Can Vietnam make ASEAN’s digital rules work for business?

When a Vietnamese software team serves a client in Singapore or Jakarta, the contract is only part of the deal. Someone has to work out what kind of data is moving, who is responsible for it and which rules apply on each side of the border. ASEAN has been writing rules for this kind of trade for a quarter of a century, from the e-ASEAN Framework Agreement of 2000 to the ASEAN Agreement on Electronic Commerce of 2018 (ASEAN 2000; MTI Singapore 2018). Trust, protection and cooperation were on that agenda from the start.

Writing in 2023, Toh argued that ASEAN’s digital future is promising but exposed to the Myanmar crisis, pressure for digital protectionism and barriers between member states (Toh 2023). In Vietnam that warning has become concrete. A Data Law and a Personal Data Protection Law now apply, just as ASEAN completes negotiations on its Digital Economy Framework Agreement (DEFA).

My argument is that Vietnam’s gains from ASEAN digital integration will depend in part on how predictably firms can identify and fulfil data obligations across markets. Implementation should be judged by three tests: the cost of supplying services, firms’ ability to take part, and the protection that data subjects actually receive.

The trade is real, but uneven

Digital trade is easily overstated because different measures get mixed together. The international Handbook on Measuring Digital Trade separates goods and services ordered online from services delivered over networks (IMF et al. 2023). The second group is where data rules bite hardest, so it is the focus here.

On WTO estimates, Vietnam’s digitally delivered services exports rose from about US$3.98 billion in 2023 to US$5.07 billion in 2024 and US$5.18 billion in 2025: growth of 27.4% and then just 2.3% (WTO 2026). Other business services made up roughly 37.5% of 2025 exports; together with computer and information services, about 82.2%. The opportunity reaches well beyond a few technology champions, but the growth path is not smooth, and a single strong year is not a forecast.

Firm figures need the same care. FPT reported international IT services revenue of VND 35,382 billion in 2025, up 14.3% (FPT 2026), but that revenue mixes several ways of supplying clients. Viettel Global mostly serves markets such as Cambodia through companies it owns there (Viettel Global 2025) – a different channel, with different obligations, from a service sent across the border from Vietnam.

Regional rules help set the conditions for this trade. Digital trade provisions show how agreements build shared rules, though not how well firms use them (Burri & Polanco 2020), and the OECD (2026) finds ASEAN’s regulatory environments still differ. ASEAN announced the conclusion of DEFA negotiations in June 2026, with signing expected in November (ASEAN 2026a; 2026b). Concluding talks is not the same as signing, entry into force or implementation – and rising trade alone cannot tell us whether change came from rules, demand or capacity.

Vietnam’s rules protect real interests. The question is how they apply

Data policy rarely has a single motive. Privacy, security, enforcement capacity and economic development can all be at work, as Han (2024) shows in comparing data localisation in Vietnam, Singapore and Indonesia. A motive does not prove that a rule is either effective or protectionist; the tools themselves need assessment.

The first step is classification. Article 23 of the Data Law (No. 60/2024/QH15) sets specific requirements for transferring and processing core and important data across borders. The Personal Data Protection Law (No. 91/2025/QH15) sets rights and obligations for personal data (Quốc hội 2024; 2025). A single transaction can touch more than one category, so the two regimes should not be merged into one picture of “data restrictions”.

The second step is to count the relief already in the law. Law 91 avoids some duplicated assessments (Article 5.4), provides exceptions to a requirement in Article 20.3 in the cases listed in clause 6, and lets small enterprises and start-ups opt into certain obligations later under Article 38, subject to conditions. Decree 356/2025/ND-CP, in force since 1 January 2026, gives the detail firms must follow (Chính phủ 2025).

An exception written into law does not prove that firms can use it easily.

As Zhang and Mitchell (2022) argue, a localisation requirement should be judged in its legal and practical context rather than labelled a violation in advance. The evidence that matters is practical: how a firm decides which rules apply, which documents it must prepare, who carries responsibility and where work is still duplicated.

Where compliance turns into business decisions

Obligations become business consequences through work. A firm must identify the type of data involved, the role of each party and the conditions that apply. Legal advice, contract changes, vendor management and proof of safeguards all take time and money. If that work delays a launch or raises its cost, firms may redesign the service, narrow the markets they serve or set up locally instead of supplying from Vietnam.

Research supports looking at data as an input. Van der Marel and Ferracane (2021) link data restrictions to lower imports of data-intensive services, and Ferracane, Kren and van der Marel (2020) connect them with the productivity of firms that rely on data. Both studies use data from before Vietnam’s new laws, so they explain the mechanism; they do not put a number on the cost of a 2026 statute.

The effects are also unlikely to be even. If part of compliance is a fixed cost, a large firm can spread it across many contracts. A small firm may need clear guidance and in-house skills before it can use the relief built for it. Against this, protection has a return: clear accountability can lower the risk of incidents and help win clients who demand it. A maximum fine is a risk if a firm breaks the law, not the average cost of doing business.

One limit matters here. The WTO series ends in 2025, while Law 91 and Decree 356 took effect in 2026, so the trade figures cannot yet show their impact. Judging implementation this year needs evidence on procedures and firms’ experience.

Two priorities for making the rules usable

First, test whether existing tools work. The data protection authority under the Ministry of Public Security, working with the Ministry of Industry and Trade and sector regulators within their mandates, should walk through common service-supply scenarios. The output would be scenario-based guidance that links existing texts and forms and makes clear the data type, each party’s role, obligations, exceptions and a contact point. It should fill gaps and settle conflicting readings, not create a new round of filings.

Second, build compatibility with safeguards. Vietnam could map the ASEAN Model Contractual Clauses against its own obligations and those of key partners, then pilot their use where the law allows. Contracts must allocate responsibility and remedies for breaches. Singapore treats the clauses as a voluntary tool under its own law (PDPC 2021); they are not automatic recognition across ASEAN, and DEFA should not be assumed to create one.

The test that matters

Toh was right that ASEAN’s digital promise faces hard internal barriers. For Vietnam, the most useful barrier to examine is not the existence of data rules but whether firms can use them. If obligations are clear and the relief already in the law works, regional integration and data protection can support each other. If not, the costs will fall unevenly, and the businesses least able to carry them will be the first to step back from regional markets.