You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

September 8, 2022

What Do Vietnam’s New Data Localization Requirements Mean for Domestic Enterprises?

Subscribe to Updates

While much attention has been paid to the data localization requirements for foreign enterprises under Vietnam’s 2018 Cybersecurity Law (“CSL”) and the recently issued Decree 53 guiding its implementation, the corresponding requirements for domestic enterprises are often overlooked, despite being potentially more troublesome.

Under Decree 53, “domestic enterprises” are defined to mean enterprises established or registered for establishment under Vietnamese law and having their head offices in Vietnam (Article 2.11), so this designation includes not only Vietnamese companies, but foreign-invested enterprises as well.

Background

Before analyzing the stipulations in Articles 26 and 27 of Decree 53 further guiding the data localization/storage requirements, it is worth restating the very problematic Article 26.3 of the CSL, which reads:

“Domestic and foreign enterprises providing services on telecommunication networks or the internet or value-added services in cyberspace in Vietnam with activities of collecting, exploiting, analyzing, and/or* processing personal information data, data on the relationships of service users, or data generated by service users in Vietnam must store such data in Vietnam for the period prescribed by the government. Foreign enterprises mentioned in this clause must open branches or representative offices in Vietnam.”

[* Note: The Vietnamese text simply uses a comma here, without specifying whether this should be “and” or “or,” leading to additional problems in interpretation.]

Because of this very broad and ambiguous wording, Article 26.3 of the CSL required further guidance from the government and remained unenforced for more than three years after the CSL took effect on January 1, 2019. Decree 53 guiding the implementation of the CSL was finally issued on August 15, 2022, and provides additional clarity on this matter. But does Decree 53 provide sufficient guidelines for implementation with regard to domestic enterprises?

Scope of Application

With regard to foreign enterprises, although there remains some ambiguity, Decree 53 provides clearer guidelines by specifying 10 types of services (the “regulated services”) that are subject to the data localization requirements, as well as the triggering conditions that lead to foreign enterprises being required to store regulated data and establish a branch or representative office in Vietnam. Decree 53 even covers cases where a foreign enterprise is unable to comply with a decision of the Ministry of Public Security (MPS) due to force majeure reasons. Please see our previous article for a detailed discussion.

With regard to domestic enterprises, Article 26.2 of Decree 53 simply sets out that “domestic enterprises must store the [regulated data as defined in Article 26.1] in Vietnam,” raising concerns as to what exactly is the true intention of the drafter.

This intention could be interpreted in several ways:

  1. The drafter wishes to cover all domestic enterprises (i.e., every company incorporated in and operating in Vietnam, regardless of industry or sector);
  2. The drafter wishes to cover all domestic enterprises “providing services on telecommunication networks or the internet or value-added services in cyberspace in Vietnam collecting, exploiting, analyzing, and/or processing personal information data, data on the relationships of service users, or data generated by service users in Vietnam,” as provided by Article 26.3 of the CSL, without any triggering conditions; or
  3. The drafter additionally wants to limit the services of domestic enterprises to the 10 regulated service types for foreign enterprises, with the same triggering conditions, to afford equal treatment between domestic enterprises and foreign enterprises. (Obviously, the scope of application in the first two interpretations would lead to differential treatment.)

Interpretation (1) is the broadest coverage and would significantly widen the scope of the CSL. In theory, according to the hierarchy of law and sub-laws in Vietnam, this is not legal. In practice, we have seen the authorities enforce stricter requirements found in subordinate legislation, instead of the broad requirements under the primary law. However, in our opinion, this intention is the least likely.

Interpretation (2) is the strictly “legal” interpretation, and the most likely intention of the drafter because Decree 53 was issued to implement certain articles of the CSL – Article 26.3 in this case. However, if interpretation (2) is the true intention of the drafter, the scope of coverage remains extremely broad and unclear, and may need further clarification from the MPS.

