Legal regulation of digital data sovereignty in cloud computing: International experience and lessons for Vietnam
Published: September 7, 2026
Abstract
Cloud computing weakens the traditional relationship between data, territory, and jurisdiction. This article conceptualizes digital data sovereignty as the legal and technical capacity to determine conditions governing data access, processing, transfer, auditing, and protection rather than equating sovereignty solely with domestic data-storage requirements. It compares regulatory approaches in the European Union, China, and the United States and evaluates Vietnam’s framework under the 2024 Law on Data, the 2025 Law on Personal Data Protection, the 2025 Law on Cybersecurity, and related legislation. Vietnam has established mechanisms for data classification, impact assessment, cross-border data-transfer control, and cybersecurity. However, gaps remain in cloud-specific regulation, coordination among relevant laws, and mechanisms for resolving jurisdictional conflicts. The article recommends a risk-based governance approach integrating legal safeguards, technical controls, and data-subject rights.
Keywords
digital data sovereigntycloud computingcross-border data flowsdata localizationpersonal data protection
References
1.
Quốc hội. (2023). Luật số 20/2023/QH15: Luật Giao dịch điện tử, ban hành ngày 22/6/2023.
2.
Quốc hội. (2024). Luật số 60/2024/QH15: Luật Dữ liệu, ban hành ngày 30/11/2024.
3.
Quốc hội. (2025a). Luật số 16/2025/QH15: Luật An ninh mạng, ban hành ngày 10/12/2025.
4.
Quốc hội. (2025b). Luật số 91/2025/QH15: Luật Bảo vệ dữ liệu cá nhân, ban hành ngày 26/6/2025.
5.
Casalini, F., & López González, J. (2019). Trade and cross-border data flows (OECD Trade Policy Papers No. 220). OECD Publishing. https://doi.org/10.1787/b2023a47-en
Chander, A., & Lê, U. P. (2015). Data nationalism. Emory Law Journal, 64(3), 677-739. https://scholarlycommons.law.emory.edu/elj/vol64/iss3/2
7.
Couture, S., & Toupin, S. (2019). What does the notion of “sovereignty” mean when referring to the digital? New Media & Society, 21(10), 2305-2322. https://doi.org/10.1177/1461444819865984
European Parliament & Council of the European Union. (2016). Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. Official Journal of the European Union, L 119, 1-88. https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng
9.
European Parliament & Council of the European Union. (2023). Regulation (EU) 2023/2854 on harmonised rules on fair access to and use of data (Data Act). Official Journal of the European Union, L 2023/2854. https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng
10.
Floridi, L. (2020). The fight for digital sovereignty: What it is, and why it matters, especially for the EU. Philosophy & Technology, 33(3), 369–378. https://doi.org/10.1007/s13347-020-00423-6
Mell, P., & Grance, T. (2011). The NIST definition of cloud computing (NIST Special Publication 800-145). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-145
National People’s Congress of China. (2021). Personal Information Protection Law of the People’s Republic of China. https://en.spp.gov.cn/2021-12/29/c_948419_2.htm
13.
State Council of the People’s Republic of China. (2024). Regulations on Network Data Security Management (Decree No. 790). https://english.www.gov.cn/
14.
Svantesson, D. J. B. (2017). Solving the Internet jurisdiction puzzle. Oxford University Press. https://doi.org/10.1093/oso/9780198795674.001.0001
United States Congress. (2018). Clarifying Lawful Overseas Use of Data Act, Pub. L. No. 115-141, div. V, 132 Stat. 1213. https://www.congress.gov/115/plaws/publ141/PLAW-115publ141.pdf
16.
U.S. Department of Justice. (2023). Regarding CLOUD Act executive agreements. https://www.justice.gov/criminal/criminal-oia/regarding-cloud-act-executive-agreements
