You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

August 19, 2022

Decree 53 Provides Long-Awaited Guidance on Implementation of Vietnam’s Cybersecurity Law

Subscribe to Updates

Vietnam’s Cybersecurity Law was promulgated on June 12, 2018, and came into effect on January 1, 2019, with a majority of its provisions enforceable from the effective date. However, certain provisions of the law, including the very concerning data localization requirements, still awaited further guidance from implementing regulations. After more than three years of being drafted and submitted back and forth to the government for consideration and approval, Decree No. 53/2022/ND-CP to implement certain articles of the Cybersecurity Law (Decree 53) was finally promulgated on August 15, 2022, with an effective date of October 1, 2022. Key provisions of Decree 53 include the following.

1. Data localization requirements (Articles 26 & 27)

Decree 53 retains most of the data localization requirements of the last accessible version of the draft decree dated August 21, 2019 (Draft Decree), clearly extends the scope of requirements to cover both domestic and foreign enterprises, adds regulations on force majeure events, and amends the timeline to implement data localization requirements for business facilitation.

(i) Data subject to data localization:

Data (information in the form of symbols, writing, numbers, images, sounds, or similar forms) which must be stored in Vietnam (“regulated data”) includes:

  • Data on personal information of service users in Vietnam: Data used to identify an individual.
  • Data generated by service users in Vietnam: Data reflecting the process of participating in, operating and/or using cyberspace by service users and information about network equipment and services used in order to connect with cyberspace in the territory of Vietnam. This includes the account name for use of services, duration of use of services, credit card information, email address, IP addresses for the latest login and logout, and registered telephone number attached to the account or data.
  • Data on the relationships of service users in Vietnam: Data reflecting and determining the relationship between a service user and other people in cyberspace. This includes friends and groups with which the user connects or interacts.

(ii) Businesses/services subject to data localization

Domestic enterprises: All domestic enterprises, no matter which services they provide, must store regulated data in Vietnam.

Foreign enterprises: There are 10 businesses/services of foreign enterprises subject to storage of regulated data in Vietnam and establishment of branches or representative offices in Vietnam (“regulated services”). These include (i) telecom services; (ii) services of data storage and sharing in cyberspace (cloud storage); (iii) supply of national or international domain names to service users in Vietnam; (iv) e-commerce; (v) online payment; (vi) intermediary payment; (vii) service of transport connection via cyberspace; (viii) social networking and social media; (ix) online electronic games; (x) services of providing, managing, or operating other information in cyberspace in the form of messages, phone calls, video calls, email, or online chat.

(iii) Conditions triggering data localization requirements for foreign enterprises

While all domestic enterprises, without any exemptions, must store regulated data in Vietnam, a foreign enterprise is only required to store regulated data and establish a branch or representative office in Vietnam when:

  • It operates in one of the 10 regulated businesses/services mentioned above;
  • It has been warned by the Department for Cybersecurity and Prevention of High-Tech Crime (A05) under the Ministry of Public Security (MPS) that the services it provides have been used to commit a breach of the law on cybersecurity and it has not taken any measures for avoiding, dealing with, fighting against, or preventing such breach, or it has resisted, obstructed, or ignored requests from the relevant authorities.

One interesting note is that compared to the Draft Decree, Decree 53 has removed a third condition that the enterprise “carries out activities of collecting, exploiting [using], analyzing, and processing regulated data.” The intention of the drafter in removing this condition is unclear. The removal could be interpreted to mean that the drafter would like to widen the application scope of Decree 53 compared to the Draft Decree, or the drafter might think that collecting, using, analyzing, and processing online data are obvious and unavoidable activities in the relationship between enterprises and their service users, so there is no need to specify this as one of the triggering conditions.

The act of collecting, using, analyzing, and processing regulated data of enterprises is regulated in a separate clause (Article 26.4) in Decree 53. The wording in this clause is very obscurely drafted. However, it could be understood as follows:

  • If the data an enterprise collects, uses, analyzes, or processes is not completely stored in Vietnam as required for regulated data, the enterprise must cooperate with A05 to verify and store the data which they are collecting, using, analyzing and processing.
  • If an enterprise collects, uses, analyzes, or processes additional data which falls under regulated data, the enterprise must cooperate with A05 to supplement this data to the list of data which needs to be stored in Vietnam.

