You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

September 8, 2022

What Do Vietnam’s New Data Localization Requirements Mean for Domestic Enterprises?

Subscribe to Updates

While much attention has been paid to the data localization requirements for foreign enterprises under Vietnam’s 2018 Cybersecurity Law (“CSL”) and the recently issued Decree 53 guiding its implementation, the corresponding requirements for domestic enterprises are often overlooked, despite being potentially more troublesome.

Under Decree 53, “domestic enterprises” are defined to mean enterprises established or registered for establishment under Vietnamese law and having their head offices in Vietnam (Article 2.11), so this designation includes not only Vietnamese companies, but foreign-invested enterprises as well.

Background

Before analyzing the stipulations in Articles 26 and 27 of Decree 53 further guiding the data localization/storage requirements, it is worth restating the very problematic Article 26.3 of the CSL, which reads:

“Domestic and foreign enterprises providing services on telecommunication networks or the internet or value-added services in cyberspace in Vietnam with activities of collecting, exploiting, analyzing, and/or* processing personal information data, data on the relationships of service users, or data generated by service users in Vietnam must store such data in Vietnam for the period prescribed by the government. Foreign enterprises mentioned in this clause must open branches or representative offices in Vietnam.”

[* Note: The Vietnamese text simply uses a comma here, without specifying whether this should be “and” or “or,” leading to additional problems in interpretation.]

Because of this very broad and ambiguous wording, Article 26.3 of the CSL required further guidance from the government and remained unenforced for more than three years after the CSL took effect on January 1, 2019. Decree 53 guiding the implementation of the CSL was finally issued on August 15, 2022, and provides additional clarity on this matter. But does Decree 53 provide sufficient guidelines for implementation with regard to domestic enterprises?

Scope of Application

With regard to foreign enterprises, although there remains some ambiguity, Decree 53 provides clearer guidelines by specifying 10 types of services (the “regulated services”) that are subject to the data localization requirements, as well as the triggering conditions that lead to foreign enterprises being required to store regulated data and establish a branch or representative office in Vietnam. Decree 53 even covers cases where a foreign enterprise is unable to comply with a decision of the Ministry of Public Security (MPS) due to force majeure reasons. Please see our previous article for a detailed discussion.

With regard to domestic enterprises, Article 26.2 of Decree 53 simply sets out that “domestic enterprises must store the [regulated data as defined in Article 26.1] in Vietnam,” raising concerns as to what exactly is the true intention of the drafter.

This intention could be interpreted in several ways:

  1. The drafter wishes to cover all domestic enterprises (i.e., every company incorporated in and operating in Vietnam, regardless of industry or sector);
  2. The drafter wishes to cover all domestic enterprises “providing services on telecommunication networks or the internet or value-added services in cyberspace in Vietnam collecting, exploiting, analyzing, and/or processing personal information data, data on the relationships of service users, or data generated by service users in Vietnam,” as provided by Article 26.3 of the CSL, without any triggering conditions; or
  3. The drafter additionally wants to limit the services of domestic enterprises to the 10 regulated service types for foreign enterprises, with the same triggering conditions, to afford equal treatment between domestic enterprises and foreign enterprises. (Obviously, the scope of application in the first two interpretations would lead to differential treatment.)

Interpretation (1) is the broadest coverage and would significantly widen the scope of the CSL. In theory, according to the hierarchy of law and sub-laws in Vietnam, this is not legal. In practice, we have seen the authorities enforce stricter requirements found in subordinate legislation, instead of the broad requirements under the primary law. However, in our opinion, this intention is the least likely.

Interpretation (2) is the strictly “legal” interpretation, and the most likely intention of the drafter because Decree 53 was issued to implement certain articles of the CSL – Article 26.3 in this case. However, if interpretation (2) is the true intention of the drafter, the scope of coverage remains extremely broad and unclear, and may need further clarification from the MPS.

