Vietnam has now built two layers of data control within three months of each other. On 19 August 2026 the Government issued Decrees 331, 332 and 333 to implement the Law on Cybersecurity. On 26 October 2026 a draft Data Security Law, which includes cybersecurity provisions, was introduced to the National Assembly. Read together, they show a regulator moving from blunt localisation rules toward a risk-based model. They also show how easily the old instruments could survive inside the new one.
The strongest case for the bill
The government's argument deserves a fair hearing. Data breaches in a fast-digitising economy can reach critical infrastructure, financial systems and millions of citizens. A single statute that says who is responsible for protecting data, and how strictly, is better than scattered obligations across telecoms, cybersecurity and e-commerce rules. The Ministry of Public Security describes the draft as six chapters and 29 articles, and says it sets five data security risk levels, from Level 1 (lowest) to Level 5 (highest), based on the likelihood of an incident and the damage it could cause to national defence, security, public order and the rights of organisations and individuals (Chinhphu.vn, 25 October 2026).
That design is, in principle, what proportionate regulation looks like. According to the same government summary, Levels 1 and 2 involve almost no administrative procedure. Level 3 and above require impact assessments and periodic audits. Levels 4 and 5 are appraised together with cybersecurity appraisal before a system goes into official operation. A hospital's appointment calendar and a national identity database should not carry the same compliance burden, and this draft says so. Vietnam News reports that data controllers would classify risk and apply matching protections, "primarily under a post-inspection mechanism" (Vietnam News, 4 November 2026). Letting owners classify their own data, with enforcement after the fact, is far lighter than licensing every system in advance.
Where the design strains
The weakness is at the top of the scale and at the border. The official summary says the draft provides for strict cross-border controls differentiated by risk level. Vietnam News reports that Level 4 and 5 transfers would need prior appraisal and approval by competent authorities. Secondary law-firm and press reports go further, saying a draft version bans export of "core" data and requires Ministry of Public Security approval for some transfers. I could not confirm those two details in the official material I could read, and they may change as the Assembly deliberates. If they hold, the practical effect is a permission regime for the data that matters most to cloud providers, banks and AI developers.
Self-classification adds a second problem. The scheme is meant to be light, but the downside of a wrong call falls entirely on the data owner. Under-classify and you risk enforcement; over-classify and you take on audits and appraisals. Companies facing that asymmetry tend to classify upward. A tiered system with vague criteria and a high-end approval gate drifts toward the same outcome as blanket rules, because every cautious firm lands in the expensive tiers.
The ministry's public draft file was open for consultation from 17 July to 5 August 2026 (Ministry of Public Security). The annexes and explanatory report sit in attached files. The Assembly should publish an explicit, objective methodology for assigning levels, so that classification is a technical exercise and not a negotiation.
Decree 333 is the layer underneath
The bill does not replace the localisation duties already in force. EY's analysis says Decree 333 retains a substantial part of the data-localisation framework from Decree 53/2022. Regulated data is personal information of service users in Vietnam and data generated by those users. The decree drops the earlier category of data on the relationships of service users, and it adds online applications to the covered services (EY Vietnam, 18 September 2026).
The split between domestic and foreign firms matters. Duane Morris describes an automatic local-storage obligation for Vietnam-incorporated enterprises, including foreign-invested ones (Duane Morris, 27 August 2026). Offshore providers face a conditional trigger. EY lists three cumulative conditions: the service was used in a cybersecurity violation, the specialised authority issued three written requests within six months, and the enterprise failed to remedy the problem. The Minister of Public Security can then order localisation, with 12 months to comply.
That offshore design is more measured than a universal mandate, and it is a real improvement on a rule that applies to everyone from day one. But it keeps the state's leverage intact. A foreign platform that wants to avoid an order must keep its Vietnam-facing operations clean enough that three written requests never accumulate.
What would make this work
The evidence from other jurisdictions is that localisation raises costs without clearly improving security. A breach of a domestic server is no less damaging than a breach of a foreign one. What improves security is encryption, access control and incident response, which is what the lower tiers of the bill emphasise. MLex reported on 27 October that Vietnam is weighing decryption-key controls as an alternative to localisation (MLex). Whether that reflects the bill's direction is unclear because the article is paywalled. Control over keys is still a sharper tool than control over server location, and it is easier to reconcile with cross-border business.
Three changes would keep the bill's good idea intact:
- Publish the classification criteria in the statute or a binding schedule. Owners should be able to predict their own level.
- Define "core" data narrowly and by list. An export ban is defensible for a short, named set of state-secret-adjacent categories. It is not defensible as an open-ended category.
- Set deadlines and reasons for approvals. Level 4 and 5 transfer decisions need a statutory clock and a written explanation, with deemed approval if the authority is silent.
Vietnam's ambition to be a regional digital hub depends on foreign investment in data centres, cloud services and AI. A risk-tiered law could support that, or it could bolt a new approval layer onto Decree 333 and make the whole stack harder to navigate. The Assembly's deliberation is the moment to choose which.