Law on Data 2024 (Law No. 60/2024/QH15) (English summary)

• Full title: Law No. 60/2024/QH15 on Data
• Issued by: the 15th National Assembly, 8th session, passed on 30 November 2024 (signed by Chairman of the National Assembly Tran Thanh Man)
• In force from: 1 July 2025 (Article 45)
• Structure: 5 chapters, 46 articles
• Amends: the list of fees attached to the Law on Fees and Charges (two new fees for using state databases) and the Law on E-Transactions No. 20/2023/QH15 (Article 44)
• Implementing texts: Decree 160/2025/ND-CP (National Data Development Fund); Decree 165/2025/ND-CP (detailed rules; Article 16(2) amended by Article 42(3) of Decree 356/2025/ND-CP); Decree 169/2025/ND-CP (science, technology, innovation and data products and services); Decision 20/2025/QD-TTg (list of important data and core data); Decree 314/2026/ND-CP (data exchanges)
• Administrative penalties: Decree 363/2026/ND-CP, in force from 11 November 2026
• Published in: Official Gazette Nos. 1523 + 1524 of 29 December 2024
• Official Vietnamese text: Official Gazette copy on the Government portal (PDF)

Note: this page is LexData’s own unofficial English summary. It is not the full text of the Law or an official translation. Only the Vietnamese text has legal effect. The detail focuses on the provisions that apply to businesses (Articles 3, 4, 10, 13, 14, 17, 18, 22, 23, 25 to 27 and 39 to 43); the chapters on the National Data Centre and the National General Database are only outlined. The summary was checked against the Official Gazette texts as of 17 October 2026.

---

Scope and structure

The Law governs digital data; the building, development, protection, governance, processing and use of digital data; the National Data Centre; the National General Database; data products and services; state management of data; and the rights and duties of everyone involved (Article 1). It applies to Vietnamese agencies, organisations and individuals, to foreign ones in Vietnam, and to foreign ones that take part in or are connected with digital data activities in Vietnam (Article 2).

Unlike Law No. 91/2025/QH15 on Personal Data Protection, the Law on Data covers all digital data, including data that identifies no one: transaction records, operational data, data about companies.

Chapter	Subject	Articles
I	General provisions (definitions, relationship with other laws, principles, state policy, state management, prohibited acts)	1-10
II	Building, protecting, governing, processing and using data; National Data Development Fund	11-29
III	National Data Centre; National General Database	30-38
IV	Data products and services	39-43
V	Final provisions	44-46

Key definitions (Article 3)

Term	Meaning in short	Clause
Digital data (“data”)	Data about things, phenomena or events in the form of sound, images, numbers, text or symbols expressed digitally	1
Shared, private-use and open data	Categories by how data may be shared; the first two concern Party and state bodies, the Fatherland Front and socio-political organisations; open data is data anyone may access and use	2-4
Original data	Data created in the course of activities or by digitising original documents	5
Important data	Data that may affect national defence, security, foreign affairs, the macro-economy, social stability, or public health and safety, and is on the list issued by the Prime Minister	6
Core data	Important data that directly affects those interests, also on the Prime Minister’s list	7
Data subject	Any agency, organisation or individual that the data reflects (wider than the PDPL’s data subject, which is always a natural person)	12
Data administrator	The party that builds, manages, operates and exploits data at the request of the data owner	13
Data owner	The party entitled to decide on building, developing, protecting, governing, processing, using and exchanging the value of data it owns	14
Data owner’s rights	Property rights under civil law	15

The data owner and data administrator pairing is close to, but not the same as, the controller and processor pairing under the PDPL. Most detailed duties in Decree 165/2025/ND-CP fall on the data administrator.

Relationship with other laws (Article 4)

• Where a law issued before the Law on Data took effect contains rules on data activities that are consistent with its principles, that law applies (Clause 1).
• A law issued after that date that departs from the Law on Data must say expressly which parts of the Law on Data do or do not apply (Clause 2).
• For personal data, Article 5(4) of the PDPL provides that a business that has carried out a personal data processing impact assessment and a cross-border transfer impact assessment under the PDPL need not do the risk assessment or cross-border impact assessment required by data legislation.

Principles, state policy and state management (Articles 5 to 9)

Article 5 requires compliance with the Constitution and the law, openness and equal access, accurate and secure data, and protection built in alongside development. The State encourages domestic and foreign investment in data storage and processing centres in Vietnam and in a data market (Article 6(5)). Requests from foreign law enforcement or judicial authorities for data of Vietnamese organisations and individuals are decided by the competent Vietnamese authority (Article 7(3)).

The Ministry of Public Security (MPS) is the lead regulator, except for data under the Ministry of National Defence (Article 8(2)(b) and (c)).

