Data localization in Vietnam is narrower than its reputation, but it bites hardest on the companies that least expect it. There is no general rule that personal data must stay in Vietnam: the Personal Data Protection Law No. 91/2025/QH15 lets data leave the country once a transfer dossier is in place. The storage obligation comes from cybersecurity law, and it applies only to businesses that provide telecoms, internet or other online services to users in Vietnam.
Within that group the rule splits in two. An enterprise established in Vietnam that provides such services must store its users' data in Vietnam, with no trigger and no waiting period (Article 19(2) of Decree 333/2026/ND-CP). A foreign provider serving Vietnam from abroad has to store data locally and open a branch or representative office only after a decision of the Minister of Public Security, which follows repeated unanswered requests (Article 19(3) and (6)). So a foreign group that sets up a Vietnamese subsidiary to run its app or marketplace takes on a stricter rule than the same service run offshore. This guide reflects the texts in force on 13 October 2026.
Where data localization in Vietnam comes from in 2026#
The framework changed on 1 July 2026, when the Law on Cybersecurity No. 116/2025/QH15 took effect and replaced both the 2018 Law on Cybersecurity No. 24/2018/QH14 and the 2015 Law on Network Information Security (Article 44(1) and (2)). Guides that still cite Article 26 of the 2018 law and Decree 53/2022/ND-CP describe the old regime.
| Layer | Instrument | What it does |
|---|---|---|
| The storage duty | Law 116/2025, Article 25(3) | Domestic and foreign enterprises providing telecoms, internet or value-added online services in Vietnam must store certain user data in Vietnam; foreign ones must also have a branch or representative office |
| The detail | Decree 333/2026/ND-CP, Articles 19 and 20 (in force 19 August 2026) | Which data, which foreign sectors, the trigger, the 12-month deadline, the 24-month storage period |
| Fines | Decree 330/2026/ND-CP, Article 33 | Fines and remedial measures for not storing data or not opening a local office |
| Cross-border transfer | Law 91/2025, Article 20 | Personal data may leave Vietnam with a transfer impact assessment dossier; no storage duty |
| Core and important data | Law on Data No. 60/2024/QH15 and Decree 165/2025/ND-CP | A separate regime for data classified as core or important |
What happened to Decree 53/2022? Decree 333 does not repeal it in terms. Article 30 sets the effective date, and Article 31 lets applications already filed under Decree 53 finish under it. Decree 53 implemented a law that expired on 1 July 2026, and Decree 333 now regulates the same subject, so in our reading Decree 53 no longer governs new situations. Two differences matter in practice: Decree 333 no longer lists "data on users' relationships" as a separate category, and it sets the trigger for foreign providers out in more detail.
Is your company in scope for data localization in Vietnam?#
Article 25(3) of Law 116 applies to enterprises that provide services "on telecoms networks, the Internet and value-added services in cyberspace in Vietnam" and that collect, exploit, analyse or process users' personal information, data on users' relationships or data users create in Vietnam. The test is the service you provide, not whether you hold personal data. Working through three questions sorts most groups.
1. Do you provide an online service to users in Vietnam? For foreign providers, Article 19(3)(a) of Decree 333 lists the sectors: telecoms; storing and sharing data in cyberspace; domain names for users in Vietnam; e-commerce; online payment; payment intermediary services; transport connection services through cyberspace; social networks and social media; online games; online applications; and messaging, voice calls, video calls and livestreaming. A consumer app, a marketplace, a SaaS platform, a payment wallet or a ride-hailing service is plainly inside.
2. If so, which entity provides it? If the Vietnamese company is the service provider, it is a domestic enterprise and Article 19(2) applies directly. In our reading this includes a foreign-owned subsidiary: it is established under Vietnamese law, and nothing in Decree 333 treats foreign ownership as making it a "foreign enterprise". If the service is contracted and operated by a company abroad, the foreign-provider route in Article 19(3) applies instead.
3. Or do you only use online services for your own business? A factory, trading company or professional firm that runs HR, CRM and email on cloud platforms is a user of online services, not a provider of them. In our reading it is outside Article 25(3), even though it processes a great deal of personal data. Its cross-border question is the PDPL transfer dossier, covered in foreign SaaS in Vietnam. The texts do not draw this line expressly, and a company website that sells products online sits closer to the e-commerce category, so check that case on its facts.
| Situation | Storage in Vietnam required? | Basis |
|---|---|---|
| Vietnamese subsidiary runs an e-commerce site or app for Vietnamese users | Yes, from the start | Decree 333, Article 19(2) |
| Foreign parent operates the same service from Singapore for Vietnamese users | Only after a Minister's decision | Decree 333, Article 19(3) and (6) |
| Vietnamese manufacturer keeps HR data on a group HRIS in Japan | No storage duty; transfer dossier under the PDPL | Law 91, Article 20 |
| Foreign SaaS vendor hosts a Vietnamese customer's data abroad | Vendor: only after a decision. Customer: transfer dossier | Decree 333, Article 19(3); Law 91, Article 20 |
Data localization in Vietnam for domestic companies, including foreign-owned subsidiaries#
Article 19(2) of Decree 333 is one sentence, and it has no trigger: domestic enterprises store the data in Article 19(1) in Vietnam. There is no request, no decision and no transition period beyond the decree's effective date of 19 August 2026.
Which data. Article 19(1) covers:
- personal information of service users in Vietnam;
- data created by service users in Vietnam: account name, time of use, credit card information, email address, the IP address of the most recent login and logout, and the registered phone number linked to the account or data.
How. The enterprise chooses the form of storage, provided the data can be retrieved promptly when a competent authority asks (Article 19(5)). Decree 333 does not require any particular data centre, certification or provider, and it does not require the only copy to be in Vietnam.
