Decree 53 data localization compliance for foreign companies

If your company processes data from users in Vietnam and you are not based there, Decree 53 has changed how you must handle that data. Since October 2025, this regulation requires certain foreign companies to store personal data of Vietnamese users on servers inside Vietnam, and to notify the government about where that data lives. For a foreign firm without local infrastructure, this means you need a new plan for data storage. This guide walks through what Decree 53 actually demands, which companies it affects, and how to comply in 2026 with a Vietnam-based VPS.

Prerequisites

• A registered business entity, either foreign or with a presence in Vietnam
• An understanding of what personal data your service collects from Vietnamese users
• An account with a Linux VPS provider located in Vietnam, or a dedicated server if your volume is large
• Basic familiarity with SSH, firewall configuration, and database management

Why Decree 53 matters for your business in 2026

Decree 53/2025/ND-CP, effective from October 1, 2025, implements the Cybersecurity Law's data localization provisions. It applies to foreign enterprises that provide services in Vietnam and process personal data, data about cyber security, or data generated by users in Vietnam. The trigger is data volume: if your service handles the personal data of a certain number of Vietnamese users, you fall under its scope. The thresholds are significant enough that only services with a real Vietnamese user base, not small pilots, need to act.

The regulation is not asking you to move your entire global infrastructure. It requires that specific categories of data about Vietnamese users be stored on servers physically located in Vietnam, and that you file a notification with the Ministry of Public Security (A05) about your data storage arrangement. Get this wrong, and you face fines plus a temporary suspension of services in Vietnam. That is why this matters: non-compliance is not a theoretical risk in 2026, it is an active enforcement area.

What data must be stored locally under Decree 53

Not all data falls under the law. Focus on these three categories:

• Personal data: name, phone number, email, ID numbers, location data, and any data that can identify a specific individual in Vietnam
• Data created by service users in Vietnam: content generated while the user interacts with your platform, including messages, uploads, and transaction records
• Data about Vietnamese cyber security: any data related to network security events, vulnerabilities, or incidents involving Vietnamese users

You need a data map before you can comply. Document where each category of Vietnamese user data currently lives, whether in your own servers, a cloud provider, or a third-party processor. If that data is outside Vietnam, you have a compliance gap.

Step 1 - Choose the right Vietnam-based storage infrastructure

The simplest compliance path is to run a database and application instance on a Vietnam VPS with a dedicated IPv4. The physical location of the server is what matters. A rent Linux VPS from a provider with servers in a Viettel IDC or VNPT IDC datacenter satisfies the storage location requirement, as long as the data is written there, not just backed up there.

# Check the public IP and confirm it belongs to a Vietnam range
curl ifconfig.me
# Example output: 14.241.xx.xx (Vietnam IPv4 block)

# Verify geolocation of the IP
curl http://ip-api.com/json/$(curl -s ifconfig.me)

Do not try to satisfy the law with a server in Singapore or Hong Kong that has a Vietnam CDN in front. The CDN caches content, it is not the storage location. Enforcement looks at where the database and primary application data physically reside.

Verify: the JSON output from ip-api.com should show "country":"Vietnam" and "countryCode":"VN".

Step 2 - Set up encrypted storage and controlled access

Storing data in Vietnam is not enough. Decree 53 also expects you to protect that data. On an Ubuntu 24.04 or Debian 12 VPS, the baseline is full-disk encryption and a firewall that only exposes the services you actually need.

# Update the system and install firewall + encryption tools
apt update && apt upgrade -y
apt install nftables cryptsetup openssl -y

# Enable and start nftables
systemctl enable nftables --now

The encryption layer matters because if the datacenter or a rogue actor physically removes a disk, the data is unreadable without the key. For a production setup, consider LUKS encryption on the data partition, not just the root filesystem. Many VPS providers, including thueVPS, offer KVM-based virtualization where you control the full boot process, which makes LUKS feasible.