If the intention of the drafter is to treat domestic enterprises and foreign enterprises equally – i.e., interpretation (3) – then the drafting technique is flawed, because by not specifying the 10 regulated types of services and the triggering conditions for domestic enterprises, Article 26 of Decree 53 is not drafted in a way to support this intention.

Without further clarification from the MPS, interpretation (2) is the most likely intention; however, it could be argued that this clause thus covers all types of online services for domestic enterprises that collect, use, analyze, and/or process regulated data. Why would this be so?

Article 26.3 of the CSL specifies three types of services – “services on telecommunication networks”; “services on the internet”; and “value-added services in cyberspace” – without further explanation or definition, leaving it up to Decree 53 to define these services:

  • “Services on telecommunication networks means telecommunication services and telecommunication application services as prescribed by law” (Article 2.6 of Decree 53). Telecom law defines telecommunication application services to mean “services using telecom transmission lines or telecom networks to provide application services in the sectors of information technology, radio, television, commerce, finance, culture, information, medical health, education, and other sectors.” The notable inclusion of “other sectors” could be interpreted as a “catch-all” term, leading to the possibility that it could cover all sectors/services provided on telecom/internet networks. (The internet network is a type of telecom network.)
  • “Services on the internet means internet services and services providing content on the internet as prescribed by law” (Article 2.7 of Decree 53). The concept of “services providing content on the internet” is not defined and is very broad. Arguably, without definition, such services could be interpreted to include online news, online consulting, online advertising, video on demand, OTT television services, online games, social networks, etc., leading to an extremely broad scope of application.
  • “Value-added services in cyberspace means value-added telecommunication services as prescribed by law” (Article 2.8 of Decree 53).

Therefore, with regard to domestic enterprises, it could be said that if there is no further guidance or clarification from the MPS, all online service providers which collect, use, analyze, and/or process regulated data are required to store the regulated data in Vietnam.

Form of Data Storage

Under Article 26.5 of Decree 53, the form of data storage in Vietnam is to be decided by the enterprises. However, what is sufficient to be considered as “storing data in Vietnam” is still very ambiguous.

As technology has evolved, cloud storage has become a very popular method for both domestic and foreign enterprises to store data. Is it sufficient to store data “in the cloud” if the cloud infrastructure is not located in Vietnam but is accessible via a computer in Vietnam? Or does the data need to be stored in a computer/server or cloud infrastructure that is physically located in Vietnam? Does the original regulated data have to be stored in Vietnam, or it sufficient to just store a copy? These practical concerns need further clarification from the MPS.

Duration of Data Storage

The duration for storage of regulated data of domestic enterprises is also unclear. Article 27.1 of Decree 53 stipulates that the data storage period specified in Article 26 of the decree starts from the time the enterprise receives a data storage request and lasts until the end of the request. The minimum storage period is 24 months.

It is unclear whether this data storage period is applicable to both domestic and foreign enterprises. While for foreign enterprises, Decree 53 clearly specifies the authority’s request to store data in Vietnam as a triggering condition, the decree is silent as to any conditions under which the authority will request domestic enterprises to store regulated data. As analyzed above, there might be no such condition to trigger a request for domestic enterprises. This means that, technically, Article 27.1 should only be applicable to foreign enterprises because it requires the enterprise to receive a data storage request from the authority. Therefore, it could be argued that the specified data storage duration is also only applicable to foreign enterprises, and the decree is silent regarding the data storage period for domestic enterprises. Accordingly, it is also unclear whether domestic enterprises have the obligation to continue retaining regulated data after their service users cease the use of their services.

Grace Period for Implementation

Decree 53 is silent on the grace period for domestic enterprises to store data in Vietnam. This could be interpreted to mean that unless there is further guidance from the MPS, domestic enterprises must comply with this requirement from the day Decree 53 takes effect, i.e., October 1, 2022.

