and level 5 data must be approved by the competent authority before transfer[4].Vietnam.vn also reports that the draft would apply to foreign organizations and individuals outside Vietnam that process data under Vietnam's jurisdiction[5]. Law firm Frasers says the draft is not limited to personal data[6] and imposes strict incident-reporting deadlines[6].According to Vietnam.vn, the draft says AI developers must control the origin and ensure the integrity of training data[2].MLex reported that an earlier consultation draft, released in July, used a four-tier, risk-based data classification system[7] and is expected to take effect on Dec. 1, 2027[7].