Vietnam: Implemented Data Law (No. 2025/QH15) including cross-border data transfer regulation

On 1 January 2026, the Data Law (No. 2025/QH15), including cross-border data transfer regulation, enters into force. The data law specifies that the core and important data that need to be transferred outside Vietnam must be approved by the appropriate authorities, with the Prime Minister overseeing core data and the Ministry of Public Security handling important data. Before transferring such data, the entity must meet several conditions, including passing a security assessment and signing a contract with the foreign recipient. Vietnam will adhere to any relevant international treaties on data transfer, and foreign recipients must comply with Vietnam's data protection standards. Data safety assessments focus on evaluating risks to national security, public interests, and individuals' rights. The assessments must consider the legality, necessity, and sensitivity of the data transfer, along with the recipient’s ability to protect the data. Continuous supervision and periodic reviews are required to ensure ongoing compliance. Requests for data from foreign law enforcement must be handled under Vietnam's international agreements, and domestic entities cannot share data without Vietnamese government approval.