VIETNAM Law and Practice Contributed by: Ngoc Luong Trinh, Tung Nguyen, Hanh Vo, Esko Cate, Nguyen Dang, Khanh Le, Hoang Nguyen and Truc Ta, VILAF
where they qualify as data compilations created through creative selection or arrangement of materi - als. Protection of a data compilation does not extend to the underlying data. Trade secrets are protected as industrial property rights without registration. Protection requires infor - mation that is not common knowledge or easily obtainable, gives the holder a business advantage and is kept secret by necessary measures. Infringement includes unauthorised access, collection, disclosure or use, breach of confidentiality obligations and use or disclosure by a person who knows or should know that the information was obtained unlawfully. Trade names, semiconductor layout designs, geographi - cal indications and plant varieties are also protected under specific statutory rules. As Vietnam continues to develop its digital economy, data has become an increasingly important resource. In this vein, Vietnam’s data protection regime has developed rapidly and now rests on two related but distinct pillars: a broader framework for data govern - ance and a specific framework for personal data pro - tection. The principal legal regulations applicable to data protection are as follows. • At a broader framework level, the 2024 Law on Data (“Law on Data”), adopted by the National Assembly and effective from 1 July 2025, consti - tutes Vietnam’s first comprehensive legal instru - ment governing data-related activities. The Law on Data is supplemented by Decree No 165/2025/ND- CP (“Decree No. 165/2025”), effective on the same date, which provides detailed guidance on imple - menting certain provisions of the Law on Data. Tak - en together, they set out requirements relating to data processing activities (eg, collection, storage, use and transmission), data protection measures, data risk management, the rights and obligations of data subjects and relevant parties (eg, preparing impact assessment dossiers, managing data secu - rity and internal controls and addressing restric - tions or filing obligations for offshore transfers) 8. Data Protection 8.1 Applicable Regulations
and the allocation of regulatory oversight among competent authorities. These instruments mean that businesses operating in Vietnam or handling Vietnam-related data should assess compliance at several levels. This also reflects Vietnam’s increas - ing regulatory attention to high-volume and high- risk processing, including cloud services, artificial intelligence, profiling, platform-based services and other technology-driven business models. • At the level of personal data, Decree No 13/2023/ ND-CP marked Vietnam’s first comprehensive regime dedicated to personal data protection. Although this Decree has now been replaced, it remains important for understanding the evolution of Vietnam’s approach because many of the com - pliance concepts first introduced under that Decree continue to shape the current regime. From 1 January 2026, the 2025 Law on Personal Data Protection (“Law on PDP”) establishes Vietnam’s first higher-level legislative framework specifically gov - erning personal data protection. This Law provides a comprehensive statutory regime, including enhanced enforcement mechanisms and more detailed compli - ance requirements and addresses personal data pro - tection in emerging sectors such as artificial intelli - gence (AI), cloud computing and blockchain. The Law on PDP is followed by Decree No. 356/2025/ND-CP (“Decree No 356/2025”), effective on the same date as the Law on PDP, which implements the Law on PDP and replaces Decree No 13/2023/ND-CP. This Decree provides detailed regulations on administrative proce - dures relating to personal data protection, including personal data processing impact assessments, cross- border data transfer assessments and data breach notification requirements. 8.2 Geographical Scope Both the Law on Data and the Law on PDP adopt an extraterritorial approach, significantly expanding the reach of Vietnamese data regulations to offshore entities and cross-border data flows. In other words, foreign organisations engaging with the Vietnamese market may be subject to local compliance require - ments, even without a physical presence in Vietnam, if they directly participate in or are otherwise connected with, data processing activities involving the Vietnam - ese market or protected categories of Vietnam-related
1185 CHAMBERS.COM
Powered by FlippingBook