Operations

Do I need a branch office in Vietnam or is a rented server enough?

BM BizMaC Team Feb 18, 2026 11 min read

If your company handles personal data of Vietnamese users, you have likely encountered the branch office Vietnam data requirement, the rule that certain foreign companies must either establish a presence or store data locally. The question sounds simple: "Do I need a branch office in Vietnam, or is a rented server enough?" The answer, however, depends on the type of data, the volume of users, and the specific legal trigger you are facing.

了解越南数据本地化要求：租用服务器满足特定场景，正式代表处应对全面合规。

Understanding Vietnam's data localization requirements: a leased server covers specific scenarios, but a formal representative office handles full compliance.

This article breaks down the real obligations under Vietnam's Decree 53 (formerly Decree 72) and the newer Personal Data Protection Decree, explains what a written storage order from a regulator actually means, and maps each scenario to the right setup, whether that is a simple VPS or a formal branch office.

The core of the branch office Vietnam data requirement

Two separate legal frameworks govern this question. The first is Decree 53/2022/ND-CP, which amended Decree 72 on telecommunications and requires certain online service providers (social networks, search engines, online advertising, online gaming, and e-commerce platforms) with a certain user threshold in Vietnam to store data domestically and establish a representative office or branch. The second is the Personal Data Protection Decree (PDPD / Decree 13/2023/ND-CP), which applies to any organization processing personal data of Vietnamese subjects, regardless of sector.

Under the PDPD, the branch office Vietnam data requirement takes a different form: the regulator can issue a written request for data storage. This request can demand that a copy of the personal data be stored on Vietnamese soil, but it does not automatically force you to open a branch. A leased server, a Vietnam VPS with a dedicated IPv4, meeting the technical requirements (a server physically inside Vietnam, properly secured, and accessible for inspection) can satisfy this specific request.

However, the Decree 53 requirement does mandate a physical presence, a branch or representative office, for services that cross the user threshold (currently set at one million users per month for social networks, search engines, and certain other categories). A server alone will not satisfy this.

So, when is a VPS enough?

A rented server, specifically, a Vietnam-hosted VPS, is sufficient in these clear scenarios:

  • You received a written storage order under the PDPD, not a general compliance query, but a specific request from the Department of Cybersecurity and High-Tech Crime Prevention (A05) or another authorized body. In this case, leasing a VPS from a Vietnamese provider and storing the relevant data there, with proper access controls and logging, meets the order. You do not need to incorporate a branch.
  • Your service does not cross the Decree 53 user threshold, you operate an online game with 500,000 active users, or an e-commerce platform with 800,000 monthly visitors. You are not legally required to open a branch. You may still receive a data-storage request under the PDPD, in which case the VPS answer above applies.
  • You are storing data proactively, not because of an order, many companies place customer data on a Vietnam server for latency, local partner access, or business continuity without any legal compulsion. A VPS is the right tool here.

In these cases, the branch office Vietnam data requirement is deferred. Your obligation is to keep the data accessible, protect it under Vietnam's data protection standards, and respond to any future inspection. A properly configured server, with encrypted storage, firewall rules, and access logging, is a defensible arrangement.

The role of a written data storage request

The PDPD allows the regulator to issue a written request for data storage. This is the primary trigger for the foreign company without a local entity. The request typically specifies which data must be stored in Vietnam, the time limit, and the retention period. It can cover both storage and establishing a branch or representative office, the law does not restrict the request to one or the other.

This is the point where many advisors get it wrong. They assume a written storage order always means "you need a branch." It does not. The regulator can issue a targeted storage order, "Store the personal data of your 50,000 users on a Vietnam-hosted server within 30 days", without demanding a legal entity. Conversely, for a large platform, the order may include "Establish a representative office within 90 days."

If you are not yet subject to Decree 53's branch requirement, the safest preparation is to have a VPS ready, lease one from a reputable Vietnam provider, configure it with security hardening, and document the setup. If a written order arrives, you respond within the deadline. The VPS itself is not the compliance answer, but it is the fastest path to satisfying the immediate storage demand.

When you absolutely need a branch

There are situations where a server alone is insufficient. You need a legal entity, a branch or representative office, when:

  • Your service crosses the Decree 53 user threshold, 1 million users per month triggers the obligation. The law says "store data in Vietnam and establish a representative office." A VPS on its own will not meet the second part.
  • A written order explicitly requires it, the regulator may decide that your data volume or the nature of your service warrants a local representative. This is most common for large social networks, messaging apps, and content platforms.
  • You need a legal presence for other reasons, signing contracts with Vietnamese partners, invoicing in VND, or hiring local staff. A branch office serves a broader business function, not just a compliance one.

If you fall into any of these, do not look for a server workaround. Engage a law firm in Vietnam, set up a branch or representative office (the process takes 1-3 months), and host your server within that entity's umbrella. The branch office Vietnam data requirement is not optional here.

Technical setup: choosing the right server

If you decide a VPS is sufficient, what should you look for? The server must be physically inside Vietnam, a cloud VM on a foreign infrastructure provider located in Singapore or Hong Kong does not count. You need a Vietnamese provider, or a global provider with a Vietnam point-of-presence.

Criterion Requirement
Physical location Vietnam datacenter (Viettel IDC, VNPT IDC)
IPv4 address Dedicated, from the Vietnam range
Storage NVMe SSD, recommended for database workloads
Operating system Linux (Ubuntu 24.04, Debian 12) or Windows Server
Network Unmetered domestic traffic at 100 Mbps, shared international pool (~4-10 Mbps)
Virtualization KVM for full root/Administrator access
Backups Snapshots for recovery

A typical starting plan for data storage compliance is the VNLite tier: 1 vCPU, 2 GB RAM, 20 GB NVMe, sufficient for a data repository and a lightweight application server. You will configure it with encryption at rest (LUKS for Linux or BitLocker for Windows), a firewall (nftables or Windows Firewall), and robust logging (auditd or Windows Event Log forwarded to a SIEM). If you write the compliance documentation, showing the server location, access controls, data encryption, and the data custodian's contact, a regulator is unlikely to demand more.

