Vietnam: Adopted Data Law (No. 2025/QH15) including data localisation requirement

On 30 November 2024, the Parliament adopted the Data Law (No. 2025/QH15), including data localisation requirements. This requirement mandates that certain categories of data, identified as core and important, must be stored within Vietnam to ensure national security and privacy. The law establishes a data localisation requirement by mandating that national and specialized databases, as well as certain sensitive data, must be stored within Vietnam, particularly in the National Data Center. Core data is defined as data with broad coverage across different sectors, groups, and regions that, if misused, could have a direct impact on political security. Important data includes information that, if compromised, may endanger national security, economic operations, social stability, and public health. This includes data relating to national security, vital economic activities, essential public services, and other sensitive areas identified by national authorities. Exporting core or important data requires approval from relevant authorities and either passing a security assessment or signing a standard contract. The Data Law gives government bodies the power to request data in special cases, such as public emergencies.