Legal hosting requirements for Vietnam-China cross-border e-commerce

If you run a cross-border e-commerce operation between Vietnam and China, the first question is not which VPS is fastest. It is where your data may legally live. Vietnam's Decree 53 and the Cybersecurity Law draw a line between data that must be stored inside Vietnam and data that can flow abroad. Get this wrong and your storefront, payment records, and customer database are the problem, not the server. This guide walks through the Vietnam-China cross-border ecommerce hosting legal requirements and maps each rule to a concrete hosting decision.

Prerequisites

• A clear picture of what data your platform collects: customer names, phone numbers, addresses, payment history, and any behavioral data.
• Knowledge of where your servers currently sit, whether that is a Linux VPS in Singapore, a shared host in Hong Kong, or something else.
• Basic familiarity with DNS, server configuration, and the difference between domestic and international bandwidth on a Vietnam-hosted server.

What Decree 53 actually requires for cross-border e-commerce

Decree 53, which took effect in 2025, implements the Cybersecurity Law. It only applies to certain categories of companies: telecom providers, cloud services, data analytics, and, importantly, e-commerce platforms that collect personal data of users in Vietnam. If your storefront serves Vietnamese customers, you fall into this group regardless of whether your company is registered in Vietnam, China, or elsewhere.

The core requirement is data localization. Personal data of Vietnamese users, and data that Vietnamese agencies determine to be important, must be stored in Vietnam. Foreign companies must open a local entity, a branch or a representative office, and file a storage request with the Ministry of Public Security (A05) within 30 days of the data rules applying to them. You must also keep this data for at least 24 months after the user closes their account or the data is no longer needed.

For a China-based e-commerce platform selling into Vietnam, the practical reading is simple. Customer data from Vietnamese users must live on infrastructure inside Vietnam. A server in Shenzhen, Hong Kong, or Singapore does not satisfy the rule. That caveat, hosting customer data in Vietnam, is the single most important takeaway from the regulation.

Which data must stay in Vietnam and which can leave

Not everything needs to sit inside Vietnam. The regulation draws a distinction between personal data of Vietnamese users and general business data. The former stays local. The latter, such as product catalogs, inventory counts, pricing, and internal analytics that do not contain personal data, can remain on servers abroad without issue.

In practice, this is how a compliant architecture looks:

• In Vietnam: customer accounts, names, phone numbers, shipping addresses, order history, payment records, and support tickets that reference a customer.
• Abroad is fine: product listings, pricing rules, supplier data, warehouse inventory, and marketing content that has no personal identifiers.
• Gray zone: session logs, behavioral tracking, and device fingerprints. The safe reading is to keep these in Vietnam too, since they are tied to identifiable users.

This split matters for latency as much as for compliance. A Linux VPS in Vietnam that holds the customer database and order tables gives Vietnamese users fast checkout, while a backend in China handles procurement and fulfillment. The two sides talk over a secure channel, but only anonymized or non-personal data crosses the border.

Do you need a Vietnamese entity to host data in Vietnam

This is the question every foreign operator asks, and the answer is nuanced. To file a storage request with A05, you must have a legal presence in Vietnam. That means a local entity, a branch, or a representative office. Without it, you cannot complete the filing, and the data localization requirement is effectively unmet.

However, having a Vietnamese entity does not force you to build your own datacenter. You can rent infrastructure from a local provider and store the required data on that infrastructure, as long as the data physically resides in Vietnam. This is where a Linux VPS with a Vietnam IPv4 becomes the practical path. You get a server inside Vietnam, you control the operating system, the database, and the backups, and you satisfy the storage location requirement without owning hardware.

越南 VPS 提供本地存储，满足第53号法令的数据本地化要求。

A Vietnam VPS provides local storage, which satisfies the data localization requirement under Decree 53.

If you are weighing this decision, the article does decree 53 require my company to host data in vietnam covers the entity question in more depth. The short version is that you need a legal presence for the filing, but you do not need to own the infrastructure.