Thus, it could be interpreted that, with regard to foreign enterprises, this separate clause of collecting, using, analyzing, and processing regulated data must be read together with the triggering conditions mentioned above. In other words, not every foreign enterprise operating in the 10 regulated businesses and not every foreign enterprise collecting, using, analyzing, and processing regulated data is automatically required to store regulated data and establish a branch or representative office in Vietnam; a foreign enterprise is only required to do so when both triggering conditions are fulfilled.

In addition, if an enterprise is required to store regulated data in Vietnam when the two triggering conditions are fulfilled, but it has not stored all the regulated data in Vietnam as required (for example, if a portion of this regulated data is stored overseas without any backup/mirror copy stored in Vietnam), A05 can then request the enterprise to cooperate to verify the data and ensure all regulated data is locally stored.

 If a foreign enterprise is required to store regulated data and establish a branch or representative office in Vietnam, it would receive a decision of the Minister of Public Security requiring it to do so. Within 12 months from the date of the decision, the enterprise must complete the storage of data and establishment of a branch or representative office in Vietnam in compliance with relevant laws. Enterprises which do not comply with data localization requirements, depending on the nature and degree of violation, will be dealt with according to the law.

(iv) Force majeure

In cases of force majeure where a foreign enterprise’s compliance with the MPS’s decision to locally store regulated data in Vietnam is not possible, the enterprise must notify A05 within three working days for verification of the authenticity of force majeure. In this case, the enterprise has 30 working days to find a corrective solution.

(v) Form and duration of data storage and having a branch or representative office in Vietnam

The form of data storage in Vietnam is to be decided by the enterprises. The duration starts from the time the enterprise receives a request for storing data and lasts until the request ends, with a minimum storage time of 24 months.

System logs to serve investigation and handling of violations of the law on cybersecurity are stored for at least 12 months.

The period for having a branch or representative office in Vietnam will start from the date on which the enterprise receives a request to set up a branch or representative office and continues until the enterprise is no longer operating in Vietnam or no longer provides the regulated services in Vietnam.

2. Take-down of illegal online content (Article 19)

Illegal online content which is subject to be taken down is specified in Article 19.1 of Decree 53, and includes, among other content, content that infringes national security, propagandizes against the state; incites violence; disrupts security or public order; is humiliating or slanderous; infringes upon economic management order; or fabricates or distorts the truth, causing confusion among the people or causing serious damage to socio-economic activities.

This illegal content is subject to a decision on take-down by the Director General of A05, the heads of competent agencies of the MIC, or the specialized force for cybersecurity protection under the Ministry of Defense depending on the matter. Under Article 22.5 of Decree 53, the MPS is the focal point for matters of national security, social order and safety, cybersecurity protection, and prevention and fighting of cybercrime, cyber-terrorism, and cyber-espionage; the Ministry of Defense is the focal point for national defense activities in cyberspace; and the MIC is the focal point for civil activities outside the activities under the authority of the MPS and Ministry of Defense.

3. Collection of electronic data (e-data) relating to illegal activities in cyberspace (Article 20)

Illegal activities in cyberspace are those that infringe upon national security, social order and safety, or the lawful rights and interests of agencies, organizations, and individuals. The Director General of A05 will decide on measures to collect e-data to serve the purposes of investigation and handling of such activities. This collection must be carried out in accordance with the law and stipulated conditions and procedures specified in Article 20 of Decree 53.

4. Suspension or stoppage of information system operation, revocation of domain names (Article 21)

Suspension or stoppage of information system operation or revocation of domain names is only applicable on two grounds: (i) when there are documents proving that the operation of the information system violates the laws on national security and cybersecurity; or (ii) when the information system is being used for the purpose of infringing upon national security or social order and safety. The Minister of Public Security will issue decisions on suspension or stoppage of information system operation or revocation of domain names while the head of A05 will implement such decisions.

