FLAT LAW FIRM
Request a consultation

Data, Technology and Compliance

Vietnam’s Law on Data: Scope & FDI Obligations

10 min readFLAT LAW FIRM
Office staff typing on a laptop in a modern office — illustrating data processing and compliance activities at an FDI enterprise

Vietnam’s Law on Data No. 60/2024/QH15 has been in force since 1 July 2025. Under Article 2, it applies directly to foreign organizations and individuals in Vietnam, and extends to foreign organizations and individuals that directly participate in or are related to digital data activities in Vietnam. Every FDI enterprise operating in Vietnam should review how it collects, stores, shares, and transfers data across borders.

Scope and Subjects of Application

Article 1 defines the law’s scope: digital data; the building, development, protection, administration, processing, and use of digital data; the National Data Center; the National Integrated Database; data products and services; state management of digital data; and the rights, obligations, and responsibilities of relevant parties. Its focus is national data governance and the data market — distinct from the Law on Personal Data Protection No. 91/2025/QH15, which centers on data subjects’ rights.

Article 2 lists three groups of subjects: (1) Vietnamese agencies, organizations, and individuals; (2) foreign agencies, organizations, and individuals in Vietnam — FDI enterprises are directly covered; (3) foreign agencies, organizations, and individuals directly participating in or related to digital data activities in Vietnam — an extraterritorial reach. The law does not further define the phrase in item (3), so businesses should treat any data flow touching Vietnamese territory with caution.

Key concepts in Article 3: important data (Clause 6) is data that may affect national defense, security, foreign affairs, macroeconomics, social stability, or public health and safety, falling within categories issued by the Prime Minister; core data (Clause 7) is important data that directly affects those areas, also within Prime Minister-issued categories; and a data owner’s rights are property rights under civil law (Clause 15).

Legal Framework and Key Dates

The Law on Data was passed by the 15th National Assembly on 30 November 2024, comprising 5 chapters and 46 articles, effective from 1 July 2025 (Article 45). Implementing and related instruments:

  • Decree 165/2025/ND-CP (30 June 2025): detailed implementation rules; Article 12 governs cross-border transfer and processing of data. Amended by Decree 356/2025/ND-CP (31 December 2025): where core or important data is personal data, only an impact assessment under personal data protection law is required;
  • Decree 169/2025/ND-CP (30 June 2025): on data products and services; amended by Decree 347/2026/ND-CP (effective 15 September 2026), which abolished the business-license certificate requirement and business conditions for data analysis and aggregation services;
  • Decision 20/2025/QD-TTg (1 July 2025): the list of 26 groups of core data and 43 groups of important data;
  • Cybersecurity Law 116/2025/QH15 (passed 10 December 2025, effective 1 July 2026): amends certain terminology in the Law on Data without changing substantive obligations;
  • Decree 363/2026/ND-CP (effective from 11 November 2026): administrative sanctions in the data sector.

Data Classification: Businesses Classify Their Own Data

Article 13 classifies data by sharing nature (shared, private, open data) and by importance (core, important, and other data). Clause 2 and Clause 1(b) of Article 13 require organizations and individuals to classify their own data against the categories in Decision 20/2025/QD-TTg.

Six Groups of Obligations for FDI Enterprises

1. Data Administration and Quality

Clause 4, Article 15: organizations other than state agencies administer data “based on actual conditions” — a more flexible standard than that applied to state agencies. Clause 2, Article 14 allows data owners to decide on data storage, except that core and important data must comply with Clause 3, Article 27. There is no absolute data-localization obligation for ordinary data.

2. Registration and Provision of Data Services

Clause 2, Article 40: providing data intermediary services requires registration under investment law (except for internal organizational use). Clause 2, Article 41: operating data analysis and aggregation services requires registration under investment law — with the accompanying business conditions abolished by Decree 347/2026 (effective 15 September 2026). Data exchange services (Clause 2, Article 42) may only be provided by licensed public service units and state-owned enterprises — FDI enterprises may not provide data exchange services. Clause 3 prohibits trading data that endangers national defense, security, foreign affairs, or cryptography; data lacking the data subject’s consent; and data prohibited by law.

3. Providing Data to State Agencies (Article 18)

Clause 1 encourages voluntary provision of data to state agencies. Clause 2 imposes a mandatory duty: upon a competent authority’s request, organizations and individuals must provide data without the data subject’s consent in four cases — emergency response, threats to national security (below emergency level), disasters, and the prevention of riots and terrorism. Clause 3 binds the receiving agency to use data for the stated purpose, ensure security, destroy the data as soon as it is no longer needed, and notify the provider.

4. Data Sharing and Connection

Article 17: data connection and sharing are carried out in accordance with law or by agreement between the parties, directly or through an intermediary; data integrated into the National Integrated Database includes data voluntarily provided by organizations and individuals.

5. Cross-Border Transfer and Processing of Data — the Hotspot

Article 23: Clause 1 affirms the freedom to transfer data from abroad into Vietnam and to process foreign data in Vietnam; Clause 2 lists the forms of cross-border transfer and processing of core and important data: moving data stored in Vietnam to storage systems outside Vietnamese territory, transferring data to foreign organizations or individuals, and using platforms outside Vietnamese territory to process data. Decree 165/2025 (Article 12) details the procedures: core data requires prior approval from the Ministry of Public Security (or the Ministry of National Defence for military, defence, and cryptography data); the impact assessment dossier (Form No. 02) is reviewed within 10 days (no more than 15 days for complex cases); transfer may proceed only after a satisfactory assessment. Important data needs no prior approval, but the transferor must prepare an impact assessment dossier before the transfer and send one original copy to the Ministry of Public Security or the Ministry of National Defence 15 days before processing the data.

