DATA LAW 2024 UPDATE: KEY HIGHLIGHTS AND REGULATIONS

On November 30, 2024, the National Assembly of Vietnam passed Data Law 2024 (Law No. 60/2024/QH15), which will take effect on July 1, 2025. This law establishes a robust legal framework for the governance, protection, and development of data in Vietnam.

Key Highlights of the Data Law 2024

Entities subject to strict regulation

• Domestic and foreign organizations and individuals involved in data-related activities in Vietnam must comply with the law.

• Critical and core data: This includes data concerning national defense, security, diplomacy, macroeconomic stability, and public safety, which will be subject to stringent oversight and special protection standards.

• National databases: These must be stored on the infrastructure of the National Data Center to ensure security and integrity.

Licensing conditions and procedures for data services

• Intermediary data services:

  • Organizations providing intermediary data services (such as connecting, sharing, or accessing data) must register their operations and comply with investment regulations, except for internal services.

  • They must adhere to strict regulations regarding data safety, information security, and cybersecurity.

• Data analysis and aggregation services:

  • If these services could pose risks to national security, defense, or public health, providers must register and be subject to special oversight by state agencies.

  • Providers must obtain approval from the competent authorities to connect with national databases for analysis or aggregation purposes.

• Data exchange platforms:

  • Only licensed public service entities or state-owned enterprises can provide these services.

  • The data traded must comply with stringent regulations and avoid breaching security, defense, or individual rights.

Types of data allowed for trading on data exchange platforms

• Permitted data for trading:

  • Data not classified as state secrets or prohibited for trading.

  • Personal data with the data subject’s consent or where allowed by law.

  • Other data authorized for trading by the data owner.

• Prohibited data for trading:

  • Data that could harm national security, defense, or diplomacy.

  • Data without the consent of the data subject.

  • Other data prohibited by law.

 Is data considered an asset under the law?

• According to the Data Law, data is considered an asset, and ownership rights over data are regarded as property rights under civil law. Data owners have full authority to develop, protect, exploit, and exchange the value of their data.

Are businesses required to provide data to state agencies?

• Businesses are required to provide data to state agencies upon lawful requests in the following cases:

  • Responding to emergencies.

  • Threats to national security.

  • Natural disasters, terrorism, riots, or similar situations.

• State agencies must ensure the proper use of the data, maintain its confidentiality, and delete it when no longer needed.

Procedures for transferring data abroad

• Transferring data abroad must comply with:

  • National security, defense, and public interest protection requirements.

  • Approval from the competent state authority, particularly for critical and core data.

  • Organizations and individuals transferring data must ensure safety, confidentiality, and adherence to applicable international agreements signed by Vietnam.

Evaluation and Prospects

Data Law 2024 establishes a clear legal framework for data management while creating opportunities for organizations and businesses in the data economy. However, organizations must:

• Invest in infrastructure: Ensure the efficient operation of the National Data Center and related systems.

• Train personnel: Enhance professional capacity in data processing and management.

• Monitor compliance: Develop mechanisms for oversight to prevent misuse of data and safeguard privacy.

Data transformation is not just a trend but a legal responsibility and economic opportunity in the globalized era. This law is a crucial milestone in Vietnam’s journey towards a digital transformation and a thriving data-driven economy.

Our firm remains committed to supporting businesses during this dynamic time. Please contact Altas at the email contact@altas.vn or Member Lawyer Chris Luong at the email chris.luong@altas.vn if you have any questions or need assistance in the fields of data, personal data protection, and technology.