A Compliance Checklist for Foreign E-commerce Platforms Serving Vietnam

You run an e-commerce platform, maybe a Shopify-like store, a marketplace, or a membership site, and you have users in Vietnam. Orders come in, customer data flows through your systems, and everything works. The question is: does Vietnam’s law consider that you are serving the Vietnamese market? And if so, what do you need to change?

面向越南的跨境电商平台已被明确列入存储要求范围。

Cross-border e-commerce platforms serving Vietnam are explicitly in scope for the storage requirement.

Vietnam has tightened its data protection and e-commerce rules over the last few years. Decree 53/2022/ND-CP (amended by Decree 85) and Decree 13/2023/ND-CP on personal data protection create real obligations for foreign platforms that interact with Vietnamese users. Ignoring them can mean blocked access, fines, or worse, losing the ability to process payments in Vietnam.

This checklist walks you through the core compliance requirements and shows you where vietnam ecommerce compliance hosting, hosting your infrastructure inside Vietnam, becomes the practical solution.

• Key takeaway: If your platform stores, processes, or transmits data of Vietnamese users, you almost certainly need a local server inside Vietnam. A foreign cloud provider with a Vietnam edge node does not count as local hosting.
• Key takeaway: Decree 53 requires foreign e-commerce platforms to register with the Ministry of Industry and Trade (MOIT) and maintain a local representative or hosting entity.
• Key takeaway: Personal data of Vietnamese users must be stored in Vietnam under Decree 13, cross-border transfers are allowed only under strict consent and notification procedures.
• Key takeaway: A Vietnam VPS with a dedicated IPv4 and full root access lets you run the required infrastructure without setting up a local subsidiary.

Who This Applies To

You are in scope if your platform enables Vietnamese consumers to buy goods or services, regardless of where your company is registered. Vietnam does not distinguish between a local entity and a foreign-incorporated business when it comes to user protection. The trigger is: Vietnamese users can access your site, place orders, and provide personal data.

Concrete examples:

• A cross-border fashion marketplace based in Singapore with Vietnamese customers.
• A SaaS subscription platform with a billing page in Vietnamese dong (VND).
• A dropshipping store using a .com domain serving mostly Vietnamese traffic.
• A digital goods platform (courses, software, ebooks) sold to Vietnamese users.

If any of these describe you, the checklist below is relevant.

Step 1, Register with the Ministry of Industry and Trade (MOIT)

Under Decree 53, foreign e-commerce platforms that allow Vietnamese users to conclude contracts must notify the Ministry of Industry and Trade (MOIT) of their operations. This is not optional, it is a registration requirement similar to having a business license.

What you need to prepare:

• Company registration documents (translated and notarized).
• A description of the platform, product categories, and target market.
• Contact information for the platform's legal representative (which can be a local service provider, not necessarily an employee).
• Proof of a local infrastructure arrangement, this is where having a server in Vietnam matters.

The registration must be submitted online via the MOIT's national e-commerce portal. Processing time is typically 15, 30 working days. Do not launch a public-facing platform for Vietnamese users before this registration is accepted.

Verify: After submission, you receive a registration number. Check it on the MOIT portal to confirm your status.

Step 2, Store Personal Data on Vietnamese Soil

Decree 13 on Personal Data Protection (PDPD) took effect on 1 July 2023. It requires that personal data of Vietnamese data subjects be stored in Vietnam. You can transfer data abroad only if:

• The data subject gives explicit consent for the specific transfer purpose.
• You notify the Ministry of Public Security (MPS) of the transfer within 30 days of the transfer.
• You maintain a copy of the data inside Vietnam anyway.

This means a foreign cloud (AWS Singapore, GCP US, Azure Europe) by itself is insufficient, you need at least one server physically located in Vietnam that holds the data. The data covered includes names, phone numbers, email addresses, IP addresses, payment details, order history, and any behavioral data (cookies, tracking IDs, device fingerprints).

The practical answer is to run your database and application logic on a Vietnam-based VPS while keeping a synchronized copy abroad if needed for your global operations. Many foreign platforms use this hybrid model.

Verify: Confirm your database server resolves to a Vietnam IP range. Use whois to check the country assignment. The IP must be allocated to a Vietnamese ISP (Viettel, VNPT, FPT, or a smaller provider).

Step 3, Appoint a Local Representative (or Use a Hosting Provider)

Decree 53 says a foreign platform must have a "contact point" in Vietnam, either a local branch, a representative office, or an authorized person. You do not need to incorporate a full subsidiary. Many platforms contract with a local law firm or a hosting provider that acts as their designated contact for regulatory correspondence.