For companies expecting larger data volumes or higher traffic, the VNx4 plan (4 vCPU, 8 GB RAM, 60 GB NVMe) or VNx8 plan (8 vCPU, 16 GB RAM, 100 GB NVMe) provides more headroom. If you require colocation, the standard offering includes 100 Mbps commit on a 1 Gbps port with 400W per 1U, ideal for dedicated hardware running in a Vietnam Tier 3 datacenter.

Colocation or dedicated server: the next level

A VPS is adequate for many compliance scenarios. However, if you run services with a very large user base, require dedicated hardware for performance isolation, or are establishing a branch office that needs its own server room, dedicated servers or colocation in Vietnam become relevant. A dedicated server from a Vietnam provider gives you the entire hardware, a dedicated IPv4, and free rDNS, useful for email services or applications with strict IP reputation requirements. Colocation lets you place your own hardware in a Vietnamese datacenter (typically Viettel IDC or VNPT IDC, both Tier 3), with remote hands support via IPKVM.

These options do not change the legal answer to the branch office Vietnam data requirement, if you need a branch, you still need one, but they are the correct infrastructure choice when a VPS reaches its scaling limits.

Practical recommendations for 2026

  1. If you have under 1 million monthly users and have not received a written storage order: you likely do not need a branch. Keep a Vietnam VPS as optional reserve infrastructure. If an order arrives, you can deploy quickly.
  2. If you receive a written storage order: reply within the deadline with a signed data processing agreement and evidence of a Vietnam-hosted server. Do not assume you must open a branch unless the order explicitly says so.
  3. If your service crosses Decree 53's threshold: start the branch registration process simultaneously with the server setup. The server handles the immediate data storage requirement; the branch covers the legal presence.
  4. Document everything: server contract showing the Vietnam datacenter, security configuration, encryption keys management, and the data protection officer. A regulator's first request will be documentation, not a server inspection.
  5. Consult a Vietnamese lawyer for your specific case. The law is evolving, and the regulator's interpretation matters at least as much as the text.

The branch office Vietnam data requirement is not a yes-or-no, one-size-fits-all rule. It depends on your user volume, your service category, and the specific legal instrument applied. A leased server, properly documented and secured, satisfies many obligations. A branch office is mandatory only in the cases where the law explicitly requires it, or where your business model needs a local entity. Know which category you fall into, and set up accordingly.

中文摘要

越南的数据本地化要求分为两类：第53号法令要求达到一定用户量的互联网服务必须开设代表处；个人数据保护法令则允许监管机构发出书面数据存储请求，该请求既可能要求设立代表处，也可能仅要求将数据存储在越南境内的服务器上。对于未达到用户阈值的中小型企业，租用一台越南VPS、做好加密和访问控制，通常就能满足合规要求。关键步骤是了解你属于哪种情形，并在收到请求时按法律要求响应。本文为一般信息，不构成法律建议。

FAQ

Does being served from a Vietnamese VPS automatically mean I comply with the data requirement?

Not automatically. A server inside Vietnam satisfies the physical data location requirement, but you also need proper access controls, encryption, documentation, and, depending on your user count, a legal entity. The server is a necessary component but not the entire compliance package.

What happens if I ignore a written storage request from A05?

Ignoring a written request is risky. A05 can issue warnings, impose administrative fines (up to 5% of total revenue for data violations under the PDPD), or escalate to criminal liability. It is safer to respond, even if the response is a request for clarification.

Can I use a cloud provider like AWS or Google Cloud with a Vietnam region to satisfy the requirement?

AWS and Google Cloud did not have Vietnam-local regions as of 2026. Their nearest regions are in Singapore or Hong Kong. Data stored there is not stored in Vietnam. You need a Vietnamese provider or a global provider with an actual Vietnam point-of-presence that hosts data on Vietnamese soil. Always verify the physical location of the datacenter.

Does the PDPD apply to foreign companies with no office in Vietnam?

Yes. The PDPD applies to any organization processing personal data of Vietnamese subjects, regardless of where the organization is headquartered. A foreign company with 100 Vietnamese users is covered. The personal data processing impact assessment must be filed with the regulator.

How long does it take to set up a representative office in Vietnam?

The process typically takes 1 to 3 months from engagement to the issuance of the establishment license. It requires notarized documents translated into Vietnamese, approval from the local Department of Industry and Trade, and a registered address. A law firm with experience in foreign investment is essential.

Is it possible that the same written request covers both storage and establishing a branch?

Yes. The PDPD allows the regulator to issue a written request that includes both storing a copy of the personal data in Vietnam and establishing a branch or representative office. The request is specific to each case; it can mandate storage alone, or both storage and a branch. You must read the exact wording and respond accordingly.

Disclaimer: This article provides general information and does not constitute legal advice. Regulations are subject to change and interpretation. Consult a qualified Vietnamese lawyer for advice tailored to your situation.

Related articles

Note: This guide is for general reference. Every system and infrastructure has its own specifics, so test each step in a safe environment and consult a qualified engineer before applying it in production.

在越南设分支机构还是租服务器

书面通知可能同时要求存储数据和设立分支或代表处，因此租一台服务器未必满足全部义务。是否需要落地实体，取决于业务类别和通知的具体要求。建议先做范围判断，再决定投入。