On May 5, 2025, the National Assembly of Vietnam convened for the 9th session, where it discussed the draft Law on Personal Data Protection. The presentation was made by Deputy Prime Minister Lê Thành Long, who emphasized the importance of this legislation in safeguarding individual rights and privacy.
The draft law consists of seven chapters and 68 articles, developed based on the guidelines of Decree No. 13/2023/ND-CP. Deputy Prime Minister Lê Thành Long stated that the purpose of this law is to institutionalize the constitutional regulations concerning human rights, civil rights, and personal privacy. This includes the inviolability of the person, home, correspondence, and the right to protect personal secrets, including information about private lives, personal secrets, and family secrets.
According to Deputy Prime Minister Long, the current legal framework for personal data protection in Vietnam is inadequate. There are 69 existing documents related to personal data protection, but they lack consistency in definitions, content, scope, and protective measures. Currently, only Decree No. 13/2023/ND-CP provides some regulation on personal data protection, but a comprehensive law is still lacking.
Long noted that the draft law aims to address several pressing issues, including the excessive collection of personal data that does not align with the nature of business activities, the lack of legal grounds for collecting personal data, and the unauthorized acquisition and transfer of personal data. Such practices have raised concerns regarding the legitimate rights and interests of individuals and organizations.
In his report, Lê Tấn Tới, Chairman of the Committee on National Defense, Security, and Foreign Affairs, affirmed the necessity of enacting this law. He stated that the law would establish a legal framework for personal data protection, prevent violations of personal data, and enhance the accountability of relevant parties. This aligns with the government’s strategy for digital transformation and international integration.
The draft law introduces two new chapters: one regarding the protection of personal data during its use for business purposes, and another outlining measures and conditions to ensure the protection of personal data. The government proposed that the National Assembly consider and approve the draft law during the 9th session of the 15th National Assembly.
Long also highlighted the need for simplifying administrative procedures and investment conditions to reduce compliance costs and facilitate businesses and individuals. This is crucial for promoting lawful use of personal data to support economic and social development.
However, the Committee on National Defense, Security, and Foreign Affairs raised concerns regarding certain provisions of the draft law. For instance, there were suggestions to reconsider the complete ban on buying and selling personal data, as such a prohibition could negatively impact business operations. Instead, it was proposed to amend the regulation to specifically prohibit the illegal buying and selling of personal data.
Furthermore, the committee pointed out that the draft law must ensure a balance of rights and interests among all parties involved. This includes protecting the rights of data controllers and processors while addressing the requests of data subjects. Some committee members expressed concerns over the feasibility of certain provisions, particularly those requiring data to be modified or deleted within 72 hours upon request, citing potential challenges in infrastructure and personnel.
As discussions continue, the National Assembly is tasked with reviewing the draft law to ensure it meets legal standards and practical applicability. The law is expected to harmonize with international norms and regulations regarding personal data protection, as over 140 countries have already enacted relevant legislation.
In conclusion, the ongoing deliberations on the draft Law on Personal Data Protection reflect Vietnam's commitment to enhancing individual rights and adapting to the digital age. As the country moves towards a digital economy, establishing robust legal frameworks will be essential for protecting personal data and fostering trust among citizens and businesses alike.
