What happens after A05 issues a written storage request

The first time an A05 written storage request arrives, it usually lands on a weekday morning and sets a clock you cannot pause. A05, the Cybersecurity Department under Vietnam's Ministry of Public Security, has the authority to issue these requests under Decree 53/2022/ND-CP. The decree requires any entity handling Vietnamese user data through certain activities to store that data inside Vietnam. If your company receives this request, you have a fixed window to respond, and what you show during that window depends on infrastructure decisions you made months earlier.

This post walks through the exact timeline: what the request looks like, the response deadline, what A05 auditors check, and what you need to have in place before the email arrives. It is written for companies outside Vietnam that serve users inside Vietnam, e-commerce platforms, social apps, game publishers, fintech services, and any business that collects Vietnamese personal data.

A05 的书面存储请求启动一个 24 小时的回应窗口。您需要证明用户数据存储在越南境内的服务器上。

An A05 written storage request starts a 24-hour response window. You need to show that user data is stored on servers physically inside Vietnam.

What the request looks like when it arrives

The A05 written storage request does not come as an automated system alert. It arrives as an official document, typically a scanned letter on Ministry of Public Security letterhead, sent by email to your registered contact, or delivered by courier to your registered address in Vietnam if you have one. The document will reference Decree 53/2022/ND-CP, specifically the articles on personal data storage and the obligation of foreign entities to maintain data servers inside Vietnam.

The request specifies:

• Your legal entity name as registered with Vietnam's Department of Cybersecurity and Prevention of High-Tech Crime (A05) or as listed in your data processing notification.
• The specific data categories that A05 wants verification of, typically personal data of Vietnamese users (name, ID number, phone, address, biometric data, financial information, and location data).
• The timeframe within which you must provide a response. Under Decree 53, this is 24 hours from receipt of the written request. The decree does not extend this for weekends or holidays.
• The required evidence format, A05 typically expects a written response signed by an authorized representative, along with supporting documentation that proves data storage compliance.

The request may also name specific infrastructure details: the data center name, the server IP range, the hosting provider, and the system architecture diagram showing where Vietnamese user data resides.

Why the 24-hour window matters more than you think

Twenty-four hours sounds like a lot of time. It is not, especially if your operations team needs to coordinate across time zones, or if your Vietnamese user data currently lives on the same database as users from Singapore, Japan, and Australia.

Decree 53 does not define a grace period. If your initial response is late, A05 may escalate. Escalation can mean additional documentation requests, an on-site inspection at your data center, or, in the more serious cases, a restriction on your ability to collect Vietnamese user data until compliance is proven. The official Ministry of Public Security guidance emphasizes that the 24-hour clock starts at receipt, not when your legal team opens the email.

The practical implication is clear: you cannot begin preparing when the request arrives. Every piece of evidence you need, server location proof, architecture documentation, data flow diagrams, must already exist in a state that is ready to send within hours.

What A05 expects in your response

A05 does not accept a one-line email saying "we comply." The response must demonstrate, with verifiable evidence, that all Vietnamese user personal data is stored on servers physically located inside Vietnam. The standard requirements include:

The response must be signed by a person with legal authority for your entity, typically the country representative or a director-level officer. If you have no legal entity in Vietnam, this becomes more complex; you may need to designate a representative or work through a local partner.

The infrastructure that makes compliance straightforward

If your Vietnamese user data lives on a general-purpose server in a European colocation facility, every A05 request triggers a scramble. If it lives on a dedicated Vietnam VPS or a physical server inside a Vietnamese data center, compliance becomes a matter of pulling the contract and a few configuration files.

The minimum infrastructure setup that satisfies A05 verification is a rent a VPS in Vietnam that gives you:

• One dedicated IPv4 from the Vietnam range. A05 starts by checking the IP. If it resolves to a Vietnam-based ASN, that is one proof point completed.
• NVMe storage for the database hosting Vietnamese user records. Most A05 cases require the database to be physically on the Vietnam server, not cached or replicated externally.
• Full root access so your team can generate the exact configuration snapshot, data directory paths, and network topology diagrams that A05 requests.
• Monthly billing and no long-term contract, because compliance infrastructure may need to scale or move without a year-long lock-in.