If you rent a Vietnam VPS from a local provider, that provider can often serve as the physical contact for legal notices. The key requirement is that the contact can be reached during Vietnamese business hours and can relay information to your HQ.

What to prepare:

• A letter of authorization appointing the local contact (lawyer, hosting provider, or local employee).
• A physical address in Vietnam (the VPS datacenter address counts if the provider agrees to this role).
• A Vietnamese phone number reachable from the MOIT's office.

Verify: Your appointment should be filed with the MOIT alongside your registration. Keep a copy of the filed form.

Step 4, Use a Vietnamese Payment Gateway

While not strictly a hosting requirement, payments are the operational side of compliance. Your platform must offer at least one payment method that works for Vietnamese consumers without requiring international transaction fees. Common options:

• Bank transfer via local banks (Vietcombank, Techcombank, BIDV, VietinBank).
• VNPay or Momo (local e-wallet with online payment API).
• Credit cards processed through a local acquirer (e.g., OnePAY, Payoo).

If you use a foreign payment gateway (Stripe, PayPal), you are allowed to do so, but the transaction data still falls under Decree 13's storage requirements. The order record, the customer's name, and the amount must live on a Vietnam server.

Verify: Ensure your order database writes to the local server first, then replicates to your global data store. A synchronous write to Vietnam followed by async replication abroad is the typical architecture.

Step 5, Implement Data Subject Rights Processes

Decree 13 gives Vietnamese users extensive rights over their personal data: the right to know, right to consent, right to access, right to withdraw consent, right to delete, and right to restrict processing. Your platform must have a mechanism for users to exercise these rights.

Technically, this means:

• A privacy policy written in Vietnamese (clear, everyday language, not just legal boilerplate).
• A web form or email address where users can submit data requests.
• A backend process to locate, modify, or delete the user's data from all your Vietnam-hosted databases and logs.
• A response within 72 hours under the law (though 30 days is the softer deadline for complex requests).

Run this from your vietnam ecommerce compliance hosting server, the data processing happens locally, and you respond directly from the local system. If your support team is overseas, they can access the local server through a secure VPN or SSH tunnel.

Verify: Test the data deletion workflow. Submit a test request for a dummy account, confirm the data is gone from the local database, and measure your response time.

What a Vietnam VPS Actually Gives You, the Network Picture

This is where the infrastructure question meets the legal one. You cannot serve Vietnamese users from a server in Singapore, Hong Kong, or the US, not for compliance, and also not for reliable domestic connections.

A Vietnam VPS from a local provider (like thueVPS) means:

• Your server sits inside a Vietnamese datacenter (Viettel IDC or VNPT IDC, both Tier 3).
• It has a dedicated IPv4 from the Vietnam IP range, whois will show "VN".
• Its traffic reaches Vietnamese users over domestic backbone lines (Viettel, VNPT, FPT's own fiber), not international transit.
• You get full root (Linux) or Administrator (Windows) access, you can install any stack, any security tool, any monitoring agent.
• Domestic bandwidth is 100 Mbps on a 1 Gbps port, with unlimited traffic and no data cap. No data caps, no overage fees.
• NVMe storage, snapshots, backups, and a 99.9% uptime SLA.

The key performance point: if your users are inside Vietnam, a server inside Vietnam is faster and more reliable. If a user in Vietnam hits a server in Singapore, the packet goes through international cables and can drop or spike in latency. A local server eliminates that variable.

Note: this is not a "fast pipe to everywhere" solution. If your users are in Europe, a Vietnam server will not be fast for them, your origin should stay global. The Vietnam server exists because your data must be here for legal reasons, and because your Vietnamese users need local performance. The two goals align.

Pricing Context

A compliance-capable VPS setup does not need a large machine. For most e-commerce platforms, a 2 GB RAM / 1 vCPU / 20 GB NVMe plan handles the database and application logic for the Vietnam side, with a second server for the web frontend if needed. Monthly billing starts from about $8, $10 per server. The cost of the infrastructure is trivial compared to the cost of non-compliance (fines, blocked access, or losing payment processing).

FAQ

Related articles

• Does Decree 53 Require My Company to Host Data in Vietnam?
• Vietnam VPS vs Singapore VPS for Serving Vietnamese Users
• Why a Vietnam IPv4 Matters When Your Users Are in Vietnam

Disclaimer: This article provides general information about Vietnam's regulatory environment for e-commerce platforms and is not legal advice. Regulations, interpretations, and enforcement practices may change. You should consult a Vietnamese-licensed attorney for advice specific to your platform, business structure, and data processing activities.