In the digital era, incidents of information leakage from internal storage systems are becoming increasingly complex due to the absence of strict management rules. The lack of a unified data storage security policy not only exposes enterprises to the risk of cyberattacks but also makes them vulnerable to violations of stringent legal regulations. In the following sections, NPLAW will provide a detailed legal analysis of this issue.

I. Current situation regarding data storage security policies

At present, many enterprises in Vietnam continue to focus excessively on transmission security while overlooking the protection of stored data. In practice, numerous major data breaches originate from storage servers, cloud services, or backup devices that lack proper encryption.

In addition, the management of paper-based data and electronic data remains fragmented, with no unified access authorization procedures. As a result, employees may easily extract sensitive information without leaving traceable records. Such situations create an urgent need to standardize data storage security policies in order to protect corporate assets while ensuring compliance with emerging personal data protection regulations.

II. Concept of a data storage security policy

1. What is a data storage security policy?

A data storage security policy refers to a set of regulations, procedures, and technical measures established by an organization to protect data when it is stored on fixed media such as hard drives, servers, cloud storage platforms, or physical documents. Such a policy defines how data is classified, encrypted, stored, and destroyed to ensure confidentiality, integrity, and availability.

Accordingly, a data storage security policy serves as a fundamental tool enabling organizations to establish a systematic framework for data governance and protection, thereby ensuring information security throughout the entire storage lifecycle.

2. Why do enterprises need to establish a data storage security policy?

First and foremost, establishing such a policy enables enterprises to comply with legal obligations, particularly avoiding administrative sanctions that may reach up to 5% of revenue under proposed new regulations on personal data protection. Secondly, it functions as a preventive safeguard that minimizes losses arising from ransomware attacks or physical theft of devices containing data. Finally, a transparent policy enables enterprises to demonstrate credibility and professionalism, thereby strengthening trust among customers and business partners in international transactions.

Therefore, establishing a data storage security policy is not only a legal compliance requirement but also an essential measure to mitigate risks, protect informational assets, and enhance an enterprise’s reputation in the marketplace.

3. What is the difference between sensitive data and ordinary data in security policies?

Decree No. 13/2023/ND-CP classifies data into two categories under Clause 3 and Clause 4, Article 2:

  • Ordinary (basic) data: Including information such as name, gender, address, nationality, marital status, personal identification number, bank account details, family relationships, and similar information. Such data generally requires only a basic level of protection.
  • Sensitive data: Including political opinions, religious beliefs, health status, genetic data, biometric characteristics, private life information, or customer data. Such a category must be subject to enhanced security measures, including mandatory encryption and multi-layer access control.

In summary, distinguishing clearly between sensitive data and ordinary data within a data storage security policy is a crucial basis for applying appropriate protection measures, ensuring legal compliance, and optimizing the enterprise’s security resources.

III. Legal regulations relating to data storage security policies

1. What do current laws provide regarding the establishment of data storage security policies?

Stored data, in the context of protecting customers’ personal information, refers to information that reflects or helps identify a specific individual and is recorded and retained on storage media (Clause 1, Article 2 of the Personal Data Protection Law 2025). Accordingly, personal data protection refers to the use of personnel, equipment, and measures by agencies, organizations, or individuals to prevent and combat acts infringing upon personal data.

Currently, Vietnam’s legal framework on data protection clearly stipulates the responsibilities of organizations in establishing and implementing data storage security policies. Specifically, Section 2 on certain activities and Article 37 of the Personal Data Protection Law 2025 require enterprises (data controllers and data processors) to adopt appropriate managerial and technical measures to safeguard personal data in accordance with legal regulations. It may include issuing internal regulations on data protection that clearly define the scope and purpose of storage, as well as the corresponding technical and organizational measures necessary to ensure information security.

2. What are the main contents of a data storage security policy?

A well-structured policy should be developed based on a rigorous risk management framework, including provisions on data classification and labeling according to levels of importance. Core contents must specify detailed procedures for access control, encryption standards applicable to different storage devices, and periodic backup plans.

In addition, the policy must clearly stipulate the maximum retention period for each category of data and establish secure destruction procedures to ensure that information cannot be recovered once it is no longer required.

Therefore, a comprehensive data storage security policy must address governance, technical, and procedural elements in order to effectively control risks and ensure the highest level of information security.

3. Fundamental principles that a data storage security policy must follow

To ensure information security and legal compliance, an organization’s data storage security policy must be developed based on core principles derived from the personal data protection principles stipulated in Article 3 of the Personal Data Protection Law 2025 (effective from January 1, 2026), including:

  • Complying with the Constitution, the Personal Data Protection Law, and other relevant legal regulations;
  • Collecting and processing personal data only within a defined, legitimate, and lawful scope and purpose;
  • Ensuring the accuracy of personal data and allowing for correction, updating, or supplementation when necessary; storing data only for a period appropriate to the processing purpose unless otherwise provided by law;
  • Implementing synchronized and effective institutional, technical, and human measures appropriate for protecting personal data;
  • Proactively preventing, detecting, stopping, and strictly handling violations relating to personal data protection;
  • Ensuring that personal data protection aligns with the protection of national interests, contributes to socio-economic development, ensures national defense, security, and foreign affairs, and maintains a balance between personal data protection and the legitimate rights and interests of agencies, organizations, and individuals.

