Việt Nam is drafting a Law on Data Security, with passage scheduled during the first session of the 16th National Assembly in October. Once enacted, it will be the country’s fourth data-related law passed over the last two years. Senior Lieutenant Colonel Nguyễn Đình Đỗ Thi, deputy head of the general staff division at the Cybersecurity and High-Tech Crime Prevention Department under the Ministry of Public Security, spoke with Việt Nam News reporter Bảo Hoa on how these laws work together to create a comprehensive data protection legal framework. 

Senior Lieutenant Colonel Nguyễn Đình Đỗ Thi speaks to reporters at a conference held recently in Hà Nội by the National Cybersecurity Association to guide public compliance with the Law on Cybersecurity and Law on Personal Data Protection. — VNS Photo Bảo Hoa

Can you briefly highlight some of the key points of the Law on Cybersecurity, which just came into force on July 1?

The Law on Cybersecurity has standardised the definition of cybersecurity and other key concepts, and incorporated some elements related to the previously defined ‘cyber information safety’. It also introduces new concepts, such as ‘cyber information security’ and ‘data security’, and specifies prohibited acts linked to the use of advanced technology and tools such as deepfakes and artificial intelligence (AI).

How is the cybersecurity law different from the Law on Personal Data Protection, which took effect earlier this year?

The Law on Cybersecurity focuses on protecting information systems and preventing activities using cyberspace to infringe upon national security and social order. On the other hand, the Law on Personal Data Protection specifies the scope and areas of regulation and strengthens measures to protect personal data. It adds new provisions related to several sectors where data breaches will have a significant impact, such as banking and finance.

It also specifies different levels of penalties for violations of personal data protection. Those who illegally buy and sell personal data can be fined up to 10 times the proceeds from the violation. For violations involving cross-border personal data transfers, the violating enterprise can be fined up to five per cent of its revenue in Việt Nam. Other violations related to personal data protection can carry fines of up to VNĐ3 billion (US$115,000).

A draft Law on Data Security was recently released for public consultation, and the law is scheduled for passage at the National Assembly’s October session. Can you briefly explain why this new law is needed?

The basis for developing and enacting the Law on Data Security can be anchored in some key foundations.

From a political standpoint, the law actualises the Party's directions at the 14th National Party Congress and several resolutions, especially the Politburo’s Resolution 57, which identified ensuring data security as an inseparable and continuous task in the national digital transformation process. This crucial task serves as the foundation for the law-making process.

In practical terms, the law aims to address shortcomings and patch loopholes in the existing laws. While the Law on Data and the Law on Personal Data Protection have been enacted, the former focuses on sharing, connecting and interoperating data to serve national digital transformation and data exploitation. 

The latter only protects one of over 20 types of data, while many other specialised data types such as finance, banking, energy, defence and security also need protection.

Enacting the Law on Data Security is thus absolutely necessary for a complete and comprehensive legal framework that will help protect personal data, and data in general. — VNS