If the intention of the drafter is to treat domestic enterprises and foreign enterprises equally – i.e., interpretation (3) – then the drafting technique is flawed, because by not specifying the 10 regulated types of services and the triggering conditions for domestic enterprises, Article 26 of Decree 53 is not drafted in a way to support this intention.

Without further clarification from the MPS, interpretation (2) is the most likely intention; however, it could be argued that this clause thus covers all types of online services for domestic enterprises that collect, use, analyze, and/or process regulated data. Why would this be so?

Article 26.3 of the CSL specifies three types of services – “services on telecommunication networks”; “services on the internet”; and “value-added services in cyberspace” – without further explanation or definition, leaving it up to Decree 53 to define these services:

  • “Services on telecommunication networks means telecommunication services and telecommunication application services as prescribed by law” (Article 2.6 of Decree 53). Telecom law defines telecommunication application services to mean “services using telecom transmission lines or telecom networks to provide application services in the sectors of information technology, radio, television, commerce, finance, culture, information, medical health, education, and other sectors.” The notable inclusion of “other sectors” could be interpreted as a “catch-all” term, leading to the possibility that it could cover all sectors/services provided on telecom/internet networks. (The internet network is a type of telecom network.)
  • “Services on the internet means internet services and services providing content on the internet as prescribed by law” (Article 2.7 of Decree 53). The concept of “services providing content on the internet” is not defined and is very broad. Arguably, without definition, such services could be interpreted to include online news, online consulting, online advertising, video on demand, OTT television services, online games, social networks, etc., leading to an extremely broad scope of application.
  • “Value-added services in cyberspace means value-added telecommunication services as prescribed by law” (Article 2.8 of Decree 53).

Therefore, with regard to domestic enterprises, it could be said that if there is no further guidance or clarification from the MPS, all online service providers which collect, use, analyze, and/or process regulated data are required to store the regulated data in Vietnam.

Form of Data Storage

Under Article 26.5 of Decree 53, the form of data storage in Vietnam is to be decided by the enterprises. However, what is sufficient to be considered as “storing data in Vietnam” is still very ambiguous.

As technology has evolved, cloud storage has become a very popular method for both domestic and foreign enterprises to store data. Is it sufficient to store data “in the cloud” if the cloud infrastructure is not located in Vietnam but is accessible via a computer in Vietnam? Or does the data need to be stored in a computer/server or cloud infrastructure that is physically located in Vietnam? Does the original regulated data have to be stored in Vietnam, or it sufficient to just store a copy? These practical concerns need further clarification from the MPS.

Duration of Data Storage

The duration for storage of regulated data of domestic enterprises is also unclear. Article 27.1 of Decree 53 stipulates that the data storage period specified in Article 26 of the decree starts from the time the enterprise receives a data storage request and lasts until the end of the request. The minimum storage period is 24 months.

It is unclear whether this data storage period is applicable to both domestic and foreign enterprises. While for foreign enterprises, Decree 53 clearly specifies the authority’s request to store data in Vietnam as a triggering condition, the decree is silent as to any conditions under which the authority will request domestic enterprises to store regulated data. As analyzed above, there might be no such condition to trigger a request for domestic enterprises. This means that, technically, Article 27.1 should only be applicable to foreign enterprises because it requires the enterprise to receive a data storage request from the authority. Therefore, it could be argued that the specified data storage duration is also only applicable to foreign enterprises, and the decree is silent regarding the data storage period for domestic enterprises. Accordingly, it is also unclear whether domestic enterprises have the obligation to continue retaining regulated data after their service users cease the use of their services.

Grace Period for Implementation

Decree 53 is silent on the grace period for domestic enterprises to store data in Vietnam. This could be interpreted to mean that unless there is further guidance from the MPS, domestic enterprises must comply with this requirement from the day Decree 53 takes effect, i.e., October 1, 2022.

Meanwhile, foreign enterprises only need to implement the data localization requirements when the triggering conditions are fulfilled and the MPS has issued a decision requesting them to do so. They also have a grace period of 12 months from the date of the decision to store data in Vietnam. Therefore, compared with foreign enterprises, domestic enterprises would need to be more proactive and act more quickly in storing regulated data in Vietnam.

