The Ministry of Public Security has drafted a Data Security Law that would reorganise Vietnam’s data‑protection landscape through a five‑tier risk classification. Understanding this shift is essential for anyone working in or running a tech‑focused enterprise in the country.

At its core, the proposal adopts a risk‑based regulatory model, echoing trends in global data‑governance. By applying the legal principle of proportionality, the law intends to match the intensity of state intervention with the actual danger posed by the data. This design seeks to prevent both lax oversight of sophisticated threats and blanket controls that would inflate compliance costs for low‑risk activities.

The draft delineates five risk levels, from Level 1 (the lowest) up to Level 5 (the highest), and ties each tier to progressively stricter protection duties. Data placed in Levels 1 and 2 would generally be subject to little or no administrative formalities, whereas from Level 3 onward controllers must carry out impact assessments and regular audits. For the topmost tiers, Levels 4 and 5, a formal data‑security appraisal is required before the associated systems may commence operation.

Cross‑border transfers will be subject to controls that rise with the data’s risk tier. Low‑risk data can flow with minimal paperwork, while higher‑risk categories face stricter checks.

The legislation also expands responsibility across the entire data‑related supply chain. Organisations must evaluate the risks posed by suppliers, limit their access to sensitive information, and continuously monitor permissions, revoking them when threats emerge. For processing systems handling high‑risk data, the draft calls for tighter remote‑access controls on service‑provider connections.

In practice, the tiered framework means that businesses handling low‑risk data will encounter only modest paperwork, while those dealing with high‑risk information must invest in impact studies, audits and supply‑chain safeguards. Companies and tech professionals should therefore recalibrate their compliance programmes to reflect the proportional duties attached to each risk level.