Vietnam: Implemented Data Law (No. 2025/QH15) including data localisation requirement

On 1 January 2026, the Data Law (No. 2025/QH15) including data localisation requirements enters into force. This requirement mandates that certain categories of data, identified as core and important, must be stored within Vietnam to ensure national security and privacy. The law also establishes a data localisation requirement by mandating that national and specialised databases, as well as certain sensitive data, must be stored within Vietnam, particularly in the National Data Center. Core data is defined as data with broad coverage across different sectors, groups, and regions that, if misused, could have a direct impact on political security. Important data includes information that, if compromised, may endanger national security, economic operations, social stability, and public health. This includes data relating to national security, vital economic activities, essential public services, and other sensitive areas identified by national authorities. Exporting core or important data requires approval from relevant authorities and either passing a security assessment or signing a standard contract.