In urgent cases, in order to promptly stop the operation of an information system to avoid causing harm to national security or to prevent potentially harmful consequences, A05 can request concerned agencies, organizations, and individuals, directly or via fax or email, to suspend or stop the operation of such information system, and within 24 hours from the time of the request, A05 must send a written request for suspension or stoppage. If this time limit is exceeded without a written decision being issued, the information system may resume operation.

In cases related to the suspension or revocation of a national domain name, the relevant authority will send a written request to the VNNIC (Vietnam Internet Network Information Center) for suspension or revocation in accordance with the procedures prescribed by law.

If the suspension or stoppage is done without the grounds mentioned above, the people and agencies involved are responsible before the law, and must compensate for any damage caused to related agencies, organizations, or individuals.

5. Responsibilities in implementing measures to protect cybersecurity (Article 22)

When competent authorities announce that cross-border service providers are in violation of Vietnamese law, Vietnamese organizations and enterprises must coordinate with the authorities in preventing and handling the violations of these cross-border service providers.

Agencies, organizations, and individuals must promptly coordinate with and assist the specialized cybersecurity force in implementing measures for cybersecurity protection.

Any act of taking advantage of cybersecurity protection measures to violate the law will, depending on the nature and seriousness of the violation, be handled in accordance with the law; if damage is caused to the lawful rights and interests of other entities, the violator must provide compensation in accordance with the law.

