Vietnam is undergoing a strong digital transformation, with a sharp rise in internet usage and rapid growth in the digital economy. By the end of 2024, the percentage of households with fiber-optic internet reached 82.4%, surpassing the 2025 target of 80%. The digital economy accounted for 18.3% of GDP, with an annual growth rate exceeding 20%, which is considered as the highest in the ASEAN region. In the first half of 2025, non-cash payments increased by 45.4% in transaction volume and 25.2% in value. In major cities, 70% of consumers used cashless payments on a daily basis. E-commerce also saw strong development, growing by approximately 25 – 27% in the first eight months of 2025.
Against this backdrop, the enactment of the Personal Data Protection Law, together with related legal frameworks such as the Cybersecurity Law, the Law on Electronic Transactions, and the Law on Data, is expected to establish a solid legal foundation for information and personal data security, while encouraging broader participation in the digital transformation process. Furthermore, other important laws, such as the Law on Science, Technology and Innovation, and the Law on the Digital Technology Industry, mark a critical step toward preventing online fraud and asset appropriation in cyberspace, while establishing a robust legal foundation for the development of technology and the digital economy.
Key Governance Trends
Institutional reform and acceleration of policymaking
- In the first half of 2025, Vietnam reviewed, amended, and supplemented numerous policies and laws related to technology, innovation, and digital transformation. Several sandboxes and special regulations were also introduced to help address institutional bottlenecks in tech governance. Within just six months, the National Assembly passed 19 laws that included new or revised provisions related to technology, innovation, and digital transformation, along with five resolutions containing relevant content. Following that, the Government issued more than 20 decrees detailing the implementation of laws in these areas. Notably, one of the most important laws related to tech governance is the Personal Data Protection Law that will come into force on January 1, 2026. The law marks a major step in Vietnam’s efforts to strengthen privacy protection, enhance inspection and supervision mechanisms, and ensure greater transparency in personal data management.
Strengthened supervisory and enforcement mechanisms
- In conjunction with the expedited lawmaking process, Vietnam carried out a significant organisational restructuring on March 1, 2025, aimed at enhancing coordination and enforcement within the area of technological governance. The Ministry of Information and Communications (MIC) underwent a merger with the former Ministry of Science and Technology (MoST), resulting in the establishment of a newly consolidated Ministry of Science and Technology. This reform has successfully decreased the number of administrative units from 42 to 25, resulting in a 40.5% reduction in organisational complexity. The newly established merged ministry is responsible for the comprehensive management of the four essential pillars: (i) Science, (ii) Technology, (iii) Innovation, and (iv) Digital Transformation, all under a cohesive leadership framework.
- The responsibilities for network security functions have been reassigned to the Ministry of Public Security to centralise the Cyber and Network Security Authority within a unified government body. Meanwhile, the management of press and publishing has transitioned to the Ministry of Culture, Sports, and Tourism, which separates information control from technology regulation and reduces overlaps in technology governance. The realignment has established clearer jurisdictional boundaries and minimised areas of overlap. The purpose of this reorganisation is to improve decision-making processes, increase the efficiency of enforcement measures, and bolster accountability in the management of technology.
Innovation through sandbox implementation
- A greater dedication to regulatory innovation was demonstrated in April with the announcement of the first regulatory fintech sandbox. This banking industry regulatory sandbox was designed to pilot innovations in credit scoring, peer-to-peer lending, blockchain in banking, and API data sharing. More significantly, Vietnam formally institutionalised experimental regulatory frameworks on July 1, 2025, with the implementation of Government Decree No. 94/2025/ND-CP, which creates sandbox procedures for the banking industry.
Key Policy Trends
The Personal Data Protection Law (PDPL)
According to 2024 statistics from the Ministry of Public Security, Vietnam has legal documents that directly address personal data protection. However, these legal documents lack consistency in defining the concept and scope of personal data and its protection. Only one sub-law document, Decree No. 13/2023/ND-CP on personal data protection, provides definitions for personal data and its protection, but as a decree, it does not carry the legal authority of a formal law. Therefore, the enactment of the Personal Data Protection Law can be seen as a foundational or “root” law, establishing a solid legal basis for personal data protection and enhancing the capacity of organisations and individuals to safeguard personal data.
The PDPL introduces several noteworthy provisions, including:
- Seven prohibited acts related to personal data are clearly defined, most notably the buying and selling of personal data;
- An expanded scope of application, which also covers cross-border platforms;
- A flexible definition of personal data, designed to keep pace with the fast-changing nature of technology;
- The introduction of the concept of data de-identification and a clear distinction between personal and non-personal data;
- Stricter administrative penalties for organisations that violate the law, particularly those involved in buying, selling, or transferring personal data across borders, with fines reaching up to 5% of the violating organisation’s revenue from the previous year;
- A requirement for businesses to erase employees’ personal data once employment contracts are terminated;
- A prohibition on social media platforms from requesting images or videos containing identity documents for authentication purposes;
- Provisions on data protection in the use of emerging technologies such as AI, Big Data, Blockchain, the Metaverse, and cloud computing. The law mandates the integration of security, authentication, access control, and risk classification measures when processing data using AI;
- A requirement for organisations and individuals processing data to publicly disclose clear privacy policies; and
- The establishment of a mechanism for specialised inspection and supervision of personal data protection.
These new provisions bring Vietnam’s PDPL in line with global technological trends, enhancing the protection of individuals’ rights. At the same time, they help businesses more easily update and comply with regulations amid rapid technological changes. Ultimately, this marks a significant step forward in creating a safe and transparent digital environment, safeguarding citizens’ legitimate privacy rights, and promoting digital economic development and international integration.
