On 26 October 2026 Vietnam's draft Data Security Law, prepared by the Ministry of Public Security, was introduced to the 16th National Assembly, according to the Digital Policy Alert tracker. It is not yet enacted. Its arrival follows Decree 333/2026/ND-CP of 19 August 2026, which keeps Vietnam's localisation regime in place. Together they show where Vietnamese data policy is heading, and where it should be corrected.
The strongest case for the state's approach
The government's argument deserves a fair statement. Data that aggregates health, location or critical-infrastructure information can be a national-security asset. A state that cannot compel access to records held abroad may struggle to investigate fraud, respond to incidents or enforce its own law. Localisation is a blunt answer to that problem, but it is an understandable one. Vietnam is not unusual in wanting its regulators to have reach over data about its people.
What Decree 333 actually does
The decree was issued under the Cybersecurity Law (No. 116/2025/QH15), and the official gazette text (Gazette No. 499, 4 September 2026) says it details, among other provisions, Article 25(4) of that law. According to an EY Vietnam legal alert, the decree retains much of the framework of Decree 53/2022/ND-CP, with changes:
- Offshore enterprises face a localisation order only after three written requests within six months and a Ministry of Public Security decision.
- A company that receives such a decision has 12 months to complete storage in Vietnam and set up a branch or representative office.
- The storage form is left free, but the data must be promptly retrievable on request.
- Online applications are added to the services covered.
- "Data on the relationships of service users in Vietnam" is dropped from the regulated categories.
Some of this is a real improvement. A trigger procedure and a 12-month runway are more predictable than an open-ended duty. But the decree still leaves the underlying choice with the ministry, and the EY alert notes that for onshore enterprises it simply says regulated data must be stored in Vietnam.
What the draft Data Security Law adds
The bill is described in Vietnamese parliamentary coverage as risk-based. In a report on the 30 September 2026 verification session, the National Assembly newspaper quotes a Ministry of Public Security official presenting a draft of six chapters and 29 articles that does not impose uniform obligations on all data. The draft covers data security across its lifecycle, including cross-border transfers: overseas cloud, international SaaS, offshore outsourcing and AI training. Digital Policy Alert reports that Level 1 and Level 2 data could be transferred abroad without procedures under the law, with higher levels treated separately. The source material does not describe a localisation mandate in the bill itself, and we should not assume one.
That design is the right instinct. A uniform rule that treats a marketing mailing list like a population registry imposes cost without security benefit. Tiered controls concentrate scrutiny where harm is plausible.
The problem lawmakers have already spotted
The risk is in how the tiers are defined. As the National Assembly newspaper reported on 27 September, Vice Chair Nguyen Hong Dien asked that data importance levels not be treated as identical to cross-border transfer risk levels. His example: encrypted data sent abroad for technical processing carries a different risk from full original data sent for long-term storage. He is right, and the point matters for the businesses the bill will touch.
If a dataset's classification alone determines whether it may leave Vietnam, then a cloud backup with customer-held encryption keys and a raw export to an unaffiliated processor get the same treatment. Firms facing that rule would respond by moving workloads onshore or declining to serve Vietnamese customers. Neither outcome improves security. Onshore storage is no safer if the same vendor and the same weak controls sit behind a local address.
What a proportionate version looks like
Three design choices would keep the bill's risk-based promise honest:
- Score the transfer, not just the dataset. Encryption, key custody, purpose, recipient and retention should change the outcome. This is what the Vice Chair's example implies.
- Make approval timelines binding. For higher-tier transfers that need a ministry decision, statutory deadlines and deemed-approval or reasoned-refusal rules would give AI developers and SaaS providers something to plan around.
- Reconcile the overlapping laws. Delegates have asked for a clearer relationship among the 2024 Law on Data, the personal data protection law and the Cybersecurity Law. A company should not face three classification schemes for one dataset.
The bottom line
Vietnam's choice is not between sovereignty and openness. Decree 333 shows localisation can be made procedural; the Data Security bill shows controls can be tiered. Together they could produce a regime that targets genuinely sensitive data and leaves ordinary commercial flows alone. That outcome depends on drafting details still open in the National Assembly, and on whether the tiers are applied to the risk of a transfer rather than only the label on a dataset. Companies, and the Vietnamese digital economy they serve, should watch those details more closely than the headline.