How Should Domestic Enterprises Move Forward?

Although there has been a long wait for the promulgation of a decree guiding the implementation of the CSL, Decree 53 as issued still poses various ambiguities, uncertainties, and concerns that could prevent it from being implemented effectively. The question put forward is whether the MPS will issue a circular or other official clarification for further guidance of the implementation of Decree 53, especially clarification on the requirements applicable to domestic enterprises.

If there is no further clarification or guidance from the MPS, the strict legal interpretation of Decree 53 would be that all domestic enterprises “providing services on telecommunication networks or the internet or value-added services in cyberspace in Vietnam collecting, exploiting, analyzing, and/or processing personal information data, data on the relationships of service users, or data generated by service users in Vietnam” must store this regulated data in Vietnam. This means that all domestic online service providers which collect, use, analyze, or process regulated data should prepare themselves to comply with this requirement, starting from October 1, 2022.

In addition, if there is no further guidance, domestic enterprises would be well advised to store physically in Vietnam all regulated data they collect, use, analyze, or process. For example, they may store the regulated data in a file which is stored on a computer (their existing system) located in Vietnam, rather than in cloud storage that might be accessible via a computer in Vietnam, but hosted in another country.

Related Professionals

Industries

Technology

Location

RELATED INSIGHTS​ 

May 28, 2025
Thailand’s Food and Drug Administration (FDA) has launched a strategic collaboration with leading e-commerce platforms Lazada and Shopee to strengthen regulatory oversight of health-related products sold online. This partnership is part of a broader initiative to enhance consumer protection, enforce compliance with Thai health regulations, and foster a safer digital marketplace for health products. As part of this initiative, the Thai FDA is urging all sellers—particularly cross-border vendors—to secure proper FDA registration for their products before market entry. The objective is to ensure that only legally authorized, safe, and quality-assured healthcare products are available to Thai consumers. In pursuit of this goal, the FDA has been working closely with Lazada and Shopee to implement proactive surveillance mechanisms aimed at identifying and removing noncompliant, substandard, or unregistered products. This collaboration has already yielded measurable results. Between September 2023 and 2024, Lazada supported regulatory enforcement by removing 9,454 noncompliant listings and delisting 30 vendors. In addition, 134 sellers were subjected to legal proceedings for regulatory violations. Shopee has taken a similarly rigorous stance, committing to the immediate removal of products found to be in breach of FDA regulations. The platform has also provided educational materials for merchants and implemented consumer complaint mechanisms to enhance accountability. Looking ahead, the Thai FDA plans to roll out a data integration system utilizing API technology, enabling seamless and secure exchange of regulatory data between the agency and e-commerce platforms. This system will be supported by comprehensive training for both Thai FDA officials and e-commerce staff, with a particular focus on the use of the Thai government’s Law Enforcement Request Portal, a secure communication channel for coordinating enforcement actions between government agencies and platform operators. Additionally, a joint product inspection framework is currently under development in partnership with Lazada and Shopee. This framework will incorporate strict
Read More
May 26, 2025
On May 21, 2025, the Trade Competition Commission of Thailand (TCCT) published a press release signaling heightened regulation of digital platforms in response to the influx of products from foreign countries being sold in Thailand via e-commerce platforms. In recent years, the rapid expansion of cross-border multi-sided e-commerce platforms has unlocked unprecedented growth, but it has also flooded Thailand’s digital marketplaces with low-cost imports sold by unregulated foreign vendors via these platforms, unfairly undercutting local merchants’ market share and exposing consumers to uneven product quality. According to the press release, the TCCT announced progress on drafting new guidelines on unfair trade practices, monopolistic conduct, and competition restraint by multi-sided e-commerce platforms at a recent meeting of the Management Committee for Addressing Issues of Foreign Goods and Businesses Violating Laws. This regulatory push is part of a broader governmental effort to tackle issues stemming from the foregoing that create uneven playing fields and undermine consumer welfare. The draft guidelines are designed to regulate platform operators and their complex and