Meanwhile, foreign enterprises only need to implement the data localization requirements when the triggering conditions are fulfilled and the MPS has issued a decision requesting them to do so. They also have a grace period of 12 months from the date of the decision to store data in Vietnam. Therefore, compared with foreign enterprises, domestic enterprises would need to be more proactive and act more quickly in storing regulated data in Vietnam.

How Should Domestic Enterprises Move Forward?

Although there has been a long wait for the promulgation of a decree guiding the implementation of the CSL, Decree 53 as issued still poses various ambiguities, uncertainties, and concerns that could prevent it from being implemented effectively. The question put forward is whether the MPS will issue a circular or other official clarification for further guidance of the implementation of Decree 53, especially clarification on the requirements applicable to domestic enterprises.

If there is no further clarification or guidance from the MPS, the strict legal interpretation of Decree 53 would be that all domestic enterprises “providing services on telecommunication networks or the internet or value-added services in cyberspace in Vietnam collecting, exploiting, analyzing, and/or processing personal information data, data on the relationships of service users, or data generated by service users in Vietnam” must store this regulated data in Vietnam. This means that all domestic online service providers which collect, use, analyze, or process regulated data should prepare themselves to comply with this requirement, starting from October 1, 2022.

In addition, if there is no further guidance, domestic enterprises would be well advised to store physically in Vietnam all regulated data they collect, use, analyze, or process. For example, they may store the regulated data in a file which is stored on a computer (their existing system) located in Vietnam, rather than in cloud storage that might be accessible via a computer in Vietnam, but hosted in another country.

