Vietnam government considers ban on personal data sales amid sharp rise in cyberattacks

Deputy Prime Minister Le Thanh Long introduced a bill in the National Assembly on Monday that will outlaw six data-related behaviors, including the buying and selling of personal data, illegal data processing, data leaks and the use of personal information for unlawful purposes.

While a current decree technically bans data sales, enforcement has been weak.

The bill aims to strengthen the legal framework and curb the rampant black market for personal data, which has grown alongside the rapid digital transformation.

Authorities say many businesses lack clear agreements for processing user data, enabling third parties to trade or exploit the information.

Some firms even purchase personal data directly, building vast databases for profit-driven analytics.

Meanwhile, hackers infiltrate systems to steal user data, often selling it on the dark web.

In 2024 cyberattacks led to the theft of 10 terabytes of personal data and losses exceeding US$11 million.

Some 14.5 million user accounts were compromised, accounting for 12% of all global data leaks that year, according to the Ministry of Public Security.

Lawmakers are seeking to precisely define what constitutes data trading, but are continuing to debate it.

Some argue that personal data is now a form of digital commodity and a blanket ban could hurt innovation and economic growth.

The National Assembly's Committee on National Defense, Security and External Affairs has suggested allowing regulated transactions with data sales made with user consent and for specific socio-economic purposes.

The committee also recommends banning companies from forcing users to provide sensitive information in return for services and prohibiting the mass collection and sale of personal data for commercial gain.

The National Assembly will further discuss the bill on May 24.