While the PDPL marks a significant step forward in strengthening Vietnam’s legal framework for digital economic development, several challenges remain to be addressed during its implementation. First, the most pressing challenge is ensuring effective enforcement, particularly for entities with foreign elements such as Foreign Direct Investment (FDI) enterprises or major technology platforms, where cross-border data control presents substantial difficulties. Second, there are limitations in monitoring capacity and the ability to handle violations effectively, as traditional oversight mechanisms such as administrative inspections or compliance reports have proven inadequate in detecting and preventing personal data breaches. The rapid pace of digital technology development also necessitates the adoption of more advanced and modern supervisory tools. Third, a shortage of resources and technical expertise may hinder the deployment of new technologies in monitoring systems and law enforcement. Fourth, insufficient coordination among state management agencies could impede the consistent implementation of data protection measures. Finally, the limited awareness of data protection among consumers and internet users remains a significant challenge.
At the mid-year review meeting of the Central Steering Committee on the Development of Science, Technology, Innovation, and Digital Transformation, the General Secretary of the Communist Party of Vietnam emphasised that “special attention must be paid to ensuring security, safety, confidentiality, protection of national data, protection of personal data, and the protection of intellectual property rights in science and technology.”
Therefore, to ensure the effectiveness and efficiency of the legal framework on personal data protection, Vietnam should focus on several key solutions, including:
- Establish tools for implementation monitoring, including a data monitoring system and a specialised authority with sufficient powers.
- As technology evolves rapidly, adopt more modern and advanced monitoring solutions, such as Artificial Intelligence (AI), blockchain technology, and big data analytics systems, to enhance the ability to detect and respond promptly to data security threats.
- Strengthen the capacity of personnel specialised in data security to address emerging challenges, particularly in handling complex and large-scale violations.
- Improve coordination among relevant authorities to ensure effective information sharing and technical cooperation for comprehensive personal data protection.
- Promote international cooperation, especially with ASEAN countries, to identify solutions and enhance the enforcement of personal data protection laws. Establishing cooperative networks among regional supervisory authorities could also facilitate the sharing of information, experiences, and best practices.
- Prioritise communication efforts and raise public awareness about privacy rights and personal data protection among both users and businesses.
Effective PDPL, along with a robust and synchronized enforcement mechanism, will safeguard citizens’ privacy. This will strengthen user trust, create a transparent and secure business environment, and promote the sustainable development of the digital economy.
2. Complementary digital economy legislation
The enactment of the PDPL was accompanied by a broader legislative push, including the Law on Data, the Law on Science, Technology and Innovation, the Law on the Digital Technology Industry, the Cybersecurity Law, and the Law on Electronic Transactions. Together, these create a more synchronised ecosystem for digital transformation.
- Released in November 2024 and set to take effect on July 1, 2025, the Law on Data represents Vietnam’s inaugural comprehensive legislation regulating digital data. It defines data ownership as a legal property right, categorising it into types, such as open and original data. The legislation outlines the rights and responsibilities of data owners, managers, and service providers; encourages data sharing and secure usage to foster the growth of the digital economy; and establishes the groundwork for a national data infrastructure. The legislation applies to both domestic and international entities engaged in data-related activities pertaining to Vietnam. It enhances the PDPL by strengthening the overall framework for data governance, privacy, and cybersecurity, representing a significant milestone in Vietnam’s digital transformation initiatives.
- The Law on Science, Technology and Innovation introduces for the first time a range of policies aimed at fostering high-risk, high-reward research initiatives. These encompass regulatory sandboxes, risk-sharing mechanisms, venture capital incentives, and various specialised financial tools. This framework facilitates experimentation in emerging technologies like AI, blockchain, medical technologies, and digital education, enabling them to function within a secure, well-regulated environment prior to large-scale implementation.
- The standalone Law on the Digital Technology Industry focuses exclusively on the digital technology sector, encompassing the semiconductor industry, AI, and digital assets. It outlines several key focus areas and incentives, including: exceptional incentives for crucial initiatives in digital technology, semiconductors, AI, and data centres; prioritised investments in essential digital infrastructure (for instance: AI data centres, centralised digital technology zones, and national laboratories); recognition and management of digital and virtual assets, including encrypted assets, to ensure ownership rights, secure transactions, and effective oversight. The purpose of these provisions is to establish a robust and innovation-focused industrial foundation for Vietnam’s digital economy.
3. Streamlining and consolidating cybersecurity legislation
Vietnam’s Ministry of Public Security recently released a draft of the 2025 Cybersecurity Law for public consultation. The revised legislation aims to replace both the 2018 Cybersecurity Law and the 2015 Law on Network Information Security. This consolidation reflects a broader government effort to streamline and centralise the legal frameworks governing cybersecurity, data protection, and information security.
Looking Ahead: on the Direction of Evolution
With the upcoming implementation of several new laws in the latter half of 2025 and early 2026, Vietnam is poised to enter a crucial phase of enforcement and execution. The emphasis will transition from creating legislation to guaranteeing that these frameworks are successfully implemented in practice, fostering trust, transparency, and accountability throughout the digital ecosystem.
At the same time, as AI continues to advance rapidly, it is expected to remain a top policy and governance priority for 2026. With the reaffirmation of the country’s ambition to position Vietnam as a regional and global leader in AI by 2030 or sooner, the next stage of policy evolution is likely to include the introduction of AI-related regulations, focusing on ethics, transparency, accountability, and safety in AI deployment. These developments will complement existing data and cybersecurity laws, ensuring that technological innovation proceeds in line with national interests and international standards.
The views and recommendations expressed in this article are solely of the author/s and do not necessarily reflect the views and position of the Tech for Good Institute.