Related Professionals

Industries

Technology

Location

RELATED INSIGHTS​ 

November 14, 2025
Interest in data center land acquisition has increased significantly over the past year, with a notable rise in inquiries from investors seeking to establish digital infrastructure in Thailand. Although the sector is still in its early stages, this emerging wave of development represents a significant shift in Thailand’s technology infrastructure landscape, driven primarily by multinational technology companies and operators looking to expand their regional presence. Project Development The data center sector in Thailand is attracting a diverse range of international investors, though with clear geographic patterns. Most investors are from China, Singapore, and Japan, with some additional interest from countries outside Asia, including the United States and Europe. This investor base consists primarily of multinational tech companies and operators seeking to establish new facilities rather than acquire existing assets. Data center business activities are also a sector promoted by Thailand’s Board of Investment (BOI), which offers investors both tax and nontax privileges as well as exemptions to foreign investment and land-ownership restrictions. Projects currently underway are still largely in the land acquisition and construction phase. Unlike more mature markets where many facilities are operational and generating revenue, the predominant focus in Thailand remains on securing suitable land and beginning the building process. This means that while interest is high and land assembly is accelerating, the sector as a whole has not yet reached the operational phase that will ultimately drive licensing applications and full regulatory compliance. The licensing process itself remains at an early stage, as most projects must first complete their facilities before applying for the specific licenses required from the telecommunications authority. Once the facilities are built, the next critical step will be obtaining these telecommunications licenses, which are mandatory for data center operations. Legal and Regulatory Considerations The complexity of data center development in Thailand requires
Read More
November 12, 2025
Thailand’s Customs Department has announced the cancellation of the longstanding de minimis exemption, which waives import duties on goods valued at THB 1,500 or less, as of January 1, 2026. This policy shift will directly impact e-commerce, logistics, and retail sectors, and will have wide-ranging implications for any company involved in cross-border trade with Thailand. Background Under current regulations, imported goods with a customs value (cost, insurance, and freight, or “CIF”) of THB 1,500 or less are exempt from import duties. This has been a cornerstone of the cross-border e-commerce model, allowing for the duty-free import of millions of small parcels. Under the new policy effective January 1, 2026, all imported goods, regardless of value, will be subject to assessment for import duties upon entry into Thailand. The stated rationale for this change is to create fair competition for Thai small and medium-sized enterprises (SMEs), which must pay VAT and other costs on their goods, putting them at a price disadvantage against foreign sellers who utilize the de minimis loophole. Business Implications This policy change will create new costs, compliance burdens, and operational challenges. For foreign e-commerce sellers and platforms: The most direct impact will be the addition of import duties to low-value items. Assuming the costs are passed on to the consumer, the higher prices and potentially more complex or slower customs clearance processes could lead to increased cart abandonment and reduced consumer demand. Businesses should review their pricing models and develop a clear strategy for calculating, declaring, and paying these new duties. For logistics providers and customs brokers: The administrative burden will be considerable. Carriers that previously handled millions of nondutiable parcels will now be required to process them for duty assessment and collection. This may necessitate new IT systems and streamlined processes to avoid delays at
Read More
November 7, 2025
Thailand and the United States signed a memorandum of understanding (MOU) titled “Cooperation to Diversify Global Critical Minerals Supply Chains and Promote Investments” on October 26, 2025, signaling a new strategic alignment aimed at developing Thailand’s mineral sector, particularly in rare earth elements (REEs). The MOU has implications for investments in technology, manufacturing, and other related sectors. This update outlines the key provisions of the MOU and the potential opportunities and legal navigating points for businesses. Objectives The primary driver of this agreement is the US initiative to diversify global supply chains for critical minerals and reduce reliance on current market leaders, particularly China. For Thailand, it represents a major opportunity to attract high-tech investment and develop its downstream processing industries. The cooperation is set to focus on five main areas: Technical knowledge: Exchange of technical expertise and international best practices to strengthen Thailand’s mining and processing sector. Joint cooperation: Establishing workshops, seminars, and scientific collaboration to boost innovation. Regulatory practice: Promoting good governance and streamlining regulatory and licensing procedures. Information sharing: Sharing data on potential projects and global market prices. Full-value chain: The MOU covers the entire mineral lifecycle, from exploration and extraction to processing, refining, and recycling. “First Opportunity to Invest” Clause The most debated provision within the MOU states that “participants expect to have the first opportunity to invest . . . in critical minerals assets that may be sold in Thailand.” Business implications: This clause is widely interpreted as granting US companies a first look or preferential access to investment opportunities in Thailand’s critical minerals sector. This could be a significant advantage for US-based or affiliated companies in mining, technology, and energy seeking to secure a foothold in a developing REE supply chain. Thai government position: Thai officials, including the prime minister, have publicly clarified
Read More
October 31, 2025
On September 29, 2025, Thailand’s Office of the Personal Data Protection Committee (PDPC Office) published its Regulations on the Review and Certification of Binding Corporate Rules B.E. 2568 (2025) (the Regulations). The Regulations provide clarity on the PDPC Office’s approach to reviewing and certifying binding corporate rules (BCRs) under Section 29 of the Personal Data Protection Act B.E. 2562 (2019) (PDPA), and aim to facilitate international data transfers within a group of undertakings or enterprises (a “corporate group”). In conjunction with this development, the PDPC Office also approved BCRs for two companies operating in Thailand on September 30, 2025. This milestone represents the first concrete progress since the PDPC’s Notification on Criteria for the Protection of Personal Data Sent or Transferred to a Foreign Country pursuant to Section 29 of the PDPA B.E. 2566 (2023) came into effect in March 2024. Some key features of the Regulations are set out below. Categorization of BCRs BCRs are classified into two types: (1) BCRs for Controllers (BCR-C) and (2) BCRs for Processors (BCR-P). The category must be clearly specified when submitting the BCRs to the PDPC Office. Documentation Requirement The applicant must prepare and submit the application (a standard template may be provided by the PDPC Office in the future) along with supporting documents for review and certification in the Thai language. If the supporting documents are in a foreign language, a certified Thai translation should be provided. The translation must be notarized by a notary public or qualified person. Supporting documents may include, among others, a binding instrument such as an intra-group agreement, or a list of entities subject to the BCRs. Expedited Process Requirement Organizations with existing BCR approvals under the EU or UK GDPR, or from countries announced by the PDPC under Section 28, may apply through an
Read More