Prohibited acts (Article 10)

1. Using data processing, data governance or data products and services to harm national interests, defence, security, public order or the lawful rights of others.
2. Unlawfully obstructing data processing or governance, or attacking, seizing or sabotaging databases and information systems.
3. Falsifying, deliberately distorting, losing or damaging data in databases of Party and state bodies, the Fatherland Front or socio-political organisations.
4. Deliberately providing false data, or failing to provide data, where the law requires it.

Collection, classification and storage (Articles 11 to 14)

• Collection (Article 11(3)): organisations and individuals may collect and create data for their own activities in line with the law, are protected as data owners and are responsible for the data they collect.
• Classification (Article 13): state bodies classify data by sharing status, by importance and by other criteria (Clause 1). Data owners and data administrators that are not state bodies must classify their data by importance as core, important or other, and may add other criteria (Clause 2). The criteria are in Articles 3 and 4 of Decree 165/2025/ND-CP (Clause 3).
• Storage (Article 14): private data owners decide how to store their own data, but storage of core and important data must comply with Article 27(3) (Clause 2). Under Article 5(1) of Decree 165/2025/ND-CP, the data owner sets the retention period for data it collects or creates.

Criteria in Decree 165/2025/ND-CP. Important data is data that could cause dangerous effects, and core data is data that directly causes dangerous effects, if collected or used unlawfully, excluding state secrets. The four areas are national security and sovereignty; foreign relations, energy and maritime security; the macro-economy, key industries, money, trade and essential supplies; and the life, health, property and lawful interests of organisations and individuals, disease control, labour supply and public services (Articles 3 and 4).

The list in Decision 20/2025/QD-TTg (in force 1 July 2025) has 26 items of core data and 18 items of important data; all core data is also important data (item II.1 of the Appendix). Most items are non-public data collected or managed by state bodies. Two items, “non-public data on organisations and citizens”, turn on volume, are not limited to state bodies and do not name the holder:

Non-public data	Important data (item II.18)	Core data (item I.26)
Basic data of Vietnamese citizens	100,000 or more citizens	1,000,000 or more citizens
Sensitive data of Vietnamese citizens	10,000 or more citizens	100,000 or more citizens
Bank account, payment history and debt data of Vietnamese enterprises and organisations	10,000 or more	100,000 or more

Decision 20/2025/QD-TTg does not define “basic citizen data” or “sensitive citizen data”. Ministries and provincial People’s Committees guide classification in their sectors and localities (Article 2(3)(a) of the Decision).

Governance, access, connection and sharing (Articles 15 to 17)

• Private data owners and administrators govern their data as their circumstances allow (Article 15(4)).
• Access and retrieval must follow technical procedures, be secure and serve the stated purpose (Article 16(1)); Article 6 of Decree 165 limits access to the rights granted and what the purpose requires.
• Data owners and administrators share data with users under the law or by agreement, directly or through an intermediary (Article 17(1)). State bodies support private owners that share data with the State (Article 17(4); Article 7 of Decree 165).

Mandatory provision of data to the State (Article 18)

Organisations and individuals are encouraged to share data with the State (Clause 1). They must provide data on request of a competent authority, without the data subject’s consent, in four situations (Clause 2):

1. responding to a state of emergency;
2. a threat to national security short of a declared emergency;
3. disasters;
4. preventing and combating riots and terrorism.

The receiving authority must use the data only for that purpose, keep it secure, destroy it when no longer needed and notify the data subject and the provider (Clause 3).

Procedure under Article 8 of Decree 165/2025/ND-CP: the request must be in writing or otherwise confirmed and must state the type, detail, volume, frequency and method of delivery, the legal basis, purpose and period of use, and the deadline, together with the sanctions for non-compliance (Clause 2). Handover is recorded in minutes (Clause 3(c)). The provider may ask for an unlawful or out-of-scope request to be amended or withdrawn (Clause 5). Requests may be made by ministers, heads of ministerial-level agencies, chairs of provincial People’s Committees, the Director of the National Data Centre and directors of provincial police departments (Clause 6).

Analysis, confirmation, publication and encryption (Articles 19 to 22)

• Private parties may analyse and aggregate data from sources they are permitted to access and use (Article 19(2)).
• Data is confirmed and authenticated by the data owner, the data administrator or an electronic authentication provider (Article 20; Article 9 of Decree 165).
• Data owners and administrators decide on encryption and decryption (Article 22(3)). Competent authorities may decrypt data without the owner’s or administrator’s consent in the same four situations as Article 18 (Article 22(4)); the Minister of Public Security decides or delegates, except in military and defence matters (Article 11(2) of Decree 165).

Cross-border transfer and processing (Article 23)

Transferring data into Vietnam and processing foreign data in Vietnam is free (Clause 1). Cross-border transfer and processing of core and important data covers (Clause 2):

• moving data stored in Vietnam to a storage system outside Vietnam;
• a Vietnamese party transferring data to a foreign organisation or individual;
• a Vietnamese party using a platform outside Vietnam to process data.