A 2GB RAM VPS or 4GB RAM VPS running Ubuntu 24.04 or Debian 12 is usually sufficient for the data storage requirement itself, the database for Vietnamese user records, the application logic that decides where records go, and a monitoring agent. The actual processing may happen elsewhere, but the persistent store of Vietnamese personal data must live inside Vietnam.

If your business handles larger volumes, a dedicated server Vietnam with an Intel E5-2670, dedicated IPv4, and free IPKVM gives you full control over the hardware that A05 can inspect. The 100 Mbps commit on a 1 Gbps port for colocation ensures you do not bottleneck on the inspection traffic.

The key point is not the raw specification, it is that the server has a documented, verifiable physical location inside a Tier 3 data center in Vietnam. A hosting contract from Viettel IDC, with the server serial number and rack position, is the evidence A05 wants to see.

The three most common mistakes companies make

1. Confusing data processing with data storage. A05 does not require that every CPU cycle run inside Vietnam. It requires that the stored copy of Vietnamese user personal data, the database rows, the backups, the audit logs, reside physically inside Vietnam. Many companies rush to move their entire application stack to a Vietnam VPS when only the data layer needs to be there. That adds latency and complexity with no compliance benefit.

2. Using a shared or rotated IP address. If your Vietnam server uses a shared IPv4 from a NAT pool, A05 cannot easily verify that the server is physically in Vietnam, because the IP may belong to a different provider or region. A dedicated IPv4 from the Vietnam range, with rDNS set to your domain, is the simplest way to clear this check.

3. Neglecting backup location. The first question A05 asks after you show the primary server is: "Where are the backups?" If your backup pipeline copies Vietnamese user data to a server in Singapore or the United States, that is a violation. You must either keep backups inside Vietnam or provide a legal basis for the external copy. Most companies do not prepare for this question because backup pipelines are rarely designed with data location as the first concern.

What happens after you submit your response

A05 reviews the documentation within 10 working days under standard procedure. If the evidence is complete and consistent, A05 issues an acknowledgment. This does not end your compliance obligation, Decree 53 requires ongoing compliance, and A05 can issue subsequent requests at any time, including on-site inspections at your data center.

If the response is incomplete, A05 issues a notice of deficiency, listing what is missing. You then have another period, typically 10 days, to provide the missing evidence. Persistent non-compliance can lead to penalties under Decree 53, which range from administrative fines to temporary suspension of data processing activities that involve Vietnamese users.

The key operational takeaway: after the first request, A05 has your contact and expects to see consistent compliance. Treat the first request as a trial run and fix every gap immediately.

How to prepare right now (before any request arrives)

The preparation is not complex, but it is specific. Do these three things today:

1. Map your data flow for Vietnamese users. Know exactly where their personal data enters your system, where it is processed, where it is stored, and where the backups go. Draw the diagram and save it in a folder your legal team can access.
2. Provision a dedicated Vietnam infrastructure. Even if your main application runs in AWS Singapore or Google Cloud Tokyo, a Vietnam VPS with a dedicated IPv4, running the database for Vietnamese users, is the simplest compliance architecture. If you use a Vietnam VPS with dedicated IPv4 and NVMe storage, the contract from the data center is your proof.
3. Set up a response playbook. Name a person in your organization who is authorized to sign the A05 response. Store the hosting contract, the IP assignment document, the architecture diagram, and a sample response letter in a shared drive. The goal is to be able to respond within four hours of receiving the request, not 24.

If you need help choosing an infrastructure setup for compliance, contact the thueVPS sales team, they work with Vietnamese data centers daily and understand what A05 expects.

If you need this reviewed for your own setup, talk to our sales team.

FAQ

Related articles

• Does Decree 53 require my company to host data in Vietnam
• How to rent a VPS in Vietnam as a foreign company
• Do you need a Vietnamese entity to buy hosting in Vietnam