The bill aims to institutionalize the Party’s guidelines on safeguarding the Fatherland in cyberspace and developing the digital economy. It identifies data security as an urgent requirement that must be upheld throughout the national digital transformation process.
    |
 |
|
A discussion during the second session of the 16th National Assembly |
It comprises six chapters and 29 articles, providing comprehensive regulations ranging from general principles to specific protection mechanisms, resources for protection and State management of data security.
Its core provisions focus on clearly defining the scope of regulation, adopting risk-based management, ensuring data security throughout the data lifecycle, proactively preventing and responding to incidents, and facilitating the development of technology, infrastructure and human resources for data security.
A key aspect of the draft law is to clearly establish its scope of regulation, principles for applying the law and boundaries with relevant specialized legislation, ensuring consistency and coherence across the legal system.
Accordingly, the draft law stipulates that the principles and conditions for processing personal data, as well as the rights of personal data subjects, will continue to be governed by the law on personal data protection. The creation, governance, exploitation, sharing and classification of data according to its importance will be governed by data-related legislation, while the protection of information systems against cybersecurity threats will be governed by the law on cybersecurity.
The security of the data itself throughout its lifecycle, however, will be governed by the Law on Data Security.
The draft law sets out five data security risk levels, from Level 1, the lowest, to Level 5, the highest. These levels are determined based on the likelihood of incidents and the extent of potential damage to national defense and security, social order and safety, and the legitimate rights and interests of organizations and individuals.
The higher the risk level of the data, the stricter the protection obligations should be.
The draft law also establishes the principle of protecting data security throughout its entire lifecycle, from collection, storage, processing and transmission to destruction. It provides for strict, differentiated controls based on risk levels over cross-border data transfers and processing, with a view to safeguarding national data sovereignty
Also on October 26, deputies will hear submissions and verification reports on the draft laws on Protection of Important Works Related to National Security; Electronic Identification and Authentication; amendments and supplements to a number of articles of the Law on Management and Use of Weapons, Explosives and Supporting Tools and the Law on Fire Prevention, Firefighting, Rescue and Salvage; and amendments to the Law on Handling of Administrative Violations.
They will also discuss the draft law amending and supplementing a number of articles of the Law on Measurement.
Source: VNA