Data, privacy and AI rules

Due in 60 days12Regulations190

12 due in 60 days · 190 regulations

Vietnam Law on Data

In force Vietnam · In force Jul 1, 2025 · no upcoming deadlines

Official text
Add to calendar
Apple Calendar or OutlookGoogle Calendar Download .ics

Deadlines

Takes effectJul 1, 2025 · 16 months ago · Source
Law on Data takes effectThe Law on Data enters into force.

Summaries for reference, not legal advice. Check the official text.

What it does

Vietnam's framework law for digital data. It classifies data as core, important or other, with lists of core and important data set by the Prime Minister, and requires cross-border transfer and processing of core and important data to protect national defence, security and the public interest. It also sets up the National Data Center and national database, and governs data products, data services and data exchanges.

Who it applies to
Vietnamese agencies, organisations and individuals, and foreign organisations and individuals in Vietnam or directly involved in digital data activities in Vietnam.
Penalties
Handled under implementing decrees and general administrative and criminal law. The Law itself does not set fine amounts.
Enforced by
Government of Vietnam, with the Ministry of Public Security as the lead data management body
Official name
Law on Data (Law No. 60/2024/QH15)
Citation
Law No. 60/2024/QH15
Topics
Data residency, Data access and sharing, Cybersecurity
Verified 2026-09-25 datafiles.chinhphu.vn
Research notes

Passed at the 8th session of the 15th National Assembly. The Ministry of Public Security's lead role comes from the Law's state management provisions and implementing decrees; exact decree numbers are not captured here. The Cybersecurity Law 2025 amends some wording of this Law.

Related

In forceAustralia
Australia Cyber Security Act (ransomware reporting)Australia's first standalone cyber law: mandatory reporting of ransomware or cyber-extortion payments within 72 hours, security standards for consumer smart devices, 'limited use' protections for information shared with ASD and the National Cyber Security Coordinator, and a Cyber Incident Review Board. Ransomware payment reporting has applied since 30 May 2025.In effect since Nov 30, 2024
AmendedAustralia
Australia SOCI ActAustralia's critical infrastructure security law. Owners and operators of critical infrastructure assets must register ownership and operational information, and many must report cyber security incidents to the Australian Signals Directorate. Responsible entities for many asset classes must also keep a critical infrastructure risk management program. Systems of national significance face enhanced cyber security obligations, and the government has step-in and assistance powers.In effect since Jul 11, 2018
In forceChina
China Cross-Border Data Flow ProvisionsRelaxes China's data export regime by exempting common transfers (contracts with the individual, cross-border HR, emergencies, and non-CII transfers of PI of fewer than 100,000 people a year) and setting volume thresholds for when a CAC security assessment, standard contract or certification is needed. Data is not 'important data' unless regulators have notified or published it as such.In effect since Mar 22, 2024
In forceChina
China Cyber Incident Reporting MeasuresRequires network operators in China to grade cybersecurity incidents using an annexed grading guide and report incidents rated relatively major or above. CII operators must report within 1 hour, central government bodies within 2 hours, and other operators to the provincial CAC within 4 hours. A full post-incident report is due within 30 days after handling ends, and ransom demands must be disclosed.In effect since Nov 1, 2025
AmendedChina
China Cybersecurity LawChina's base cybersecurity statute: multi-level protection scheme duties for network operators, localization and security review duties for critical information infrastructure (CII) operators, and content controls. The 2025 amendment, in force from 1 January 2026, adds AI governance support, ties PI processing to PIPL, allows fines on first violations and sharply raises maximum fines.In effect since Jun 1, 2017
In forceChina
China Data Export Security Assessment MeasuresSets the CAC security assessment that must be passed before certain data leaves China, including exports of important data and large-scale personal information exports. Data handlers must run a self-assessment, then apply through the provincial CAC for a national CAC review. Transfers already under way had six months to come into compliance.In effect since Sep 1, 2022
In forceChina
China Data Security LawSets up China's data classification and grading system, with heightened protection for 'important data' and 'core data'. Requires data processors to run data security management systems, risk monitoring and incident handling, and restricts giving data stored in China to foreign judicial or law-enforcement bodies without approval.In effect since Sep 1, 2021
In forceChina
China Data Security Risk Assessment MeasuresImplements the annual risk assessment duty for important data handlers under the DSL and Network Data Security Regulations. Important data handlers must assess risk every year and submit the report to their regulator within 20 working days of finishing; general data handlers are encouraged to assess at least every 3 years. Regulators can order an assessment by a certified third party after serious risks or large leaks.In effect since Aug 20, 2026
Questions about Vietnam Law on Data
What are the Vietnam Law on Data compliance deadlines?
Jul 1, 2025: Law on Data takes effect.
When does Vietnam Law on Data take effect?
Vietnam Law on Data took effect on Jul 1, 2025.
Who does Vietnam Law on Data apply to?
Vietnamese agencies, organisations and individuals, and foreign organisations and individuals in Vietnam or directly involved in digital data activities in Vietnam.
What are the penalties under Vietnam Law on Data?
Handled under implementing decrees and general administrative and criminal law. The Law itself does not set fine amounts.