TL;DR
Vietnam is rapidly accelerating its data sovereignty agenda by moving beyond corporate administrative fines to propose direct, severe criminal liability for personal data infractions. This legislative push, marked by a new draft Law on Data Security and proposed Penal Code amendments, introduces a strict risk taxonomy and potential ten-year prison sentences for data trafficking. Compliance teams must prepare for an environment where data residency failures shift from balance-sheet risks to individual criminal liabilities.
Vietnam's Shift to Criminal Enforcement and Tiered Data Governance
Vietnam is rapidly transforming its data compliance landscape by layering severe criminal penalties for individuals atop its strict corporate data localization requirements.
"Unlike other jurisdictions where data protection enforcement is primarily civil and administrative, Vietnam is aggressively integrating severe criminal penalties (up to 10 years' imprisonment) directly into its Penal Code." — vietnam-data-security-law-draft-limits-2026
This transition means that multinational compliance teams cannot treat Vietnam's data localization mandates as mere administrative hurdles. By introducing broad extraterritorial jurisdiction that targets foreign entities, the state is making localized data security a matter of individual executive liability vietnam-data-security-law-draft-limits-2026.
What to watch: The National Assembly's upcoming legislative vote, which will determine whether these strict measures officially take effect vietnam-data-security-law-draft-limits-2026.
What surprised us
- The Extraterritorial Discretion of the DSL: The draft Law on Data Security applies to foreign organizations "directly involved in or related to" data processing in Vietnam, giving authorities wide discretion to enforce local laws on remote technology vendors without any physical presence vietnam-data-security-law-draft-limits-2026
.
- Severe Criminal Thresholds for Data Trading: Under the proposed Penal Code amendments, trading the personal data of 25,000 people or more, or earning an illicit profit of VND 1 billion (approximately $38,000), can trigger a maximum 10-year prison sentence vietnam-data-security-law-draft-limits-2026
- The Speed of the Legislative Push: Following a major cyber bust involving the trafficking of over 50 million pieces of personal information, the Ministry of Public Security moved with remarkable speed to advance draft Penal Code amendments and secure Government policy adoption vietnam-data-security-law-draft-limits-2026