A trade association representing major technology companies has raised concerns about a proposed new law in Vietnam that would tighten data protection rules and limit data transfers overseas.
A trade association representing major technology companies including Meta, Google and data center operator Equinix has raised concerns about a proposed new law in Vietnam that would tighten data protection rules and limit data transfers overseas.
According to Reuters, the Information Technology Industry Council (ITI) warned that the draft law would hamper social media platforms and data center operators trying to grow their business in Vietnam.
The draft law "will make it challenging for tech companies, social media platforms and data center operators to reach the customers that rely on them daily," ITI president and CEO Jason Oxman told the news agency.
In September, the Vietnamese government released the first draft of the new Personal Data Protection Law (PDPL), which was drafted by the Ministry of Public Security. The draft law is currently being discussed in parliament and is open for public consultation until November 24 this year, allowing stakeholders to provide feedback.
It applies to all Vietnamese agencies, organizations and individuals operating domestically and abroad, as well as foreign entities that process data in Vietnam. This broad scope of application ensures that the draft law will cover data processing activities in the country as well as for Vietnamese data subjects located abroad.
The draft PDPL has stricter provisions than last year's Personal Data Protection Decree and covers a wide range of areas, including marketing services, behavioral advertising, big data processing, AI, cloud computing, employee monitoring and recruitment, financial and credit data, healthcare, insurance, and more.
Among other things, the draft law would require prior authorization for the transfer of "core data" and "important data," which are currently subject to vague definitions.
"That will hinder foreign business operations," Oxman told Reuters.
He also raised concerns about "the undue expansion of government access to data," as one provision of the draft law would require companies to share data with Vietnam's ruling Communist Party and state organizations in several vaguely defined cases including for "fulfilling a specific task in the public interest."
Challenges and considerations
According to a Vietnam Briefing analysis published five weeks ago by Dezan Shira and Associates, despite the new provisions in the draft law, certain challenges remain unresolved. For example, it is unclear how the draft PDPL will interact with the existing decree on the protection of personal data.
"For businesses operating in Vietnam, this draft law will require significant adjustments. Companies must prepare to enhance their data processing operations, particularly around data protection impact assessments, cross-border transfers, and the stringent consent regime," the article stated.
It pointed out that while businesses will need to navigate new compliance challenges, they also have the opportunity to provide input during the consultation period.
The analysis also said that companies should act quickly to assess their readiness and ensure compliance with the new data protection paradigm.
The draft PDPL has a target date of May 2025 for enactment and a target date of January 1, 2026 for enforcement.
Adam Sitkoff, executive director of the American Chamber of Commerce in Hanoi, told Reuters that the new law "would cause significant compliance challenges for most private sector companies," adding that talks were underway to persuade authorities to "reconsider the rushed legislative process" for the law.
Regional data center hub
It is unclear how the new PDPL draft law would affect the country's ambitions to become a regional data center hub.
Vietnam, with its population of 100 million, is among the countries in Southeast Asia vying for a big slice of the lucrative data center market as the subregion goes deeper into digitization with the advent of AI.
Last year, the Vietnamese government updated its telecommunications law to allow foreign investors full ownership of data center and cloud computing businesses in the country. The law, which will take effect next year, will remove the existing 49% foreign ownership limit for companies operating in these sectors.
Vietnam is poised to become the third-largest data center market in ASEAN, Vietnam News Services (VNS) reported on Friday. The liberalization of Vietnam's telecom sector and ambitious digital infrastructure reforms – including 5G, fiber and submarine connectivity – have created a fertile environment for data center and cloud investors.
"If investment patterns persist, Vietnam may be on track to receive nearly 1GW of data center capacity from local and foreign platforms, potentially making it the third-largest data center market in emerging Southeast Asia," VNS reported, citing BMI Research.
Read more about:
AsiaYou May Also Like
