Security

Does Decree 53 require my company to host data in Vietnam?

BM BizMaC Team Jan 28, 2026 11 min read

The first time you read Decree 53/2022/ND-CP, the question hits you: “Does this mean we have to move every database to a server inside Vietnam?” The short answer is no, not every company, not every data type, not automatically. But if your service reaches enough users in Vietnam or handles protected categories of personal data, compliance becomes mandatory. This article tells you exactly who the law targets, what it requires, and how to meet the obligation with a real Vietnam VPS hosting solution.

第53号法令的存储要求由公安部A05书面通知触发，并非自动适用。

Decree 53's storage requirement is triggered by a written notice from A05, not automatically.

What is Decree 53/2022/ND-CP?

Decree 53, effective October 1, 2022, is the implementing regulation for Vietnam’s Cybersecurity Law (Law 86/2015/QH13) and the Law on Network Security (Law 24/2018/QH14). It defines the conditions for providing services in cyberspace and, most critically for foreign companies, the data localization and data hosting requirements. The Decree establishes two separate obligations:

  • Data localization: storing certain categories of user data on servers physically located in Vietnam.
  • Data hosting: maintaining a branch or representative office in Vietnam to handle data processing.

Both obligations apply to domestic and foreign enterprises that meet specific user-volume and data-type criteria. The rule is not blanket, it only triggers when your service crosses a threshold defined in Article 26 of the Decree.

Key takeaways

  • Decree 53 applies if your company, domestic or foreign, amasses over 100,000 monthly user interactions in Vietnam within the scope of certain service categories.
  • The obligation covers personal user data, data about user relationships, and data generated by user activity in Vietnam’s cyberspace.
  • Compliance means storing that data in a server inside Vietnam, for a minimum of 24 months, and filing registration with the Ministry of Public Security.
  • A Linux VPS, Windows VPS, or dedicated server from a Vietnamese data center with a dedicated IPv4 is a straightforward way to meet the hardware requirement.
  • Failure to comply can lead to operational suspension of the service in Vietnam, not a fine, but a service block.

Who does Decree 53 apply to?

The Decree targets both domestic enterprises (companies incorporated in Vietnam) and foreign enterprises providing services on telecommunications networks, the internet, and value-added services in Vietnam’s cyberspace. The key trigger is found in Article 26.3: if the enterprise falls into one of a list of service categories, including telecom, social networks, online ads, data platform services, online games, messaging, e-commerce, cloud computing, and over-the-top (OTT) services, and the number of monthly user interactions in Vietnam exceeds 100,000, then the data localization and hosting obligations kick in.

The 100,000 threshold counts “user interactions,” not registered accounts or unique visitors. “User interactions” is defined broadly to include any user activity: posting, sharing, commenting, sending messages, conducting transactions, or using network features. If your service accumulates 100,000 of these actions in a month, you cross the line.

Domestic companies are not exempt, they must also comply if they fall into the service categories and meet the user volume. However, for domestic firms that are already wholly operating inside Vietnam, the practical difference is less drastic because they likely already host most data locally. For foreign companies, the requirement forces a change in architecture.

What data must be located in Vietnam?

Article 26.1 of Decree 53 lists three categories of data that must be stored on servers physically placed in Vietnam:

  • Personal data of users in Vietnam, any data that can identify an individual: name, ID number, phone number, email, location, IP address, device identifiers, biometrics, etc. This aligns with the definition in the draft Personal Data Protection Decree (DPDP).
  • Data about user relationships, data created by the interaction between users and the service: who they connect with, groups they join, transaction history, activity logs.
  • Data generated by user activity in Vietnam, any data that arises when a user on the service performs an action that is recorded: login timestamps, content they post, search queries, purchase history.

This is not the entire dataset of the company. If you run a global CRM tool, only the data tied to your Vietnam-based users’ interactions must be stored locally, not the entire corporate database containing records from other countries. However, the boundary can be fuzzy in practice because user activity data often touches other tables (groups, payment logs, message history).

Does Decree 53 apply to my B2B SaaS startup?

Yes, if you provide a service that fits the listed categories, for example, a cloud-based collaboration platform, an analytics dashboard used by Vietnam-based companies, or a helpdesk SaaS integrated into Vietnamese social networks, and your monthly user interactions in Vietnam exceed 100,000. Even if your target users are businesses, the data of their employees (who interact via your platform) is still “user data” under the Decree.

What are the duration and reporting requirements?

The data must be stored in Vietnam for a minimum period of 24 months from the date you trigger the obligation. The storage is not just archival, the data must be accessible and processable. Additionally, you must file a registration with the Ministry of Public Security (MPS) confirming the location of the server(s) in Vietnam and providing a description of the data stored.

The registration process is outlined in Article 26.4-26.5. The MPS has 30 days to respond after receiving a complete dossier. During this period, your service can continue operating. After approval, you must maintain the Vietnamese data center for the full 24-month window. Foreign enterprises must also appoint a local representative, a branch or representative office, to coordinate with Vietnamese authorities.

What happens if you don’t comply?

Enforcement under Decree 53 is not monetary fines, it is operational. The MPS has the authority to suspend or terminate the service’s activities in Vietnam’s cyberspace until compliance is achieved (Article 26.6). For a digital service, this is effectively the death penalty for the Vietnam market. Your domain could be blocked, your IP ranges blacklisted, and your service unreachable from Vietnamese IP addresses. This makes compliance a business continuity issue, not a legal margin.