Exceptions requiring no prior approval or notification: emergencies; cross-border HR management; and the conclusion or performance of genuinely necessary contracts (cross-border transport, logistics, money transfers, payments, hotels, visas, etc.) — but an impact assessment must still be sent within 15 days after the transfer. Data volumes are measured cumulatively from 1 July 2025; the ministries may order a halt to transfers in case of violations. Under Decree 356/2025 amending Decree 165, core or important data that is personal data requires only an impact assessment under personal data protection law — FDI enterprises must comply with both laws simultaneously.

6. Data Security, Risk Management, and Decryption

Article 25 lists four risk groups: privacy; cybersecurity; identification and access management; and other risks (sharing, data management). Clause 3 requires data controllers other than state agencies to self-assess and identify risks, remediate promptly, and notify relevant parties. Clause 4 sets a higher bar for controllers of core and important data: periodic risk assessments reported to the specialized cybersecurity units of the Ministry of Public Security and the Ministry of National Defence. Article 26 recognizes data subjects’ right to request retrieval, erasure, and destruction of their data — under Article 13(1)(b) of Decree 165/2025/ND-CP, erasure and destruction must be completed within 72 hours of a data subject’s request. Clause 4, Article 22 allows competent state agencies to decrypt data without the data owner’s or controller’s consent in four cases: emergencies, threats to national security, disasters, and the prevention of riots and terrorism.

Regulator: The Ministry of Public Security Is the Focal Point

Article 8: the Government exercises unified state management of data; the Ministry of Public Security is the focal agency (except for defence and cryptography data under the Ministry of National Defence), handling most key procedures: approval of core-data cross-border transfers, receipt of impact assessment dossiers, and licensing of data exchange services.

Sanctions: Decree 363/2026 Effective from 11 November 2026

Decree 363/2026/ND-CP on administrative sanctions in the data sector takes effect on 11 November 2026 — it is not yet in force as of October 2026. Verified points: Article 6 — maximum fine of VND 100 million for individuals, doubled for organizations (VND 200 million maximum); Clause 2, Article 1 — excludes conduct covered by sanctioning decrees in cybersecurity and personal data protection; plus transitional rules at 11 November 2026.

Distinguishing It from the Law on Personal Data Protection 91/2025/QH15

The Law on Data is not Vietnam’s “personal data protection law.” It governs digital data in general (personal and non-personal), focusing on national data governance and the data market; Law 91/2025/QH15 (effective 1 January 2026) governs only personal data, focusing on data subjects’ rights and the obligations of data controllers and processors. FDI enterprises must comply with both laws.

Practical Recommendations

  1. Inventory and classify data against the 26 core and 43 important data groups in Decision 20/2025/QD-TTg;
  2. Map cross-border data flows under Clause 2, Article 23;
  3. Prepare impact assessment dossiers: important data — send one original copy to the Ministry of Public Security/Ministry of National Defence 15 days in advance; core data — obtain prior approval (10 days, 15 for complex cases);
  4. Build an internal data governance policy (Clause 4, Article 15): self-assessment of risks, erasure procedures to be completed within 72 hours of a data subject request (Article 13(1)(b), Decree 165/2025/ND-CP), and a process for handling state agencies’ data requests;
  5. Complete compliance before 11 November 2026 — when Decree 363/2026 on sanctions takes effect.

Frequently Asked Questions

Does the Law on Data apply to 100% foreign-owned companies in Vietnam?

Yes. Clause 2, Article 2 directly covers “foreign agencies, organizations, and individuals in Vietnam,” regardless of ownership ratio.

Must FDI enterprises store data in Vietnam?

No, not for ordinary data (Clause 2, Article 14); only core and important data must comply with Clause 3, Article 27 and the procedures in Article 12 of Decree 165/2025.

What procedures apply to transferring important data abroad?

Prepare an impact assessment dossier (Form No. 02) and send one original copy to the Ministry of Public Security (or the Ministry of National Defence) 15 days before processing the data — no prior approval required. Core data requires prior approval.

Must businesses “register data” with the Ministry of Public Security?

No. The law provides no general data-registration duty. “Registration” appears only in Clauses 2 of Articles 40 and 41 and in the licensing procedure for data exchange services under Decree 169/2025 (as amended by Decree 347/2026).

Sources Cited

  • Law on Data No. 60/2024/QH15 (passed 30 November 2024, effective 1 July 2025);
  • Cybersecurity Law No. 116/2025/QH15 (effective 1 July 2026) — terminology amendments to the Law on Data;
  • Decree No. 165/2025/ND-CP dated 30 June 2025 detailing implementation of the Law on Data (as amended by Decree 356/2025/ND-CP);
  • Decree No. 169/2025/ND-CP dated 30 June 2025 on data products and services (as amended by Decree 347/2026/ND-CP);
  • Decree No. 356/2025/ND-CP dated 31 December 2025 guiding the Law on Personal Data Protection;
  • Decree No. 363/2026/ND-CP dated 19 September 2026 on administrative sanctions in the data sector (effective 11 November 2026);
  • Decision No. 20/2025/QD-TTg dated 1 July 2025 of the Prime Minister on the lists of core and important data;
  • Law on Personal Data Protection No. 91/2025/QH15 (effective 1 January 2026).

Contact Us

FLAT Law Firm assists FDI enterprises with Law on Data 60/2024/QH15 compliance: data classification, cross-border transfer impact assessments, and internal data governance policies. Contact us via flaw.vn.

This article was drafted by the AI Legal Council and reviewed by the QA Council; it has not been reviewed by a licensed human lawyer and does not constitute legal advice for any specific case.