The draft Law on Data Security establishes five levels of data security risk. Data controllers will be responsible for classifying risks and applying corresponding protection measures, primarily under a post-inspection mechanism. Protection measures will cover the entire data lifecycle, from system design to data destruction.
For artificial intelligence research, development and application, the draft law requires the origin and integrity of training and derived data to be ensured, while prohibiting data poisoning and unauthorised data extraction. It also provides for human intervention and oversight of automated decision-making in accordance with the law.
Regarding cross-border data transfers and processing, level-one and level-two data will be exempt from procedures under the law. Controllers of level-three data must conduct their own assessments and retain relevant records, while transfers of level-four and level-five data will require prior appraisal and approval by competent authorities. The draft also addresses foreign requests for data provision, responsibilities of cross-border service providers, and the integration of data security assessments into existing investment and technology transfer procedures.
The revised Law on Handling of Administrative Violations comprises six chapters and 128 articles. It proposes extending the statute of limitations for administrative penalties to two or three years in certain sectors, raising maximum fines to VND1.5 billion (US$58,200) for individuals and VND3 billion for organisations, and specifying maximum fines for each sector.
Reviewing the draft, the National Assembly’s Committee for Legal and Judicial Affairs called for further scrutiny and differentiated provisions on sectors eligible for extended limitation periods, ensuring that violations are detected and prevented promptly and penalties imposed swiftly.
The committee also cautioned that extending the limitation period to three years, or up to four years in cases referred by procedural authorities, could narrow the legal distinction between administrative violations and criminal offences, given that the statute of limitations for less serious crimes is five years. This could expose violators to more severe legal consequences and therefore requires particularly careful consideration.
