You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

August 19, 2022

Decree 53 Provides Long-Awaited Guidance on Implementation of Vietnam’s Cybersecurity Law

Subscribe to Updates

Vietnam’s Cybersecurity Law was promulgated on June 12, 2018, and came into effect on January 1, 2019, with a majority of its provisions enforceable from the effective date. However, certain provisions of the law, including the very concerning data localization requirements, still awaited further guidance from implementing regulations. After more than three years of being drafted and submitted back and forth to the government for consideration and approval, Decree No. 53/2022/ND-CP to implement certain articles of the Cybersecurity Law (Decree 53) was finally promulgated on August 15, 2022, with an effective date of October 1, 2022. Key provisions of Decree 53 include the following.

1. Data localization requirements (Articles 26 & 27)

Decree 53 retains most of the data localization requirements of the last accessible version of the draft decree dated August 21, 2019 (Draft Decree), clearly extends the scope of requirements to cover both domestic and foreign enterprises, adds regulations on force majeure events, and amends the timeline to implement data localization requirements for business facilitation.

(i) Data subject to data localization:

Data (information in the form of symbols, writing, numbers, images, sounds, or similar forms) which must be stored in Vietnam (“regulated data”) includes:

  • Data on personal information of service users in Vietnam: Data used to identify an individual.
  • Data generated by service users in Vietnam: Data reflecting the process of participating in, operating and/or using cyberspace by service users and information about network equipment and services used in order to connect with cyberspace in the territory of Vietnam. This includes the account name for use of services, duration of use of services, credit card information, email address, IP addresses for the latest login and logout, and registered telephone number attached to the account or data.
  • Data on the relationships of service users in Vietnam: Data reflecting and determining the relationship between a service user and other people in cyberspace. This includes friends and groups with which the user connects or interacts.

(ii) Businesses/services subject to data localization

Domestic enterprises: All domestic enterprises, no matter which services they provide, must store regulated data in Vietnam.

Foreign enterprises: There are 10 businesses/services of foreign enterprises subject to storage of regulated data in Vietnam and establishment of branches or representative offices in Vietnam (“regulated services”). These include (i) telecom services; (ii) services of data storage and sharing in cyberspace (cloud storage); (iii) supply of national or international domain names to service users in Vietnam; (iv) e-commerce; (v) online payment; (vi) intermediary payment; (vii) service of transport connection via cyberspace; (viii) social networking and social media; (ix) online electronic games; (x) services of providing, managing, or operating other information in cyberspace in the form of messages, phone calls, video calls, email, or online chat.

(iii) Conditions triggering data localization requirements for foreign enterprises

While all domestic enterprises, without any exemptions, must store regulated data in Vietnam, a foreign enterprise is only required to store regulated data and establish a branch or representative office in Vietnam when:

  • It operates in one of the 10 regulated businesses/services mentioned above;
  • It has been warned by the Department for Cybersecurity and Prevention of High-Tech Crime (A05) under the Ministry of Public Security (MPS) that the services it provides have been used to commit a breach of the law on cybersecurity and it has not taken any measures for avoiding, dealing with, fighting against, or preventing such breach, or it has resisted, obstructed, or ignored requests from the relevant authorities.

One interesting note is that compared to the Draft Decree, Decree 53 has removed a third condition that the enterprise “carries out activities of collecting, exploiting [using], analyzing, and processing regulated data.” The intention of the drafter in removing this condition is unclear. The removal could be interpreted to mean that the drafter would like to widen the application scope of Decree 53 compared to the Draft Decree, or the drafter might think that collecting, using, analyzing, and processing online data are obvious and unavoidable activities in the relationship between enterprises and their service users, so there is no need to specify this as one of the triggering conditions.

The act of collecting, using, analyzing, and processing regulated data of enterprises is regulated in a separate clause (Article 26.4) in Decree 53. The wording in this clause is very obscurely drafted. However, it could be understood as follows:

  • If the data an enterprise collects, uses, analyzes, or processes is not completely stored in Vietnam as required for regulated data, the enterprise must cooperate with A05 to verify and store the data which they are collecting, using, analyzing and processing.
  • If an enterprise collects, uses, analyzes, or processes additional data which falls under regulated data, the enterprise must cooperate with A05 to supplement this data to the list of data which needs to be stored in Vietnam.