How to comply: practical steps

Once you confirm that Decree 53 applies to your company, the implementation is a straightforward infrastructure move:

  1. Select a data center in Vietnam. You need a server physically located in a Vietnamese data center, Tier 3 facilities like Viettel IDC or VNPT IDC in Hanoi or Ho Chi Minh City. These offer NVMe storage, redundant power, and direct domestic bandwidth. The server must have a dedicated IPv4 address registered in Vietnam.
  2. Rent a VPS or dedicated server. For most SaaS and digital services, a Linux VPS with full root access is sufficient. You get your own isolated KVM virtual machine, you install the OS (Ubuntu, Debian, AlmaLinux) and your application stack (Nginx, Docker, PostgreSQL) yourself. For heavier workloads, a dedicated server, an Intel E5-2670 or newer, gives you bare-metal control. You choose the OS, install what you need, and maintain full root access.
  3. Set up data replication. You do not need to move your entire global infrastructure to Vietnam. Use async replication (e.g., PostgreSQL streaming replication, MariaDB Galera, rsync + cron) to send the required user data to the Vietnamese server. You keep your primary database in your existing region and replicate only the Vietnam subset.
  4. File the MPS registration. Prepare a dossier that includes: your company registration, description of the service, volume of user interactions in Vietnam (calculated from your logs), server location in Vietnam, contact details of your local representative. Submit it to the MPS via the designated portal. Expect a 30-day review period.
  5. Maintain logs and monitoring. Keep at least 24 months of the specific data categories on the Vietnamese server. Set up monitoring (Prometheus + Alertmanager, Uptime Kuma) to ensure the server stays accessible and the replication is continuous.

Does Decree 53 apply if I use a foreign cloud provider’s Vietnam region?

Yes, as long as the server is physically in Vietnam. AWS, Google Cloud, and Alibaba Cloud all have data centers in Vietnam. However, you must still appoint a local representative and file the registration with the MPS. The server being in a foreign-operated data center does not exempt you from the Decree, only the physical location matters. Many companies choose a locally operated VPS or dedicated server for simpler logistics and to avoid dependency on foreign cloud pricing for Vietnam-specific traffic.

Troubleshooting common compliance questions

How do I calculate the 100,000 user interaction threshold?

Count the number of distinct user actions recorded in your system from Vietnamese IP addresses or from users whose registered phone number uses the +84 country code. “User interactions” includes logins, page views, comments, messages, transactions, shares, API calls from the user’s device. Sum them per month. If the total exceeds 100,000 in any month, the obligation is triggered for that month onward.

What if I have fewer than 100,000 interactions but handle sensitive personal data?

The Decree does not impose localization solely based on data sensitivity. The threshold is purely quantitative. However, the definition of “personal data” in the DPDP (not yet enacted as a stand-alone law) is broad and will affect many categories. For now, stick to the threshold as the trigger for localization. You should still implement data protection measures regardless.

Can I store data in Vietnam on a shared hosting plan?

No. The Decree does not explicitly forbid shared hosting, but the operational requirement to “host” data implies you must have control over the storage location and security. A shared hosting plan where you cannot install software, configure the firewall, nor guarantee the data’s physical location on a specific server is not sufficient. You need a Linux VPS or a dedicated server, a self-managed environment where you hold root access and control the data.

If you are sizing this up for a Vietnam footprint, our VPS pricing lists the specs and monthly cost per plan.

FAQ

Is Decree 53 applicable to my company if I do not meet the 100,000 user interaction threshold?

No. The trigger is strictly quantitative. If your service in Vietnam generates fewer than 100,000 user interactions per month, Decree 53’s data localization and data hosting requirements do not apply to you, regardless of the nature of your service. However, you must still comply with the general Cybersecurity Law and data protection rules.

Does Decree 53 apply to domestic as well as foreign companies?

Yes. Both domestic enterprises and foreign enterprises that provide services in the listed categories (telecom, social networks, online ads, cloud, etc.) in Vietnam’s cyberspace and meet the 100,000 user interaction threshold must comply. Domestic firms often already host data locally, but they must still file the registration.

What happens if I store the data in Vietnam but fail to file the registration?

Storing the data without filing the registration is non-compliance. The MPS can still suspend your service until you complete the registration process. The registration is a mandatory step, it confirms the location, the data categories, and your local representative. Without it, your server in Vietnam does not satisfy the legal obligation.

Can I use a Vietnamese server for only part of the data?

Yes. You only need to store the data categories listed in Article 26.1 (personal data, relationship data, activity data) for your Vietnam users on the Vietnamese server. You can keep the rest of your global data in other data centers. Replicate only the relevant subset to the Vietnam server.

How long must I retain the data in Vietnam?

At least 24 months from the date you trigger the obligation. This is updated continuously as long as the service operates. If your service crosses the threshold in one month, the 24-month clock starts from that month.

Does Decree 53 require a data center in a specific city?

No. The Decree only requires the server to be physically in Vietnam. It can be in Hanoi, Ho Chi Minh City, Da Nang, or any other facility with licensed data center operations. Tier 3 data centers in Hanoi (Viettel IDC) or Ho Chi Minh City (VNPT IDC, FPT) are common choices.

Related articles

Note: This guide is for general reference. Every system and infrastructure has its own specifics, so test each step in a safe environment and consult a qualified engineer before applying it in production.

越南第53号法令的存储要求详解

第53号法令自2022年10月生效，落实2018年网络安全法。存储义务不是开业即触发，而是由公安部A05发出书面通知后才生效。收到通知的企业需要把越南用户数据留在境内，并保存24个月。提前准备一台越南VPS，比收到通知再仓促搬迁便宜得多。