How long. Data is stored for at least 24 months (Article 20(1)). System logs, which Article 25(2)(b) of the Law requires service providers to keep, must be kept for at least 12 months (Article 20(3)). Separately, Article 25(2)(a) of the Law requires providers to give user information to the Ministry of Public Security within 24 hours of a request, or 3 hours in an emergency. A copy held in Vietnam is what makes that deadline realistic.
For a foreign group, the practical consequence is architectural. If the Vietnamese subsidiary is the contracting provider of a consumer or business service, the platform needs a Vietnam data store for the Article 19(1) data from launch, with a retrieval process the local team can run without waiting for headquarters. Deciding which entity contracts with Vietnamese users is therefore a data localization decision as much as a tax or licensing one.
Foreign providers serving Vietnam from abroad: the request-and-decision route#
A foreign enterprise in the Article 19(3)(a) sectors does not have to store data in Vietnam or open an office merely because it has Vietnamese users. For it, data localization in Vietnam is a sanction for non-cooperation, not a default. The duty to do both arises only when:
- its service is used to commit violations of Vietnamese law, the cybersecurity force of the Ministry of Public Security has notified it and requested cooperation in writing three times over a period of up to 6 months, and the violation has not been remedied; or
- it fails to comply, complies only partly, or obstructs or refuses the cybersecurity force's requests.
The Minister of Public Security then issues a decision (Article 19(6)(a)), and the enterprise has 12 months from the decision to store the data and establish a branch or representative office that takes legal responsibility (Article 19(6)(c)). If force majeure prevents compliance, the enterprise must notify the Ministry within 3 working days and has 25 working days to find a solution (Article 19(3)(b)). Once opened, the local office must be maintained until the enterprise stops operating in Vietnam or the service ends (Article 20(2)).
In practice, this route is driven by content and cooperation, not by data volumes. A foreign platform that answers takedown and information requests promptly is unlikely ever to receive a decision. One that ignores them can be required to localize within a year, so platforms with large Vietnamese user bases usually design a Vietnam data region they can switch on in less than 12 months.
Does storing data in Vietnam stop it leaving Vietnam?#
No. Decree 333 requires companies in scope to store data in Vietnam; it does not prohibit sending copies abroad, and the Law 116 storage article says nothing about transfers. Whether data may leave the country is governed by the PDPL.
Under Article 20 of Law 91, transferring personal data abroad, storing it on a system outside Vietnam or using a platform abroad to process it is lawful once the transferring party has prepared a cross-border transfer impact assessment dossier and filed it with the A05 Department within 60 days of the first transfer (Article 20(1) and (2)). So a Vietnamese e-commerce subsidiary that keeps its user database in a Vietnam region and replicates it to a group analytics platform in Singapore has two separate duties: the onshore copy under Decree 333 and the transfer dossier under the PDPL. See the cross-border data transfer impact assessment in Vietnam for the dossier and cross-border data transfer for the concept.
The two regimes are enforced by different units of the Ministry of Public Security and fined under different sections of Decree 330, so compliance with one is no defence under the other.
Core and important data under the Law on Data#
The Law on Data No. 60/2024/QH15 and its Decree 165/2025/ND-CP (in force 1 July 2025) add a separate regime for data classified as "core" or "important", which is subject to assessment or approval before it is transferred abroad. Decree 356 has drawn a boundary with the PDPL: where core or important data is personal data, it is protected under the personal data protection law (Article 42(3) of Decree 356, amending Article 16(2) of Decree 165).
The list in Decision 20/2025/QD-TTg is mostly about non-public state data, but two items turn on volume and are not limited to state bodies. Non-public basic data of 100,000 or more Vietnamese citizens, sensitive data of 10,000 or more citizens, and bank account, payment history and debt data of 10,000 or more Vietnamese businesses and organisations are important data (item II.18); the core data thresholds are ten times higher (item I.26). The Decision does not say who the holder must be, so in our reading a private company with a large enough customer dataset can fall within it. The thresholds, duties and the fines under Decree 363/2026/ND-CP (in force from 11 November 2026) are covered in the Vietnam data law.
Fines for breaching data localization in Vietnam#
Article 33 of Decree 330 sets the fines for breaching the cybersecurity storage rules:
| Breach | Fine for an organisation | Basis |
|---|---|---|
| Not storing data as required | VND 60–100 million | Article 33(1)(a); Article 7(1) |
| Not complying with a decision to store data or open a branch or representative office | VND 60–100 million | Article 33(1)(b); Article 7(1) |
| Not keeping system logs as required by Article 25(2)(b) of the Law | VND 60–100 million | Article 33(1)(c); Article 7(1) |
The amounts in the cybersecurity sections of Decree 330 are stated for individuals, VND 30–50 million here, and doubled for organisations (Article 7(1)); the maximum cybersecurity fine for an organisation is VND 200 million (Article 7(3)). The remedial measures matter more than the fine: an order to store the data or open the branch or office, and an order to suspend telecoms or internet services or connections in Vietnam (Article 33(3)). Foreign individuals who commit these breaches can be expelled (Article 33(2)).
One wording mismatch to note: Article 33(1)(a) refers to not storing data, or not fully storing "data sensitive to national security", under the decree detailing the 2025 Cybersecurity Law, but Decree 333 does not use that term. In our reading the fine applies to the Article 19 storage duty; until the authorities clarify, treat any gap in the Article 19(1) data set as within Article 33(1)(a).
For businesses that are in scope, LexData maps which entity provides the service, which data falls under Article 19(1) and how the onshore store fits with the PDPL transfer dossier, through its PDPL compliance consulting service. For the transfer side, see the DPIA and cross-border transfer dossier service. Industry-specific notes for software vendors are in data protection in SaaS in Vietnam.