Thus, it could be interpreted that, with regard to foreign enterprises, this separate clause of collecting, using, analyzing, and processing regulated data must be read together with the triggering conditions mentioned above. In other words, not every foreign enterprise operating in the 10 regulated businesses and not every foreign enterprise collecting, using, analyzing, and processing regulated data is automatically required to store regulated data and establish a branch or representative office in Vietnam; a foreign enterprise is only required to do so when both triggering conditions are fulfilled.

In addition, if an enterprise is required to store regulated data in Vietnam when the two triggering conditions are fulfilled, but it has not stored all the regulated data in Vietnam as required (for example, if a portion of this regulated data is stored overseas without any backup/mirror copy stored in Vietnam), A05 can then request the enterprise to cooperate to verify the data and ensure all regulated data is locally stored.

 If a foreign enterprise is required to store regulated data and establish a branch or representative office in Vietnam, it would receive a decision of the Minister of Public Security requiring it to do so. Within 12 months from the date of the decision, the enterprise must complete the storage of data and establishment of a branch or representative office in Vietnam in compliance with relevant laws. Enterprises which do not comply with data localization requirements, depending on the nature and degree of violation, will be dealt with according to the law.

(iv) Force majeure

In cases of force majeure where a foreign enterprise’s compliance with the MPS’s decision to locally store regulated data in Vietnam is not possible, the enterprise must notify A05 within three working days for verification of the authenticity of force majeure. In this case, the enterprise has 30 working days to find a corrective solution.

(v) Form and duration of data storage and having a branch or representative office in Vietnam

The form of data storage in Vietnam is to be decided by the enterprises. The duration starts from the time the enterprise receives a request for storing data and lasts until the request ends, with a minimum storage time of 24 months.

System logs to serve investigation and handling of violations of the law on cybersecurity are stored for at least 12 months.

The period for having a branch or representative office in Vietnam will start from the date on which the enterprise receives a request to set up a branch or representative office and continues until the enterprise is no longer operating in Vietnam or no longer provides the regulated services in Vietnam.

2. Take-down of illegal online content (Article 19)

Illegal online content which is subject to be taken down is specified in Article 19.1 of Decree 53, and includes, among other content, content that infringes national security, propagandizes against the state; incites violence; disrupts security or public order; is humiliating or slanderous; infringes upon economic management order; or fabricates or distorts the truth, causing confusion among the people or causing serious damage to socio-economic activities.

This illegal content is subject to a decision on take-down by the Director General of A05, the heads of competent agencies of the MIC, or the specialized force for cybersecurity protection under the Ministry of Defense depending on the matter. Under Article 22.5 of Decree 53, the MPS is the focal point for matters of national security, social order and safety, cybersecurity protection, and prevention and fighting of cybercrime, cyber-terrorism, and cyber-espionage; the Ministry of Defense is the focal point for national defense activities in cyberspace; and the MIC is the focal point for civil activities outside the activities under the authority of the MPS and Ministry of Defense.

3. Collection of electronic data (e-data) relating to illegal activities in cyberspace (Article 20)

Illegal activities in cyberspace are those that infringe upon national security, social order and safety, or the lawful rights and interests of agencies, organizations, and individuals. The Director General of A05 will decide on measures to collect e-data to serve the purposes of investigation and handling of such activities. This collection must be carried out in accordance with the law and stipulated conditions and procedures specified in Article 20 of Decree 53.

4. Suspension or stoppage of information system operation, revocation of domain names (Article 21)

Suspension or stoppage of information system operation or revocation of domain names is only applicable on two grounds: (i) when there are documents proving that the operation of the information system violates the laws on national security and cybersecurity; or (ii) when the information system is being used for the purpose of infringing upon national security or social order and safety. The Minister of Public Security will issue decisions on suspension or stoppage of information system operation or revocation of domain names while the head of A05 will implement such decisions.