How to choose a compliant VPS for the Vietnam side

Compliance is not a license to ignore operations. The server holding Vietnamese customer data must be reliable, reachable from Vietnam with low latency, and fully under your control so you can implement access controls and audit logs.

Start with location. The server must sit in a Vietnamese datacenter, run by a provider with local infrastructure, not a foreign provider resold into Vietnam. A Tier 3 datacenter such as Viettel IDC or VNPT IDC is the right tier for production e-commerce data. Ask the provider directly where the physical server is located.

Then look at control. You need full root or Administrator access to configure encryption, firewalls, and database access, and to prove where data is stored if a regulator asks. A shared hosting account will not give you this. A Linux VPS with KVM virtualization and root access is the minimum workable setup.

n8n is a common middle layer in cross-border operations, syncing orders between the Vietnam storefront and a China-side ERP. If you run one, the deployment guide deploy and secure n8n on a debian vps in vietnam shows a hardened setup that keeps automation data local too.

Why the connection quality between Vietnam and China matters

Hosting customer data in Vietnam solves the legal problem, but it creates an operational one. The storefront database is in Vietnam, the fulfillment backend is in China, and every order must cross the border. The quality of that cross-border link determines whether checkout feels instant or sluggish.

Vietnam has multiple international gateways and the route to China is generally direct, but latency varies by provider and time of day. Do not trust a marketing claim about speed. Measure it. From a server in Vietnam, run a continuous ping to your China-side endpoint for a few days and log the round-trip time. A stable 40-80 ms is realistic for a good route. If you see jitter above 100 ms, the integration will feel slow to users.

A related issue is domestic bandwidth on the Vietnam side. Vietnamese users connect to the storefront over domestic routes, so the server must have solid domestic bandwidth, not just a good international pipe. When you compare VPS pricing and plans, check what the provider says about domestic connectivity and the port speed they allocate.

Handling data transfer and access control across the border

Once you split the stack, you need a disciplined way to move data between the Vietnam side and the China side. The rule is simple: only the minimum necessary data crosses, and it crosses over an encrypted channel.

Set up a VPN or an encrypted tunnel between the two servers. WireGuard is the practical choice here, lightweight and fast. The China-side backend should not be able to query the Vietnam database directly. Instead, it calls a read-only API or a webhook that returns only the fields needed for fulfillment, such as order ID and shipping address, without exposing the whole customer record.

# On the Vietnam VPS, allow only the China backend IP through the API
sudo ufw allow from 203.0.113.10 to any port 8443 proto tcp

Log everything. The regulator may ask who accessed customer data, when, and from where. Keep access logs for at least 24 months to match the data retention period. Centralize logs on the Vietnam side and rotate them with logrotate so they do not fill the disk.

For the encryption layer, a wildcard certificate on the storefront domain is the clean move. The article dv ssl vs wildcard ssl which to buy explains the trade-off if you have not picked one yet. Use TLS for every connection that touches personal data, including the API between the two servers.

Practical checklist for a compliant launch

Here is the sequence I would follow when standing up a Vietnam-China cross-border storefront today:

1. Register a Vietnamese entity, a branch or representative office, before processing any Vietnamese user data.
2. Provision a Linux VPS in a Vietnamese Tier 3 datacenter with a dedicated IPv4 and root access.
3. Install the customer database, order tables, and payment records on the Vietnam VPS. Keep product catalog and fulfillment data on the China-side server.
4. File the storage request with A05 through your local entity within 30 days.
5. Connect the two servers with WireGuard, expose only a read-only API from the Vietnam side, and log all access.
6. Test the cross-border route continuously for a week before launch. Log the latency and jitter.

If the operation grows and the Vietnam side needs more compute, a dedicated server Vietnam is the natural upgrade. But most early-stage platforms run comfortably on a 4-8 GB RAM VPS with NVMe storage, and that keeps the compliance footprint small.

FAQ

Related articles

• Does Decree 53 require my company to host data in Vietnam
• Vietnam Decree 53 data localization rules for SaaS
• Do you need a Vietnamese entity to buy hosting in Vietnam
• How to rent a VPS in Vietnam as a foreign company