Hanoi (VNA) – The 16th National Assembly, continuing its second session, put the draft Law on Data Security under plenary scrutiny in Hanoi on November 4 morning.
The bill sets rules and safeguards for data security, define rights and duties, and assign state management. It will cover Vietnamese and foreign entities in Vietnam, and foreign ones outside Vietnam that process data under Vietnamese jurisdiction or breach Vietnam’s data security.
It creates five risk tiers. Data controllers will self-classify, apply matching safeguards and bear responsibility for the outcome under a mainly ex-post supervision model. Controllers at Level 3 and above will have to assess impacts and conduct periodic security audits, while Level 4 and Level 5 systems will require formal appraisal. Safeguards will run from system design through data destruction.
Deputy Doan Hung Vu from southern Dong Thap province pushed to require that data security personnel for Level 5 systems be dedicated staff with appropriate information security qualifications. He also called for annual data protection drills covering both system vulnerability incidents and human factor failures.
Deputy Nguyen Vu Trung from Ho Chi Minh City said incidents at Level 3 and above should be reported within 24 hours of discovery, with immediate notice in especially serious cases and updates after verification. Affected individuals should be told without delay what data may have leaked, what risks remain, how to lock accounts, change passwords or block transactions, and whom to contact.
According to him, the focal agency should work with banks, telecom operators and digital platforms to issue warnings and stop risks from spreading. Slow response to a breach can widen damage, especially in identity theft, account takeover and financial fraud. For emergency technical measures, he sought clear legal grounds, scope, time limits and recovery plans.
Deputy Le Minh Nam from Can Tho city flagged voter concern over personal data protection and whether the public will genuinely feel safe. He welcomed the push for data interoperability so citizens need not resubmit information already on file, but said technology platforms and rollout must be integrated, secure and convenient for the policy to work in practice.
Nam also said data controllers must promptly notify affected people when personal data leaks, with guidance on avoiding fraud. People need to know what data may have been exposed so they can guard against fake calls and messages that use accurate personal details, or even cloned voices or images of relatives.
Minister of Public Security Luong Tam Quang said the drafting agency will coordinate closely with the permanent members of the NA Committee for National Defence, Security and Foreign Affairs, absorb lawmakers’ comments and report to the NA Standing Committee before finalising the bill. The goal, he said, is a law that protects national sovereignty while creating a safe, favourable legal environment for digital economic growth./.