Related Professionals

Industries

Technology

Location

RELATED INSIGHTS​ 

August 14, 2026
Thailand’s Office of the Insurance Commission (OIC) has issued guidelines clarifying the boundaries between permissible and prohibited activities for unlicensed individuals—including influencers, bloggers, and content creators—when communicating about insurance products on social media. The Good Practice Guidelines for Persons Not Licensed as Insurance Agents or Brokers Regarding the Dissemination of Insurance Content Through Digital Media B.E. 2569 (2026) took effect on July 24, 2026. Activities Requiring a License The guidelines reserve the following activities for licensed agents and brokers: Soliciting or facilitating insurance contracts. Providing personalized advice on product suitability. Recommending policy cancellation to purchase promoted products. Creating links that facilitate contract formation. Receiving performance-based compensation tied to policies or premiums generated. Importantly, boilerplate disclaimers such as “this is not a recommendation to buy insurance” will not shield individuals from liability if the OIC views the content as personalized advice or solicitation. Permitted Activities Unlicensed persons may present general educational content about insurance—such as explaining terminology, sharing industry statistics, reporting news, or sharing personal experiences—provided the content does not target specific individuals to purchase from specific companies. The guidelines also set out best practices for communication, including presenting information in a fair and balanced manner that covers both benefits and limitations, encouraging consumers to read policy terms and consult licensed professionals, verifying information from credible sources before dissemination, and exercising special care when the audience may include vulnerable groups such as persons aged 60 and older. Prohibited Practices Prohibited practices include fear-based marketing, creating artificial urgency, omitting material limitations, making exaggerated claims, falsely claiming professional credentials, using fake engagement mechanisms, and sharing false or misleading content. The guidelines also reinforce the prohibitions under section 83 of the Life Insurance Act B.E. 2535 and section 78 of the Non-Life Insurance Act B.E. 2535 against soliciting insurance contracts with foreign operators
Read More
August 11, 2026
On July 27, 2026, the State Bank of Vietnam (SBV) released a draft decree proposing amendments to Decree No. 52/2024/ND-CP dated May 15, 2024, on non-cash payments (Decree 52). The draft decree would amend 17 of Decree 52’s 38 articles, with several key changes directly affecting providers of intermediary payment service (IPS). The key proposed changes affecting IPS providers are outlined below. Streamlining IPS Licensing Procedures A central objective of the draft decree is to simplify regulatory procedures for IPS providers. Notably, it would significantly reduce IPS licensing documentation requirements by removing the need to submit enterprise registration certificates, investment registration certificates, and documents evidencing the qualifications of the legal representative and general director. Instead, the SBV would retrieve this information directly from national business registration and other specialized databases, requesting additional documents only where the relevant information cannot be verified electronically or is incomplete. The draft decree also removes the current limit of two rounds for dossier supplementation and shortens processing timelines for several IPS licensing procedures such as issuance, amendment, and reissuance of IPS licenses. The processing time for new IPS license applications would be thereby reduced from 90 to 60 working days. In addition, several continuing IPS business conditions would be removed. For example, IPS providers would no longer be required to maintain certain representations relating to corporate restructuring or the legality of contributed capital. Likewise, the IPS project plan (đề án) would become a one-time application document rather than an ongoing licensing condition. If retained in the final decree, this change could provide IPS providers with significantly greater flexibility to implement post-licensing technology upgrades, system integrations, and corporate restructuring transactions without needing to revisit the originally approved project plan. The draft decree also removes the requirement for the SBV to consult the Ministry of Public
Read More
August 10, 2026
Thailand has finalized its social media KYC (“know your customer”) rules under Notification of the Electronic Transactions Commission on Measures to Prevent Technological Crimes for Social Media Service Providers (No. 2), which was published in the Government Gazette on May 5, 2026, and will take effect on November 1, 2026. While an early draft of the notification proposed requiring social media platforms to arrange identification of every user account, the final notification is significantly more targeted, focusing on paid online advertising and advertiser identity verification. Though the regulatory initiative primarily aims to combat online fraud and technology-related crimes, it also has important consequences for intellectual property enforcement, because the verified platform records that will be generated under the new requirements can help IP rights holders to identify anonymous online infringers. Key Regulatory Mandates The notification requires social media service providers to verify the identity of advertisers before their paid advertisements are published and disseminated in Thailand through social media, regardless of whether the advertising fees come from the advertisers or third parties. Verification of an advertiser is valid for one year, after which verification would have to be performed again before the platform could publish additional paid advertisements from the advertiser. Permitted verification methods are specified under the notification. A platform may verify an advertiser by checking identity evidence and confirming the connection between the advertiser and that identity evidence, with the notification giving facial comparison against certain government-issued identity documents as an example. Alternatively, platforms may verify advertisers through a digital identity verification and authentication system with an identity-proofing assurance level not lower than the level prescribed by Thailand’s Electronic Transactions Commission. The notification further requires platforms to retain only the advertiser’s information necessary to identify the advertiser, beginning from the start of the advertising activity and for
Read More
August 10, 2026
On July 31, 2026, Thailand’s Big Data Institute (BDI) launched a public consultation on the principles of a proposed new data-sharing law, with comments accepted until August 31, 2026. If enacted, the law would establish Thailand’s first comprehensive framework for government and private-sector data sharing, creating a systematic, secure, and transparent regime to support analytics, policymaking, research, and innovation. Central Data-Sharing Platform The draft law establishes a central system for data sharing, managed by the BDI. Government agencies would be required to connect to the BDI’s Data Integration and Intelligence Platform (also referred to as D2), in accordance with the BDI’s rules and procedures. Five Dimensions of Data Sharing The draft law covers five key types of data sharing between government (G), businesses (B), and consumers (C): G2B: Private organizations may request government data specifically for research and development purposes. The BDI will assess the applicant’s data governance, security, and privacy capabilities whether such measures meet prescribed standards before forwarding the request to the relevant government agency within 90 days. Any dispute may be escalated to a newly established Data-Sharing Promotion Committee for final determination. G2G: Government agencies may request data from other agencies through the central system. The data-holding agency must respond within 90 days, taking legality, necessity, proportionality, public interest, and personal data protection into account. Disputes may be referred to the Data-Sharing Promotion Committee for adjudication. B2G: In emergency situations involving public safety, economic security, or disaster response, the Minister of Digital Economy and Society may require private entities to provide data through the central data-sharing system. Government agencies must specify the data requested, demonstrate its necessity and expected benefits, and request only data reasonably available to the data holder. Requests for personal data must be limited to the minimum amount necessary. B2C: Royal decrees may
Read More