multidimensional trade relations that cause network effects and distort competition. The forthcoming guidelines, to be issued under the Trade Competition Act B.E. 2560 (2017), will undergo public consultation to ensure platform operators, the public, and other stakeholders will have an opportunity to provide input before they are finalized and enforced. The guidelines are seen as an important priority, with the minister of commerce urging swift implementation of the measures to achieve the government’s objectives. In addition to the legislative advancement, one of the TCCT commissioners has been appointed to advise a subcommittee on preventing nominee arrangements by foreign investors and a subcommittee dedicated to promoting Thai SMEs and eliminating poor-quality imports. The appointee will also support the nationwide task force against illegal foreign products in overseeing proactive field operations and comprehensive
Read More
May 22, 2025
While digital technologies have significantly enhanced communication and information sharing, they have also created new opportunities for misuse, particularly for children, who are especially vulnerable to online abuse and exploitation. These risks are often difficult for parents and guardians to detect or prevent in a timely manner. To address these concerns, Thailand has drafted an amendment to the Criminal Code to introduce new provisions targeting offenses against children committed via online platforms. The objective is to close existing legal gaps and to provide more robust protections for children in the digital environment. The draft amendment focuses primarily on addressing online offenses against children and enhancing legal protections for children. The draft amendment proposed changes regarding the following issues: Jurisdiction and media misuse Expanding Thailand’s jurisdiction to cover sexual and liberty-related offenses committed against children outside the country. Adding offenses for misuse of media, including recording, publishing, or transmitting text, images, or sounds for unlawful or exploitative purposes. Offenses involving child exploitation Adding penalties for persuading, luring, or enticing children to engage in sexual or indecent conduct. Imposing harsher penalties for aggravated cases relating to child exploitation that result in serious harm or death. Adding penalties for sending or forwarding inappropriate sexual content to children with exploitative intent. Adding penalties for using threats involving sexual conduct to pressure or coerce victims. Removing ignorance of a child’s age as a possible defense for certain offenses (e.g., luring children or sending inappropriate content) when the child is under 13 years old. Special protections for vulnerable individuals Imposing harsher penalties for offenses committed against parents, persons under legal guardianship or parental authority, or individuals unable to protect themselves. Adding penalties to offenses such as luring children, sending inappropriate content, and cases involving serious harm or death. Child pornography Increasing liability for possession and
Read More
May 15, 2025
Thailand’s Electronic Transactions Development Agency (ETDA) held an explanatory session on the draft principles and regulatory approaches of the country’s planned artificial intelligence (AI) law on May 2, 2025. This came after a lull of two years following the initial release of draft legislation on AI. In the session, the ETDA explained that the earlier drafts were modeled after the EU’s legal framework for AI, but given the evolving Thai legal and technological landscape, it is now necessary to revisit and refine the drafts to ensure they remain relevant and effective in the local context. To aid in this process, the ETDA will accept public comments on the draft principles of the AI law until June 9, 2025. Based on gap analysis and a comparative study of how different countries have addressed AI issues, the ETDA’s draft AI law principles are structured into five key areas. These are described below. 1. Risk-Based Requirements The draft principles outline a set of approaches that the legislation will take toward mitigating risk: Delegation of powers to enforcement agency or sectoral regulators The primary legislation will not directly specify a list of prohibited risks or high-risk types of AI. Instead, it will empower an enforcement agency or relevant sectoral regulators to determine and issue such lists. This approach allows regulators in each specific industry to assess the necessity of risk classifications within their respective sectors, based on the principle that sectoral regulators are best positioned to understand the specific risks in their domains. These regulators are expected to issue subordinate legislation in alignment with the overall framework. Meanwhile, the central enforcement agency will coordinate oversight across sectors and cover areas not under the jurisdiction of any specific regulator. Duties of high-risk AI providers Providers of AI deemed by the enforcement agency or sectoral
Read More