Vietnam State Bank proposes new data security regulations for banking sector

The State Bank of Vietnam is drafting a new circular to replace Circular 09/2020/TT-NHNN, aiming to strengthen information system security within banking operations. The proposed regulations respond to the increased use of cloud computing, artificial intelligence, and open APIs, which have expanded third-party dependencies and cybersecurity risks.

Key provisions in the draft include mandatory data classification, protection, and encryption based on ISO/IEC 27001:2022 standards. Financial institutions would be required to implement Data Loss Prevention (DLP) solutions and enhance access management to protect sensitive information across networks and devices.

To combat ransomware and unauthorized data modification, the draft proposes using immutable storage technology for backups. These backups must be stored in geographically separate locations to ensure system continuity and resilience against cyberattacks.