# Create a LUKS-encrypted volume for application data
cryptsetup luksFormat /dev/vdb
cryptsetup open /dev/vdb datavolume
mkfs.ext4 /dev/mapper/datavolume
mount /dev/mapper/datavolume /var/lib/postgresql

Verify: run lsblk -f and confirm the data volume shows crypto_LUKS as its filesystem type before the mapper device.

Step 3 - Configure a database and application on the local VPS

Your Vietnamese user data needs a home inside Vietnam. PostgreSQL is a solid choice for transactional workloads that need strict consistency, which is typical for user accounts and orders. Install and configure it to listen on the private interface only, never directly on the public IP.

# Install PostgreSQL on Debian 12 or Ubuntu 24.04
apt install postgresql -y

# Edit the configuration to bind to localhost or private network
nano /etc/postgresql/15/main/postgresql.conf
# Set: listen_addresses = '127.0.0.1'

Your application, whether it is a Node.js API, a Laravel backend, or a WordPress site, connects to this database over the localhost interface. The application itself can stay on the same VPS or on a separate server, but the database holding Vietnamese user data must be the one in Vietnam.

# Create a dedicated database user with a strong password
sudo -u postgres psql
CREATE USER app_user WITH PASSWORD 'strong_password_here';
CREATE DATABASE vietnam_users OWNER app_user;
\q

For failover, take regular snapshots. A VPS with snapshots and backups gives you a restore path if the instance fails or if you need to prove data residency during an audit. Schedule a daily snapshot, and test a restore at least once a quarter.

Verify: from the application server, run psql -h 127.0.0.1 -U app_user -d vietnam_users -c "SELECT 1;" and confirm it returns 1.

Step 4 - File the data storage notification with A05

Decree 53 sets a 30-day window: once your data hits the threshold, you must notify the Ministry of Public Security (A05) of your data storage location and the contact person responsible. The notification is a formal document, in Vietnamese, detailing what data you store, where the servers are, and who manages them.

Do not let this step slide. Companies have reported that the process itself is straightforward once the infrastructure is in place, but the paperwork takes time the first time you do it. If you have no legal counsel in Vietnam, hire a local firm for this step. The cost is small compared to the fine for missing the window, which starts at a significant penalty and escalates for repeat violations.

Step 5 - Document your compliance and review it quarterly

Compliance is a living process. Users change, data volumes grow, and your infrastructure may need to scale. Keep a written record that answers three questions at any moment: where is the data, who can access it, and what happens if the server fails.

# Document your current data residency with a simple inventory script
#!/bin/bash
echo "Data residency check - $(date)"
echo "Primary database: $(hostname) - $(curl -s ifconfig.me)"
echo "Backup location: /backup/vietnam_users (snapshot policy: daily)"

Schedule a quarterly review with your engineering team. Confirm the server is still in Vietnam, the encryption keys are rotated, and the A05 contact is still current. If you migrate to a different provider or a different datacenter, re-file the notification before you move data, not after.

Common compliance mistakes to avoid

Three errors show up repeatedly when foreign companies try to comply with Vietnam Decree 53 data localization rules for SaaS providers. The first is thinking a backup in Vietnam satisfies the law. It does not. The primary copy of the data must be in Vietnam, not a replica.

The second mistake is using a consumer VPN or proxy in Vietnam as the storage location. A VPN endpoint is not a server you control, and the data does not persist there in a way you can audit. You need a real VPS or dedicated server you manage.

The third is ignoring the notification requirement entirely and hoping the volume stays under the radar. Enforcement in 2026 is active. The law also requires you to respond to written requests from A05 within a defined period. If you have not prepared a response workflow, review what happens after A05 issues a written storage request.

Decree 53 and foreign companies FAQ

Related articles

• What happens after A05 issues a written storage request
• Does Decree 53 require my company to host data in Vietnam
• Vietnam Decree 53 data localization rules for SaaS
• How to rent a VPS in Vietnam as a foreign company

For a foreign company, the practical path is straightforward: identify the data, provision a server inside Vietnam, secure it, and file the notification. A rent Linux VPS with a Vietnam IPv4 is the fastest way to meet the storage requirement, and the earlier you start, the easier the compliance review becomes.