Decree 53 data localization for foreign businesses in Vietnam

If your company stores personal data of Vietnamese users, Decree 53/2022/ND-CP is not an abstract legal footnote. It is the operative rule that decides where that data physically lives, and it carries fines that start far below what non-compliance costs your reputation. The confusion for foreign businesses is rarely the law itself, it is mapping it onto a real hosting setup. This guide walks through which data must stay in Vietnam, which companies the rules actually bind, and how to build a compliant architecture without overpaying.

Prerequisites

• A working understanding of your data flows: where user data enters, processes and lands.
• Access to your current cloud or Linux VPS provider to check region settings.
• Legal counsel familiar with Vietnamese data protection, this guide is technical, not legal advice.

第53号法令要求特定数据存储在越南境内，外国企业需提前规划本地服务器与合规架构。

Decree 53 requires specified data to be stored inside Vietnam, so foreign firms need to plan local servers and a compliant architecture early.

What Decree 53 actually regulates

Decree 53/2022/ND-CP implements the Cybersecurity Law, and it is the text that turns a vague "localize data" slogan into enforceable rules. The decree distinguishes between two groups: telecom and internet service providers that operate in Vietnam, and foreign enterprises whose services touch the Vietnamese market. For the second group, the trigger is not a Vietnamese office. It is whether your service is used inside Vietnam and collects certain categories of personal data.

The data that falls under localization includes personal data of Vietnamese users: names, phone numbers, account credentials, financial information, location data, and data about social relationships. It also covers data your users generate while using your service: their messages, purchases, browsing behavior. If your platform processes this data at scale, the rules apply to you regardless of where your company is incorporated.

The law has a coordination mechanism. Vietnam's Ministry of Public Security (A05) issues a written request to a foreign company, and the company has 12 months to set up local storage and a representative office in Vietnam. Failing to comply brings fines up to 5% of total Vietnamese revenue, capped at VND 200 million, but that cap undersells the real cost, which is service disruption. The state can block your service, and a block in Vietnam is hard to reverse quickly.

Does Decree 53 apply to your business?

This is the question where most foreign firms go wrong, in both directions. Some assume the law targets only large platforms like Meta or Google. Others assume every company that has a Vietnamese user must rush to buy local servers. The actual test sits in the middle.

The decree binds you if your service is accessed from Vietnam and you process data covered by the personal data categories above. There is no minimum user threshold published in the decree itself, and the practical reading from Vietnamese authorities is that a service with a meaningful Vietnamese user base falls in scope. A developer tool with two users in Ho Chi Minh City does not. A SaaS platform with 50,000 Vietnamese accounts almost certainly does.

Time matters as much as scope. The 12-month window starts when A05 issues its written storage request, not when you first collect data. That request is the real enforcement trigger, and it has been issued to foreign companies since the decree took effect. You gain nothing by ignoring it. Proactive preparation, local storage capacity, a local point of contact, a data map, turns a potential crisis into a paperwork exercise.

Which data must stay inside Vietnam

Not every byte your business touches needs a home in Hanoi. Decree 53 targets personal data of Vietnamese users and data about their relationships and activities. Understanding this boundary is what stops you from over-engineering a global platform into a Vietnam-only deployment.

The covered categories are your Vietnamese users' personal data: identifiers, contact details, account credentials, financial information, and location. Data your users create while on your platform, messages, transactions, behavioral logs, also falls in scope. What does not fall in scope is your internal corporate data, your code repositories, your employee records outside Vietnam, and aggregated data stripped of personal identifiers.

This boundary has a practical consequence. You do not need to run your entire stack inside one Vietnamese datacenter. You need a data plane that keeps Vietnamese personal data within Vietnam's borders, and a control plane that can stay where it is efficient. A common architecture keeps the application logic in your global cloud but routes Vietnamese user data into a VPS with a dedicated IPv4 located in Vietnam. The law cares about where the data rests, not where every line of code executes.

How to store and process data in Vietnam: practical options

Data localization sounds like a demand to build a local data center. In practice, the compliant path is far lighter. You need storage and processing capacity with a physical footprint in Vietnam, which is exactly what a local VPS or dedicated server provides.

A rent Linux VPS from a Vietnamese provider gives you a working data residence without a local entity or a datacenter lease. The key is the physicality of the choice: the server sits in a Vietnamese Tier 3 datacenter such as Viettel IDC or VNPT IDC, your data never leaves the country, and you hold full root access to run your own encryption, backup and access policies. For a foreign company that needs a fast, low-commitment start, a monthly billing VPS keeps the setup flexible while the legal picture settles.

For heavier workloads, a dedicated server gives you the same data residence with more headroom. The operational model is identical to running any remote server: provision, harden SSH, deploy your database, point your Vietnamese user traffic at it. The difference is that a meaningful class of Decree 53 compliance, keeping personal data local, is met by the server's physical location alone.

# Example: check where your data actually resides (run on each server)
curl -s https://ipinfo.io/json | grep -E '"country"|"region"|"city"'
# Expected output for a compliant Vietnam VPS:
#   "country": "VN"
#   "region": "Ho Chi Minh City"

Run that check on every database host that touches Vietnamese personal data. Teams are regularly surprised that their "Asia" region is Singapore, not Vietnam, and that gap matters under the decree.

Recommended compliance architecture under Decree 53

The setups that work combine three layers: a local data plane, a synchronization path, and an access control policy.

1. Local data plane: a Vietnam VPS or dedicated server running your database (PostgreSQL, MySQL, or Redis for sessions) that stores all Vietnamese personal data.
2. Synchronization: encrypted replication between your global application and the Vietnam data plane, with regional read routing so Vietnamese users always hit the local replica.
3. Access control: role-based access with audit logging on the local server, so you can demonstrate who touched what, when.

Your global application tier keeps serving static assets and non-personal logic. The Vietnamese data plane handles the regulated load. This split is worth building now, because the cost of retrofitting data separation after an A05 request is an order of magnitude higher than designing it in from the start.

Encryption is not optional decoration here. Local Vietnamese regulation and your own security posture both demand encrypted storage and encrypted transit. Use TLS for all connections between your global tier and the Vietnam server, and enable disk-level encryption on the VPS itself so a physical access incident does not become a data breach notification.

Consequences of non-compliance and common mistakes

The fine structure is real but modest in absolute terms, up to 5% of Vietnamese revenue capped at VND 200 million (around USD 8,000). The sharper teeth are operational. Authorities can require your service to be blocked in Vietnam, and for a company whose growth depends on Vietnamese users, that is the outcome to fear.

Three mistakes recur across foreign teams:

• Treating Singapore or Hong Kong as "close enough". It is not. The decree names Vietnam, and a regional cloud that routes through Singapore fails the physical location test.
• Storing data locally but processing it abroad. The decree covers processing, not just storage. If you synchronize Vietnamese personal data to a US or EU server for analytics, you have moved regulated data across the border.
• Assuming a Vietnamese subsidiary is required. The 12-month window requires a representative office or subsidiary, but you can start storing data locally before that corporate work finishes. Legal registration and technical compliance run on separate tracks.

Document your data map. Knowing exactly which database holds which class of data, and being able to show that map to an authority, transforms an audit from a scramble into a demonstration of control.

FAQ

Related articles

• Vietnam Decree 53 data localization rules for SaaS
• What happens after A05 issues a written storage request
• Does Decree 53 require my company to host data in Vietnam
• How to rent a VPS in Vietnam as a foreign company