In urgent cases, in order to promptly stop the operation of an information system to avoid causing harm to national security or to prevent potentially harmful consequences, A05 can request concerned agencies, organizations, and individuals, directly or via fax or email, to suspend or stop the operation of such information system, and within 24 hours from the time of the request, A05 must send a written request for suspension or stoppage. If this time limit is exceeded without a written decision being issued, the information system may resume operation.

In cases related to the suspension or revocation of a national domain name, the relevant authority will send a written request to the VNNIC (Vietnam Internet Network Information Center) for suspension or revocation in accordance with the procedures prescribed by law.

If the suspension or stoppage is done without the grounds mentioned above, the people and agencies involved are responsible before the law, and must compensate for any damage caused to related agencies, organizations, or individuals.

5. Responsibilities in implementing measures to protect cybersecurity (Article 22)

When competent authorities announce that cross-border service providers are in violation of Vietnamese law, Vietnamese organizations and enterprises must coordinate with the authorities in preventing and handling the violations of these cross-border service providers.

Agencies, organizations, and individuals must promptly coordinate with and assist the specialized cybersecurity force in implementing measures for cybersecurity protection.

Any act of taking advantage of cybersecurity protection measures to violate the law will, depending on the nature and seriousness of the violation, be handled in accordance with the law; if damage is caused to the lawful rights and interests of other entities, the violator must provide compensation in accordance with the law.

