Guidance on Data Localisation Requirements under Decree 53/2022/ND-CP

On 15 August 2022, the Government enacted the long-awaited Decree 53/2022/ND-CP ("Decree") to guide the Law on Cybersecurity (which was passed back in 2018). The Decree, which came into effect from 1 October 2022, provides greater clarity on the companies that are required to comply with Vietnam's data localisation requirements.

The Law on Cybersecurity required both domestic and overseas companies engaged in certain industries to localise their data. The Decree now clarifies that data localisation will be required for the following companies that collect, exploit, analyse and process the data of its service users (including personal information, data concerning users' relationship and data created by them) ("User Data"):

1. All domestic companies that engage in the provision of services on a telecoms network or the internet, or provision of value-added telecom services in cyberspace are required to localise the User Data.
2. All foreign companies that conduct business activities in a regulated sector are required to localise the User Data on the request of the authorities if their services were used to violate cybersecurity laws, and the relevant state agency has notified the company of such violation and requested for cooperation prevention, investigation and remediation, and the company fails to comply. A regulated sector covers telecoms services, data storage and data sharing services in cyberspace, provision of national or international domain names to service users in Vietnam, e-commerce, online payment, payment intermediary, transport connection services via cyberspace, social networks and social media, online games, and services of providing, managing or operating other information in cyberspace in the form of messaging, voice call, video call, e-mail or online chat. In addition, these foreign companies may also be ordered to establish a branch or representative office in Vietnam.