Vietnam data localization rules under Decree 53

Vietnam data localization rules decide which companies must keep certain data on servers inside Vietnam. The main rules sit in Decree 53/2022/ND-CP, signed on 15 August 2022 and in force since 1 October 2022. It explains Article 26 of the Law on Cybersecurity (24/2018/QH14). Short answer: Vietnamese companies in telecom and internet services must follow the rules. Foreign companies must follow them only in set cases.

Where the rules come from

The Law on Cybersecurity took effect on 1 January 2019. Article 26 said that certain service providers must store data of users in Vietnam inside the country. It left the details for a later decree.

Decree 53 supplies those details. It covers who must store data, which data, for how long, and when a foreign firm must open an office in Vietnam. Law firm notes at the time say it clarifies Article 26(3) of the law. Read the decree together with the law. Neither one is enough alone.

Sources: Decree 53/2022/ND-CP of 15 August 2022, as summarized by Allens, August 2022 and Allen & Gledhill, October 2022; Law on Cybersecurity 24/2018/QH14, Article 26(3).

Which data must be stored in Vietnam

The decree names three groups of data. The first is personal information of service users in Vietnam. The second is data that users in Vietnam create, such as account names, time spent on the service, credit card information, email addresses, recent login and logout times and IP addresses. The third is data about the relationships of users, such as friends or groups they are connected to.

This is user data. It is not every file a company holds. Internal accounts, supplier records and product designs are not the target of these rules.

Sources: Allen & Gledhill, October 2022; Allens, August 2022.

Who must store it

Companies set up under Vietnamese law must store the data in Vietnam if they provide telecom services, telecom-based application services, value-added telecom services, internet services or over-the-top content services on the internet. This duty is ongoing. It does not wait for a request from the authorities. Branches and offices of foreign companies do not count as Vietnamese companies here.

Foreign companies are treated differently. They must store data and open a branch or representative office in Vietnam only when two conditions are both met. First, the company works in a listed field (ten are named for foreign firms). The list includes telecom services, data storage and sharing in cyberspace, domain name services, e-commerce, online payment, payment intermediary services, transport connection services in cyberspace, social networks and social media, online games, and services that supply or run information in cyberspace such as messages, calls and email. Second, its services have been used to break cybersecurity laws, the Department of Cybersecurity and High-Tech Crime Prevention told it in writing, and it did not cooperate or it blocked protective measures.

Only then does the Minister of Public Security issue a written order to localize. It is not automatic. A foreign firm that is not in a listed field is not covered by this requirement.

Sources: Allens, August 2022; Allen & Gledhill, October 2022.

How long, and how fast

The minimum storage time is 24 months. For a foreign company, the storage time starts when it receives the storage request and runs until that request ends. The decree also gives a deadline to act. A foreign company has 12 months from the date of the Minister's order to store the data and set up its branch or office in Vietnam.

Do not read the 24 months as a limit on holding data. It is the least time to keep it in the country. Other laws, such as tax and accounting rules, may ask you to keep records for longer.

Sources: Allens, August 2022; Allen & Gledhill, October 2022.

Who is not covered

Many firms are outside the rules. A foreign company outside the listed fields has no duty to localize under Decree 53. A Vietnamese company outside the five listed service types is also outside the decree. A listed company that has never been linked to a breach of cybersecurity law has no order against it. A company that only holds its own staff and business records is not storing user data in the sense of the decree.

That said, a foreign company that serves users in Vietnam through an online service should watch the list closely. The fields are wide, and a mixed business may touch more than one.

Sources: Allens, August 2022; Allen & Gledhill, October 2022.

A practical checklist

Take these steps now. First, find out whether your company is Vietnamese or foreign. Second, check whether your services match a listed field. Third, map the user data you hold: personal details, account data and relationship data. Fourth, note where it is stored today. Fifth, plan how you would move it to Vietnam and how you would open an office if you were ordered to. Sixth, keep records of your plan. Review it when the authorities issue new guidance.

This article is general information about the law, not legal advice. For your own case, speak to a qualified Vietnamese lawyer.

Sources: Allens, August 2022; Allen & Gledhill, October 2022.