Q: Data breaches are becoming increasingly complex and dangerous in nature and scale. Based on your experience in ensuring cybersecurity and data security, could you explain the consequences for people's rights and interests, business stability, and, more broadly, national security?
A: Data security breaches are becoming increasingly complex and dangerous in nature and scale, with impacts in several areas.
First, violations of data security can directly affect national security. Cyberattacks and intrusions into information systems to collect and steal information and state secrets, particularly in the fields of security, defence, the economy, and foreign affairs, can have unforeseeable consequences.
In recent years, cyberattacks have increased sharply in intensity, scale, and sophistication, with a number of escalating, targeted advanced persistent threat (APT) campaigns against Vietnamese agencies, organisations, businesses, and economic groups to steal or seize information and personal data, or encrypt data for ransom.
In the first six months of 2026 alone, the Viet Nam Cyber Emergency Response Centre, coordinated by the Cybersecurity Department, detected two million cyberattack alerts, nearly 50% of which involved AI. Perpetrators used automation to scan for vulnerabilities and spread malware faster and more accurately, making their activities harder to detect and handle.
Second, data breaches can undermine security in the financial, banking, and securities sectors, or disrupt the normal operations of agencies, organisations, and businesses. Among these, ransomware attacks are one of the most dangerous forms of data breach. When attacking an information system or database, hackers package and encrypt all the organisation's or business's data, then demand a ransom before providing the decryption key.
In the US, one company paid a ransom of up to 40 million USD. In Viet Nam, some businesses have also been forced to pay ransoms worth billions of Vietnamese dong, while a securities company once suffered an attack that disrupted its operations for weeks. Data breaches also seriously damage businesses' reputation and brand, with losses that are difficult to quantify.
Third, data breaches directly affect individuals, resulting in the loss of personal information, ranging from basic details to sensitive information, confidential data, and private matters.
Armed with stolen personal data, criminals can operate on an "industrial scale,” using sophisticated methods and hundreds of scenarios linked to topical and current issues to deceive the public and cause huge financial losses. Some victims have lost tens of billions of Vietnamese dong to fraud. In a typical case, a woman in Bac Ninh City was defrauded of 26.5 billion VND through cyberspace.
Q: Given the risks of data theft, handling violations and addressing the consequences after incidents occur are not enough. Could you clarify how to implement the shift in approach from passive response to proactive prevention and control of data risks in the current period?
A: Data breaches have remained complex in cyberspace in recent years. Numerous closed groups, underground forums, social networks, and dark web and deep web sites continue to trade illegally in data files containing information on tens of millions of Vietnamese people.
Over the past three years, specialised units of the Ministry of Public Security have stepped up efforts to combat this type of crime and dismantled numerous criminal networks. Notably, in February 2025, the Cybersecurity Department, in coordination with the Hue City Public Security and Ha Noi City Public Security, dismantled a network trading in nearly 56 million personal data records and arrested three suspects. In February 2026, the department, in coordination with Tuyen Quang Public Security, dismantled a network trading in nearly 8.4 billion user email addresses.
In June 2026, Lam Dong Public Security initiated legal proceedings against a suspect who had hacked into systems, stolen, and offered for sale 20 million data records. In July 2026, Nghe An Public Security initiated legal proceedings against P.X.D. for trading in 50 million items of personal information and data, alongside other cases.
Based on my experience, handling violations and addressing the consequences after incidents occur are essential but insufficient, as these are merely steps that competent authorities must take to deal with incidents that have already happened. Therefore, there is an urgent need to shift from a passive response approach to proactively preventing, identifying, and controlling data risks.
Alongside changes in awareness and mindset, with greater emphasis on proactively protecting data, information, and state secrets, agencies, organisations, units, and businesses must strengthen and improve the legal framework to enhance proactive data security.
Q: The National Assembly's consideration of the draft Law on Data Security at this session is expected to mark a major legal turning point. Could you analyse the strategic significance of this law in firmly safeguarding national security and data safety, while creating fresh momentum for the country's digital transformation?
A: The draft law has been developed based on six policies approved by the Government under Resolution No. 246/NQ-CP dated August 20, 2026, and closely follows the orientations set out in the Politburo's Resolution No. 57-NQ/TW dated December 22, 2024, on breakthroughs in science and technology development, innovation, and national digital transformation. The resolution identifies ensuring data security as an integral and continuous task of national digital transformation.
The National Assembly's consideration and passage of this law at its second session is highly significant for data protection, national security, and the digital transformation process.
This significance is reflected in several aspects:
First, the law will promptly institutionalise the Party's guidelines, policies and directives on data security; address existing difficulties, obstacles, and legal gaps; and regulate emerging issues in the quantum technology era. It will also clearly define the authority, functions, and responsibilities of state management agencies, ministries, sectors, and departments in data security.
Second, it will help establish a more comprehensive and robust legal framework for data security, enabling competent forces to implement coordinated measures and carry out their duties more effectively.
Third, it will mobilise all necessary stakeholders and resources to protect national data sovereignty and security, as well as the legitimate rights and interests of agencies, organisations, and individuals. It will help strengthen the institutional and legal foundation and create a stable, safe environment for digital transformation, enabling data — a new resource for the economy — to be harnessed safely, effectively, and sustainably.
Fourth, it will clearly stipulate the rights, obligations, and responsibilities of relevant parties in data security protection and fully define different levels of data security risks. On this basis, appropriate and proportionate measures will be applied at each level and throughout the data lifecycle. It will also establish a level playing field in terms of obligations, responsibilities, and benefits for domestic and foreign businesses.
Finally, the Law on Data Security will serve as the final piece in completing Viet Nam's legal framework on data. Together with the Law on Data, the Law on Personal Data Protection, and the Law on Cybersecurity, it will form a more comprehensive, complete, and robust legal framework for data security, strongly supporting national digital transformation and the development of the digital economy and digital society in the digital era.
Q: What practical benefits will the public, businesses, and the economy gain once the Law on Data Security is passed by the National Assembly?
A: Once passed by the National Assembly and put into practice, the Law on Data Security will bring tangible benefits to the public, businesses, and the economy.
For individuals, this will be the first time their data is protected throughout its entire lifecycle, from collection and storage to use and deletion, rather than protection being limited to preventing data leaks, exposure, and theft as before.
Article 6 of the draft law explicitly prohibits the appropriation, trading, and disclosure of personal data, biometric data, and bank account numbers. These are the types of data currently exploited in most telephone and online scams targeting the public. Thus, the Law on Data Security will serve as a legal shield protecting the data of every agency, organisation, and individual throughout its lifecycle.
For businesses, the law will help create a safe and stable environment in which they can benefit from services provided by an accurate, complete, clean, and live data ecosystem, reducing compliance and customer verification costs. It will also establish a controlled legal sandbox for businesses to harness big data and artificial intelligence safely, while attracting high-quality investment into core technology sectors.
For the economy, particularly the digital economy, firmly protecting critical data infrastructure in banking, energy, and telecommunications against cyberattacks, especially ransomware attacks and other forms of data breaches, means safeguarding growth drivers and strengthening investor confidence in Viet Nam's safe and reliable digital environment.
Reporter: Thank you for sharing your insights!