Procedure under Article 12 of Decree 165/2025/ND-CP:

Step	Core data	Important data	Source
Impact assessment	Required, once for the life of the business, updated when facts change	Same	Clauses 1 and 8
File	Report on Form 02 and supporting documents; contract with the recipient containing mandatory terms	Same	Clauses 3 and 4
Filing with the MPS (or the Ministry of National Defence)	File for assessment; result within 10 days of a complete file, up to 15 days if complex; transfer only after a pass	Send one original 15 days before processing; no prior approval needed	Clauses 5 and 6
Exceptions (emergencies; cross-border HR management; transfers truly needed to conclude or perform a contract)	No approval needed; impact assessment filed after the transfer	No advance filing; impact assessment filed after the transfer	Clauses 11 and 12

Volumes are counted cumulatively from 1 July 2025 (Clause 10). The MPS or the Ministry of National Defence may order a transfer to stop if the data is misused or the transferor breaches the rules (Clause 9). Filing notices use Form 01a (individuals) and Form 01b (organisations), addressed to the National Data Centre, MPS.

Core and important data that is personal data. Article 16(2) of Decree 165/2025/ND-CP, as amended by Article 42(3) of Decree 356/2025/ND-CP, provides that this data is protected under the PDPL. For cross-border transfer and processing, the data administrator prepares the PDPL impact assessment and cross-border transfer dossiers and does not do the risk assessment or impact assessment under Decree 165.

Risk, protection and deletion (Articles 25 to 27)

• Risk (Article 25): privacy, cybersecurity, identity and access management and other risks (Clause 1). Private data administrators assess their own risks, take protective measures and notify affected parties (Clause 3). Administrators of core and important data must assess risk periodically and notify the cybersecurity units of the MPS and the Ministry of National Defence (Clause 4).
• Deletion (Article 26): data subjects may ask for data they provided to be recalled, deleted or destroyed, unless the law provides otherwise (Clause 1). Under Article 13(1)(b) of Decree 165, deletion is done within 72 hours of the request unless the law provides otherwise.
• Protection (Article 27): policies, management of processing, technical solutions and staff measures throughout processing (Clause 1). Owners and administrators of core and important data must comply with the data protection rules (Clause 3).

Detailed duties for core and important data (Decree 165/2025/ND-CP):

Duty	Source
A management system for data protection across the whole processing cycle	Article 17(1)
Procedures for collection, and for storage with backup, recovery and logging; least-privilege access control	Article 17(2) to (4)
Processing logs kept for at least six months	Article 17(10)
Annual risk assessment, with a report on Form 06 kept available for inspection (not needed where a cross-border dossier under Article 12 exists)	Article 17(11)
Deletion documented as irreversible	Article 17(7)
On reorganisation or dissolution, report the data handling plan and recipient to the authorities	Article 17(8)
Outsourcing: contract, check the recipient’s capability, encrypt and digitally sign; keep outsourcing records for important data for at least three years	Article 16(3); Article 17(9)
A person responsible for data protection and a data security unit; no one with a criminal record in IT or telecoms in that role; confidentiality undertakings from staff; annual training	Article 18
Report security incidents involving core or important data to the MPS or the Ministry of National Defence as soon as possible; emergency drills every six months	Article 19(4) and (8)

Data products, services and exchanges (Articles 39 to 43)

• Data intermediaries (Article 40): products and services that set up commercial relationships between data subjects, data owners and users to exchange, share or access data. Providers must register under investment law, except for purely internal services. Under Decree 169/2025/ND-CP, intermediaries between users and state bodies need an MPS certificate of eligibility (Article 23(3)): the legal representative must be a Vietnamese citizen resident in Vietnam, there must be at least five qualified graduate staff, infrastructure in Vietnam and a deposit of at least VND 5 billion (Article 25). Cloud and data centre services are outside this regime (Article 23(4)).
• Data analysis and aggregation (Article 41): businesses whose products could harm defence, security, public order, social ethics or public health must register under investment law. Decree 169/2025/ND-CP sets four levels by the degree of AI involvement (Article 27) and requires a certificate for level 3 and 4 products used in state information systems, products connected to national or sector databases, and products using core or important data (Article 28(1)).
• Data exchanges (Article 42): only public service units and state-owned enterprises may operate a data exchange (Clause 2). Data that may not be traded: data that endangers defence, security, foreign affairs or cipher work; data without the data subject’s consent unless the law provides otherwise; other prohibited data (Clause 3). Decree 169 adds core and important data to the non-tradable list (Article 33(6)(a)). Decree 314/2026/ND-CP (in force 25 September 2026) sets up the National Data Exchange run by the National Data Centre (Article 5), bans the use of exchanges to buy and sell personal data and allows data derived from personal data only once de-identified (Article 4(6)); foreign legal entities need a commercial presence, branch or representative office in Vietnam to trade (Article 16(2)).
• General duties (Article 43): service contracts, a working contact channel, ongoing security monitoring and compliance with network security, cybersecurity and e-transactions law.
• Intermediary and analytics providers receive the incentives available to high-tech, innovative start-up and digital technology businesses (Article 39(3)).

