American tech giants are expressing serious concerns over a new data protection law being reviewed by Vietnam’s parliament. The proposed legislation could create significant hurdles for companies like Google and Meta, potentially disrupting digital services for millions of users in one of Asia’s fastest-growing digital economies. The law’s focus on data localization and restricting cross-border data flows has put foreign investors and tech companies on high alert.
What is in the New Data Law?
The Vietnamese government, led by the Ministry of Public Security and the Ministry of Information and Communications, is pushing for tighter control over user data. This move builds upon a 2022 decree that already required tech firms to store user data locally and establish offices in Vietnam.
The new draft law goes a step further by introducing more stringent controls. The most significant concern revolves around the requirement for companies to get prior authorization before transferring “core data” outside of Vietnam. The problem is that the term “core data” is vaguely defined in the draft, creating widespread uncertainty. This lack of clarity makes it difficult for companies to plan and ensure compliance.
Key provisions of the proposed law that are causing concern include:
- Mandatory Prior Approval: Companies must seek government permission to transfer what is deemed “core data” across borders.
- Vague Definitions: The ambiguity around “core data” could allow the government to classify a wide range of information under this category, from user data to operational details.
- Data Sharing Mandates: The law suggests companies may be required to share user data with Vietnamese authorities upon request, with limited information on privacy safeguards.
These rules represent a major shift from the more fluid, cross-border data practices that global tech companies rely on for efficient operations.
Tech Industry Sounds the Alarm
The global tech industry has been quick to voice its opposition to the proposed changes. The Information Technology Industry Council (ITI), which represents major players like Meta, Google, and Apple, has formally expressed its apprehensions. They argue that the law, in its current form, could disrupt the everyday services that millions of Vietnamese citizens and businesses depend on.
Jason Oxman, the chairman of ITI, stated that the draft law would make it incredibly challenging for tech companies and data center operators to serve their customers effectively. The core fear is that these regulations will add layers of bureaucracy and unpredictable compliance risks, hampering the ability to offer seamless digital services.
For social media platforms and cloud service providers, the requirement to potentially share user data with authorities is particularly troubling. Complying with such requests could force them to violate their own privacy policies and erode user trust, putting them in a difficult position between following local laws and upholding their global standards.
A Chilling Effect on Foreign Investment?
Vietnam has clear ambitions to become a major technology and digital hub in Southeast Asia, actively seeking foreign capital to fuel its growth. However, industry experts warn that this restrictive data law could have the opposite effect and scare away the very investors it hopes to attract. The data center industry, a sector Vietnam is keen to develop, is especially at risk.
Data center providers operate on a model that often requires the free flow of data across borders. Data localization policies make it more expensive and complex to operate, which could lead potential investors to look at other markets with more favorable regulations.
The table below highlights the key differences in regulatory pressure between the existing decree and the new proposed law.
| Regulatory Area | 2022 Decree | Proposed New Law |
|---|---|---|
| Data Storage | Requires local storage of user data. | Maintains local storage requirements. |
| Cross-Border Data Transfer | Generally permitted with some conditions. | Requires prior government approval for “core data”. |
| Data Definition | Focuses on general user data. | Introduces the vaguely defined term “core data”. |
This escalation in regulatory control creates an unpredictable environment that is often a major red flag for foreign investors.
Vietnam’s Balancing Act between Security and Growth
The Vietnamese government’s stated goal for the new law is to enhance national cybersecurity and protect data sovereignty. This is not an issue unique to Vietnam; governments globally are trying to find ways to regulate the digital sphere. However, critics argue that Vietnam’s approach may be too restrictive and could stifle the very innovation and economic growth it seeks.
A healthy digital economy thrives on the free flow of information. By putting up barriers, Vietnam risks limiting consumer choice and hindering the progress of its own tech sector. Stakeholders are urging the government to engage in more dialogue to find a middle ground. They suggest looking at models like the European Union’s GDPR, which provides strong data protection without crippling business operations.
As the draft law awaits deliberation in the coming months, the international tech community is watching closely. The final version of this law will not only determine the future of digital services in Vietnam but could also set a precedent for data governance across Southeast Asia.
