Sovereign Data: Kenya, Indonesia and Vietnam Redraw the Data Map

Decree No. 314/2026/ND-CP, signed on August 8, 2026, established the framework for the operation of data exchanges in Vietnam, with its provisions taking effect on September 25, 2026, according to MLex.

The Centralized Exchange Model in Vietnam

Vietnam is implementing a centralized approach to data sovereignty through its National Data Exchange. This system is built, run, and supervised by the National Data Center under the Ministry of Public Security. The decree specifies that all exchanges within this system must meet information-system security Level 3 or higher. This technical requirement serves as a significant barrier to entry for smaller or less-resourced participants. Also, the decree mandates that foreign entities must maintain a commercial presence in Vietnam to participate in the exchange. This requirement effectively ties participation in the national data economy to a localized physical or legal presence.

One reading of these requirements is that Vietnam is moving to ensure that data flows are not only legally traceable but also physically and operationally tethered to the state's oversight. The decree also notes that traded data must originate from lawful sources that are provable with valid records. This emphasis on provenance, combined with the requirement for a commercial presence, suggests a high level of administrative control over the data lifecycle. The decree was issued approximately two months later than the initial Q2 2026 target, according to Thu Vien Phap Luat.

Foreign entities must maintain a commercial presence in Vietnam to participate in the National Data Exchange, according to Decree No. 314/2026/ND-CP.

Key Insight

Indonesia: Resolving Governance Fragmentation

In Indonesia, the legal terrain for data governance has shifted from fragmented executive regulations toward a unified statutory framework. The Satu Data Indonesia (One Data) bill was passed into law by the DPR plenary on October 6, 2026, according to CNN Indonesia. This new law consists of 20 chapters and 141 articles, focusing on national basic data, data governance planning, and security and protection standards. The Indonesian cyber and encryption agency is expected to play a role in implementing these standards.

This legislative action addresses a fundamental tension in Indonesian data governance: the lack of binding authority for previous executive orders. In April 2026, the Baleg chair, Bob Hasan, argued that Perpres 39/2019 lacked the necessary force to bind all ministries. By elevating data governance to a formal law (Undang-Undang), the government aims to ensure compliance across all government bodies. The new law mandates that implementing bodies be formed within one year of the law's passage, according to Bisnis.com. While the law clarifies domestic governance, it remains unclear from the current text how it will address cross-border transfer provisions.

The Kenyan Transfer and Localization Nexus

Kenya is currently refining its rules for cross-border data movement through a draft Guidance Note from the Office of the Data Protection Commissioner (ODPC). Released in April 2026, the draft guidance implements Part VI of the Data Protection Act 2019 and Regulation 40 of the 2021 General Regulations. A critical component of this draft is the definition of data transfers: the placement of Kenyan personal data on a foreign cloud server is explicitly classified as a transfer. This definition has significant implications for multinational companies that rely on centralized global cloud architectures.

The draft provides three distinct routes for legal data transfers:

• The destination country must ratify and implement the AU Malabo Convention.
• The parties must enter into a reciprocal agreement.
• Entities can utilize Binding Corporate Rules (BCRs).

Additionally, the draft introduces a localization requirement for data processing that is deemed to be in the "Strategic Interest of the State." Under Section 49(3) of the Act, the Commissioner retains the power to prohibit, suspend, or condition transfers based on these assessments, according to ODPC. The draft leaves open how broadly that discretion will be used.

Comparative Regulatory Frameworks

The regulatory approaches taken by these three nations reflect different philosophies of sovereignty: centralized exchange, statutory standardization, and conditional transfer. The following table compares the primary mechanisms identified in the current regulatory terrain.

Jurisdiction	Primary Mechanism	Key Operational Requirement	Regulatory Driver
Vietnam	National Data Exchange	Security Level 3+; Commercial presence	Ministry of Public Security
Indonesia	Satu Data Indonesia Law	National basic data compliance	Cyber and encryption agency
Kenya	ODPC Guidance (Draft)	Localization for "Strategic Interest"	ODPC Commissioner

Operational Implications for Global Entities

The divergence in these models presents a complex terrain for technology providers and multinational corporations. For cloud service providers operating in Vietnam, the requirement for Level 3 security compliance and a local commercial presence necessitates a shift from centralized global models toward more localized infrastructure and legal structures. This suggests that "borderless" cloud services may face increasing friction in markets where the state demands direct oversight through a National Data Center.

For investors and executives in the Indonesian market, the one-year implementation window for new implementing bodies is a critical period. The effectiveness of the Satu Data Indonesia law will depend on whether these bodies can successfully enforce the standards across all ministries. In Kenya, the definition of cloud hosting as a "transfer" means that companies must proactively review their data architecture to ensure they can meet the requirements of either the AU Malabo Convention or the implementation of Binding Corporate Rules. If the "Strategic Interest of the State" clause is interpreted broadly, companies may face unexpected requirements to localize data within Kenyan borders.

The definition of processing within the 'Strategic Interest of the State' allows the Commissioner to prohibit or condition data transfers, according to the ODPC draft guidance.

Watch For

Strategic Watchlist for Regulators and Investors

As these regulatory regimes mature, several key indicators will determine the ease of cross-border data operations in these regions. Stakeholders should monitor the following:

1. The formation and enforcement capabilities of the implementing bodies in Indonesia, expected within one year of the October 2026 law's passage.
2. The finalization of Kenya's ODPC Guidance Note following the April/May 2026 draft period, specifically regarding how the "Strategic Interest of the State" is defined.
3. The first audits of foreign commercial entities operating under the Vietnamese National Data Exchange framework to verify compliance with Level 3 security standards.

Failure to monitor these specific legal and technical thresholds may lead to sudden compliance gaps for organizations operating across these three jurisdictions.

Sources: thuvienphapluat.vn, mlex.com, cnnindonesia.com, teknologi.bisnis.com, odpc.go.ke, itweb.africa.