Related Professionals

Industries

Technology

Location

RELATED INSIGHTS​ 

September 30, 2026
On September 15, 2026, Vietnam’s Ministry of Finance (MOF) released for public consultation a draft circular on reporting and information disclosure in the pilot crypto asset market. The draft implements Resolution No. 05/2025/NQ-CP on the Pilot Implementation of the Crypto Asset Market in Vietnam and provides further detail on how licensed crypto asset service providers (“CASPs”) will be supervised once the market becomes operational. The draft indicates a data-intensive supervisory model, with licensed CASPs serving as the first line of market oversight. Public Disclosure Requirements The draft imposes detailed public disclosure requirements on CASPs, aimed primarily at market transparency. CASPs and crypto asset issuers must make disclosures in both Vietnamese and English, retain reported and disclosed information for at least 10 years, and keep information published on their websites accessible for at least five years. For CASPs, disclosure obligations arise both periodically and when specific events occur. A CASP must announce any crypto asset to be admitted to trading on its website at least seven days before trading begins and publish periodic financial statements. Certain extraordinary events and information requested by the MOF must generally be disclosed within 24 hours. CASPs must also provide ongoing market information. During trading hours, they must publish key trading data, including prices and volumes, daily highs and lows, average prices, the three best bid and offer levels, and transactions by foreign investors. By 9:00 a.m. each trading day, they must publish specified information on the previous day’s trading activity. Regulatory Reporting Requirements Separate from public disclosure, the draft requires CASPs to provide regulators with detailed information enabling ongoing supervision of their operations and the market. For market activity, CASPs must report decisions to admit or remove a crypto asset from trading within 24 hours, submit previous-day trading data to the State Securities Commission
Read More
September 24, 2026
Vietnam is implementing and developing a broad package of regulatory reforms that could reshape how IP, data, digital platforms, and product authenticity are regulated and enforced. Several of the key measures have been led by the Ministry of Public Security in its legislative and administrative capacity, as part of a broader government effort. The core reform package consists of four key legal instruments: proposed amendments to the Criminal Code, a proposed new Data Security Law, a draft Decree on Product Identification, Authentication and Traceability, and the newly enacted Decree No. 330/2026/ND-CP. These instruments include rules on criminal enforcement, data security, electronic identification, product identification and traceability, administrative violations, and cybersecurity sanctions. Combined, these measures will affect copyright enforcement, industrial property rights, trade secrets, AI training data, product provenance, online takedowns, valuation of counterfeit goods and electronic evidence. It is worth noting that, in addition to strengthening criminal penalties for IP crimes, Vietnam’s emerging regulatory framework increasingly treats infringement, data misuse, product authentication, and platform-enabled violations as interconnected regulatory and enforcement challenges. For rights holders and foreign investors, this could mean stronger tools against counterfeiting and online infringement, but also more compliance obligations around data, traceability, AI, platform controls and government-facing reporting. Expansion of Criminal IP Enforcement Proposed amendments to Article 225 of the Criminal Code would expand criminal copyright exposure beyond reproduction and distribution to cover large-scale commercial public performance and online communication of works, phonograms and video recordings. This is important because piracy is increasingly about streaming, unauthorized communication, and platform access models rather than physical copying. Aggravated copyright infringement could be subject to up to 10 years in prison for individuals and fines of up to VND 6 billion (about USD 228,300) for commercial legal entities. The amended Article 226 would expand criminal industrial property liability beyond
Read More
September 17, 2026
Thailand’s Office of the Consumer Protection Board (OCPB) has released for public comment a draft bill to amend the Consumer Protection Act B.E. 2522 (1979), the country’s foundational consumer protection legislation. The draft amendment aims to modernize the nearly five-decade-old framework to address the rapid growth of digital commerce, online advertising, influencer marketing, and new business models. The public consultation period is open until October 10, 2026. Expanded Definitions Covering Digital Commerce The draft significantly broadens several core definitions to capture modern commercial activities: “Consumer” is expanded to include natural persons and nonprofit juristic persons who purchase or receive services, including those solicited by businesses and end users who do not directly pay for the goods or services. “Business operator” now explicitly covers advertising business operators and hired advertising persons, such as influencers and content creators. “Advertising media” is expanded to include digital platforms, social media, and social media user accounts. “Label” now encompasses electronic labels—symbols, codes, or other electronic formats displaying product information. Influencer and Advertising Disclosure Requirements In addition to these expanded definitions, “hired advertising person for selling goods or services” is a new definition covering influencers, content creators, live streamers, affiliate marketers, and virtual online media operators who receive monetary compensation or other benefits for advertising goods or services. Hired advertising persons—including influencers and content creators—must disclose to consumers that content is advertising and reveal their relationship with the business owner. Disclosure is required when the business owner employs the advertiser, pays or provides other benefits for the advertisement, or provides free or discounted products or services. These requirements apply where consumers would not otherwise know that the business has a connection to the person presenting the content. Labeling Requirements for Importers The draft introduces a clearer labeling obligation for importers of label-controlled goods, who must
Read More
September 11, 2026
Thailand’s National Broadcasting and Telecommunications Commission (NBTC) has published a new five-year master plan that will bring significant regulatory changes to the broadcasting and digital media sectors, including formal licensing requirements for internet-based audiovisual services. The Master Plan for Broadcasting and Television, 3rd Edition (B.E. 2569–2573/2026–2030) was published in the Government Gazette on September 1, 2026, and will affect OTT platforms, internet-based audiovisual service providers, and traditional broadcasters. Licensing Reform The NBTC will develop new licensing frameworks ahead of existing digital television license expirations, which are slated to occur between 2028 and 2030. This creates both uncertainty and opportunity for incumbents and new market entrants. New licensing criteria will also be developed for audiovisual services delivered over the internet, meaning previously unregulated internet-based providers may face licensing, fee, and content obligations for the first time. The plan also calls for a new law to govern converged communications services. OTT Regulation and Content Oversight The plan explicitly acknowledges and aims to lessen the regulatory asymmetry between traditional broadcasters—which are subject to licensing, fees, and content regulation—and internet-based services that currently face fewer obligations. The NBTC intends to develop regulatory frameworks to bring internet-based audiovisual services, including OTT platforms, streaming services, and user-generated content platforms, under content, consumer protection, and licensing requirements. Consumer Protection and Digital Rights The NBTC will strengthen its oversight of broadcasting, television, and telecommunications operators to ensure compliance with consumer protection and personal data protection requirements. This includes updating relevant notifications and orders and more strictly enforcing rules against practices that unfairly exploit consumers. These measures may layer NBTC-specific requirements on top of Thailand’s existing Personal Data Protection Act obligations. Stricter enforcement against practices that exploit consumers is a priority, with particular scrutiny on advertising practices. The NBTC will modernize complaint resolution processes, meaning service providers should
Read More