Strict compliance with these principles is not only a mandatory legal obligation but also the fundamental foundation for organizations to build trust with customers, optimally protect privacy rights, and ensure secure and sustainable operations in the digital environment.

4. Who is responsible for establishing and maintaining a data storage security policy in an enterprise?

The highest legal responsibility belongs to the enterprise’s legal representative, who must ensure sufficient resources are allocated for implementing security measures. In organizations that process large volumes of data or sensitive data, the personal data protection department designated under Clause 2, Article 28 of Decree No. 13/2023/ND-CP will play a direct role in establishing, monitoring, and periodically reporting on compliance status.

Accordingly, the responsibility for establishing and maintaining a data storage security policy lies with the enterprise, led by the legal representative, with direct participation from the data protection department to ensure compliance and effective implementation.

IV. Questions regarding data storage security policies

1. Does a data storage security policy apply to both electronic and paper-based data?

A comprehensive data storage security policy must cover all forms in which data exists within an organization.

  • For paper-based data, the policy should stipulate requirements such as fire-resistant storage cabinets, secure locking systems, surveillance cameras, and strict handover records when documents are transferred.
  • For electronic data, the focus is typically placed on software encryption tools, user identity management systems, and control of external connection ports on work computers.

Accordingly, current laws require enterprises to establish and implement a data storage security policy as a continuous legal obligation throughout the entire lifecycle of personal data processing.

2. How should new employees be trained on data storage security policies?

Enterprises should develop a mandatory onboarding training program that instructs employees on how to identify sensitive company data and understand the rules governing its handling. Employees should be trained in secure password management, proper use of removable storage devices, and recognition of cyberattack indicators.

Finally, requiring employees to sign confidentiality commitments attached to detailed policy provisions is an important legal step in binding individual responsibility for the organization’s data assets.

Thus, training new employees on data storage security policies is a mandatory requirement to enhance awareness, mitigate human-related risks, and establish individual legal accountability within the organization.

3. What steps must an enterprise take upon detecting a violation of a data storage security policy?

When an incident occurs, the enterprise must first activate its emergency response plan to isolate affected data areas and prevent further escalation.

Pursuant to Article 23 of Decree No. 13/2023/ND-CP, within 72 hours from detecting a violation, the enterprise must notify the Ministry of Public Security (Department of Cybersecurity and High-Tech Crime Prevention) in writing regarding the nature and consequences of the incident.

The notification must include:

  • A description of the nature of the violation, including time, location, conduct, involved organizations or individuals, types of personal data, and the number of affected data records;
  • Contact details of the staff member or organization responsible for personal data protection;
  • A description of potential consequences or damages arising from the violation;
  • A description of measures implemented to address and mitigate the impact of the violation.

After stabilizing the situation, the organization must conduct a root cause analysis, reassess vulnerabilities, and provide compensation where the violation causes damage to customers.

4. Does a data storage security policy require periodic review and assessment?

Periodic review and assessment constitute a mandatory legal requirement to maintain the effectiveness of protective measures.

Enterprises should conduct reviews at least once per year or immediately following significant changes to information technology infrastructure. Such evaluations help identify newly emerging vulnerabilities, ensure security configurations continue to function properly, and guarantee that policies remain compliant with the latest legal standards in Vietnam.

Therefore, periodic review and assessment are indispensable components of a data storage security policy, ensuring legal validity, operational effectiveness, and adaptability to emerging risks.

5. Can customers request enterprises to disclose data storage security policies?

Clause 1, Article 9 of Decree No. 13/2023/ND-CP stipulates that data subjects (customers) have the right to be informed about the processing of their personal data unless otherwise provided by law.

Accordingly, customers are fully entitled to request enterprises to disclose their data storage security policies. Enterprises must ensure transparency in data processing activities, allowing customers to understand how their data is collected, used, and protected, thereby safeguarding their privacy rights and control over personal information.

Thus, customers have the legal right to request disclosure of data storage security policies, ensuring transparency and the protection of personal data rights under applicable law.

V. Why seek legal advice from NPLaw regarding data storage security policies

Legal consulting services at NPLAW provide comprehensive support to clients in the following areas:

  • Identifying legal grounds and reviewing systems: Conducting a full review of the enterprise’s existing storage procedures to detect potential legal risks at an early stage.
  • Drafting and standardizing policies: Developing a tailored set of data storage security rules suitable for the enterprise’s specific business model while ensuring legal rigor and practical feasibility.
  • Representation before competent authorities: Assisting in procedures related to personal data processing impact assessment reports.
  • Dispute resolution and data incident management: Representing enterprises in compensation negotiations, handling customer complaints, and protecting legitimate rights before courts or arbitration tribunals in the most effective manner.

The above information is provided for reference purposes only. Should you have any questions relating to data storage security policies, please contact NPLAW so that our team of lawyers can provide direct consultation and comprehensive support.