Series
Blogs
Vietnam’s Draft Data Law: Key Takeaways for Multinational Companies
Vietnam’s Draft Data Law: Key Takeaways for Multinational Companies
29 August 2024
Series
Blogs
29 August 2024
Vietnam is refining its data management and security regulatory landscape with the introduction by the Ministry of Public Security (MPS) of a proposed new Data Law.
Now out for public comment, if enacted in its current form, the Data Law will significantly impact multinational companies operating in or with Vietnam. We have provided an overview of some of the key points below.
Ultimately, the purpose of the Data Law is to foster innovation and growth of Vietnam’s data economy. The main goals of the new law include:
However, various obligations (e.g. those related to data management and security for entities and individuals) are also included in the current draft. Some of these may be covered by existing Vietnamese laws. These requirements, if included in the final version of the Data Law, will duplicate existing rules and cause confusion for multinationals’ compliance efforts.
The proposed Data Law applies to agencies, organisations and individuals involved in data activities in Vietnam. The drafting does not expressly extend the application of the Draft Data Law to organisations outside of Vietnam, but that is the market’s expectation based on the country’s legislative trend. Multinationals are known to be pressing the MPS for clarity.
The draft Data Law includes several clauses that are heavily influenced by recent data regulations released in mainland China.
Specifically, the proposed security assessment and approval process for data exports from Vietnam has similar requirements to those under China’s Measures for Security Assessment for Outbound Data Transfer. If retained, these terms – as we discuss below – will present a burdensome process for both organisations and regulators. Indeed, if commentary from many international business stakeholders in mainland China is believed, these regulatory playbooks may impede development of Vietnam’s digital economy.
Other articles of the draft Data Law provide a supervisory hierarchy similar to that formulated under China’s data laws: multiple authorities are challenged to find a balance between national security and economic considerations. Multinationals’ experience tends to be that a multi-authority approach poses a challenge for sustaining a business-friendly environment, particularly in already heavily regulated sectors like financial services.
Cross-border data transfers
Core data and important data
Cross-border data transfers are subject to stricter regulation under the proposed Data Law, particularly for two newly-formed categories of “core data” and “important data”.
These concepts will be exceptionally familiar to businesses tracking the evolution of China’s Data Security Law. However, extrapolating from learnings in other jurisdictions, these concepts are exceptionally difficult to define. In the worst case, formulating appropriate catalogues of data may – even if only a matter of perception and not the reality – lead to a subjective or politicised classification as opposed to one that is made objectively by industry-experts from (for instance) the relevant industry regulators. The uncertainty that will inevitably arise will affect investors’ investment strategies.
Data export requirements
Exporting core data or important data requires approval from the relevant authorities (such as the Prime Minister's Office or the MPS), and either passing a government-led security assessment or signing a prescribed standard contract. None of these requirements are clearly or fully set out in the proposed law and businesses await implementation rules to clarify each of these frameworks:
The draft Data Law grants government entities the power to request data from entities and individuals in “special cases”, such as public emergencies or when data is crucial for fulfilling specific public tasks but not otherwise available. It also sets the responsibilities of government agencies in handling such data, including only using the data for the stated purpose, implementing necessary technical and organisational measures, and destroying it when no longer needed.
The ambiguity of the scope of “special cases” and the other parameters to this government power could leave Vietman in the situation were its laws are found under the EU's General Data Protection Regulation and other regimes to lack sufficient precision and proportionality to allow organisations to export personal data to Vietnam. If left unremedied, multinationals may struggle to legally share data between global and Vietnamese operations; similarly, Vietnamese domestic champions looking to expand abroad may face regulatory barriers or even investigations where they seek to transfer personal information back to Vietnam in breach of overseas data principles (in the manner beset Uber in the Netherlands in the last few days).