National Data Development Fund and National Data Centre (Articles 29 to 38)

• The National Data Development Fund is a non-profit state fund outside the budget (Article 29). Decree 160/2025/ND-CP (in force 1 July 2025) places it under the MPS and governs the Fund’s on-lending through banks, cost support and investment activities (Chapter IV).
• The National General Database is built and managed centrally at the National Data Centre (Article 33). Private parties may use open data freely, personal data with the consent of the National Data Centre and of the data subject, and other data with the Centre’s consent (Article 35(3)(c)). Using data that is not one’s own is subject to fees (Article 38(3)).

Administrative penalties

The Law sets no fines. Decree 363/2026/ND-CP of 19 September 2026 on administrative penalties in the data sector applies from 11 November 2026 (Article 34); it is not yet in force on 17 October 2026. Key points:

• The maximum fine for an individual is VND 100 million. Amounts in Chapter II are for individuals, except Article 8(1)(b), Articles 9 and 10, Article 13(2) and Article 16(4), which are set for organisations; organisations otherwise pay double (Article 6). The limitation period is one year (Article 3(1)).
• Failing to classify data, or to update and review the classification: VND 30-50 million for an organisation (Article 9(1)(a) and (b)).
• Storing core or important data on systems outside Vietnam or run by foreign parties in breach of the rules: VND 30-70 million for an organisation (Article 10(2)(c)).
• Transferring core data abroad without an impact assessment or written approval: VND 60-80 million at the individual rate (Article 19(3)).
• Failing to carry out periodic risk assessments of core or important data: VND 20-40 million at the individual rate (Article 22(2)(a)); failing to report incidents involving core or important data to the MPS or the Ministry of National Defence: VND 60-100 million at the individual rate (Article 22(4)(a)).
• Additional sanctions include suspension of data transfer, processing or connection activities, withdrawal of certificates and expulsion of foreign nationals (Article 4(2)).
• Decree 363 does not cover conduct within the scope of the cybersecurity and personal data protection penalty decree (Article 1(2)); that conduct is fined under Decree 330/2026/ND-CP.

Implementing texts

Document	Subject	In force
Decree 160/2025/ND-CP of 29 June 2025	National Data Development Fund (Article 29(4))	1 July 2025
Decree 165/2025/ND-CP of 30 June 2025	Detailed rules: criteria for core and important data, provision of data to the State, cross-border transfer, protection duties, National General Database, Forms 01a to 07b	1 July 2025; Article 16(2) amended by Decree 356/2025/ND-CP from 1 January 2026
Decree 169/2025/ND-CP of 30 June 2025	Science, technology, innovation and sandbox; intermediary and analytics services; data exchanges; certificates of eligibility	1 July 2025
Decision 20/2025/QD-TTg of 1 July 2025	List of important data and core data	1 July 2025
Decree 314/2026/ND-CP of 8 August 2026	Operation of data exchanges, National Data Exchange, trading procedure	25 September 2026
Decree 363/2026/ND-CP of 19 September 2026	Administrative penalties in the data sector	11 November 2026

Decrees 165 and 169 and Decision 20 were signed by Deputy Prime Minister Nguyen Chi Dung; Decree 160 by Deputy Prime Minister Ho Duc Phoc; Decrees 314 and 363 by Deputy Prime Minister Ho Quoc Dung.

Entry into force and transition (Articles 45 and 46)

The Law took effect on 1 July 2025 (Article 45). The only transitional rule concerns state bodies that had already built or leased infrastructure for national databases (Article 46); there is no transition period for businesses.

Sources checked

LexData checked this summary against Law 60/2024/QH15 in Official Gazette Nos. 1523 + 1524 of 29 December 2024; Decree 165/2025/ND-CP and Decision 20/2025/QD-TTg in Official Gazette Nos. 909 + 910 of 17 July 2025; Decree 169/2025/ND-CP in Nos. 889 + 890 of 15 July 2025; Decree 160/2025/ND-CP in Nos. 863 + 864 of 10 July 2025; Decree 314/2026/ND-CP in No. 479 of 25 August 2026; and Decree 363/2026/ND-CP in No. 530 of 2 October 2026.

See our article on the Vietnam data law for foreign-invested companies and the summary of the Personal Data Protection Law for personal data.