Operations

Which ten service categories fall under Vietnam's data storage requirement

BM BizMaC Team Feb 07, 2026 11 min read

If your company provides any online service to users in Vietnam, there is a good chance you are affected by Decree 53 (officially Decree 53/2022/ND-CP, effective October 2022). This regulation defines exactly which service categories must store user data within Vietnam and establishes the legal framework for data localization. The list is concrete: 10 service categories covering everything from telecom and e-commerce to online gaming and cloud computing. Understanding these vietnam data storage requirement categories is the first step toward compliance, and it matters whether you operate a small social network or manage a large cloud platform.

第53号法令点名十类服务，电商与社交平台都在其中。

Decree 53 names ten service categories, and both e-commerce and social platforms are on the list.

What is Decree 53 exactly?

Decree 53/2022/ND-CP is a Vietnamese government decree that specifies which types of online services must store personal data and other user data on servers physically located in Vietnam. It also requires these services to maintain local contact points for coordination with Vietnamese authorities. The decree does NOT apply to every website or app, it targets specific categories of service providers. If your service fits one of the listed categories, you must store the data of your Vietnamese users in Vietnam, and you must keep an office or representative in the country.

The three major telecom-state-owned enterprises in Vietnam, Viettel (also known as Viettel Military Industry and Telecoms Group), VNPT (Vietnam Posts and Telecommunications Group), and FPT Telecom (part of FPT Corporation, a private ICT company), typically serve as the infrastructure providers for foreign firms that need to meet this requirement. You can rent a VPS in Vietnam from these providers or from private hosting companies like thueVPS to host your data locally. The key point: the data must stay on Vietnamese soil.

Why does the list matter?

The law does not say "all internet companies", it says specific categories. A small e-commerce shop in Ho Chi Minh City is covered, but a random blog is not. A social media platform with 100,000 Vietnamese users is covered, but a private intra-company messaging app is not (unless it becomes public). If you are building a service that falls into any of the ten categories, even indirectly, you need to plan for local storage of user data, including personal identifiable information (PII) and transaction records.

The categories are defined in Article 25 of Decree 53. Below is the full list, with each category explained in plain English for a foreign audience.

The 10 service categories that require data storage in Vietnam

1. Telecommunications services

This covers any business that provides voice, data, or messaging services over public telecom networks. If you run a VoIP application, a virtual phone number service, or a bulk SMS platform that serves Vietnamese numbers, you are in this category. The obligation: store call detail records (CDRs), subscriber data, and billing data in Vietnam. For example, a company like Twilio offering programmable voice in Vietnam would need to store Vietnamese subscriber data locally.

2. E-commerce services

Any online platform where goods or services are sold, including marketplaces (Shopee, Lazada, Tiki) and direct-selling platforms. This also includes platforms that facilitate payments, order management, and logistics for online transactions. E-commerce platforms must store transaction histories, user profiles, seller data, and order records in Vietnam. Even a foreign-owned marketplace with Vietnamese customers must keep the data in-country.

3. Online advertising services

If your platform delivers targeted ads to Vietnamese users or manages advertising campaigns in Vietnam, you are covered. This includes ad networks (Google Ads, Facebook Ads, TikTok Ads) and any intermediary that handles ad delivery, targeting, or performance measurement. The data to be stored: ad targeting profiles, clickstream data, user identifiers used for ad personalization, and campaign performance data.

4. Social media and online social networking services

This is the broadest category. Any platform that enables users to share content, connect with others, or form communities, including forums, messaging apps with groups, video-sharing platforms, review sites, and dating apps. For foreign providers, this is the category that catches most "out of scope" services. If your app has a feed, comments, or group chat, you are likely in this category. Examples: Facebook, Zalo, YouTube, Reddit, Discord (if used in Vietnam), even niche platforms like Strava (which has social features). All user-generated content, profiles, and activity logs must be stored in Vietnam.

5. Online payment and intermediary payment services

Any service that processes, transfers, or facilitates payments between parties, including e-wallets (Momo, ZaloPay), payment gateways, and remittance services. This includes both domestic and cross-border payments where one party is in Vietnam. Data to store: payment transaction logs, KYC (know your customer) data, account balances, and dispute records. Intermediary payment services are tightly regulated in Vietnam, and this requirement adds a data location layer.

6. Online video and on-demand streaming (OTT) services

This covers any service that delivers video, music, or audio content to users over the internet, including Netflix, Spotify, Apple TV+, Disney+, and local services like FPT Play and VieON. The decree does NOT require storing massive video files locally (that would be impractical), but does require keeping user accounts, viewing history, subscription data, and billing records in Vietnam. Metadata about what users watch is considered personal data under the law.

7. Cloud computing services (IaaS, PaaS, SaaS)

Any provider of virtual servers, storage, platforms, or software hosted in the cloud. This covers AWS, Google Cloud, Microsoft Azure, and local players like Viettel Cloud and VNPT Cloud. The obligation: the provider must ensure tenant data is stored in Vietnam when the customer is Vietnamese. Many global cloud providers now offer "Vietnam region" options (e.g., AWS has announced plans for a Vietnam region, though not yet live as of 2026). Smaller providers like thueVPS also offer local-hosted VPS with data staying in Vietnam.

8. Online gaming services

Any multiplayer, social, or real-money gaming platform that is accessible to Vietnamese users. This includes mobile games with leaderboards, massively multiplayer online games (MMOs), and betting/gambling platforms (though gambling is heavily restricted in Vietnam). The data to store: player profiles, in-game transactions, chat logs, and gameplay data that can identify a user. This is why many foreign game developers keep their Southeast Asian servers in Vietnam, not just for latency, but for compliance.

9. Online data storage and sharing services

Any service that allows users to upload, store, and share files, including Google Drive, Dropbox, OneDrive, iCloud, and local services like FPT Cloud Storage. The law requires that user data stored in these services must physically reside in Vietnam if the user is Vietnamese. For providers like Google Drive, this is a significant operational requirement: hosting even a fraction of Vietnamese user files locally.

10. Domain name registration and internet number services

This covers domain registrars and DNS providers that manage .vn domains or provide services to Vietnamese users. If you register a domain ending in .vn, the registry (VNNIC, the Vietnam Internet Network Information Center) already requires local presence. But this category also includes international registrars that provide domain services to Vietnamese entities. The data to store: registration details, contact data, and DNS configuration records.

What data exactly must be stored?

The decree does not require storing every single data packet. It specifically applies to personal data (as defined in Decree 13/2023/ND-CP on personal data protection) and the data mentioned above for each service category: user profiles, transaction records, activity logs, payment data, and user-generated content. The storage period is typically the lifetime of the user's account plus a retention period defined by the category. For telecom, it is 2 years after termination. For e-commerce, it is the duration of tax obligations.

If your service falls into one of these categories, you need to store that data on physical servers within Vietnam. Rent a VPS in Vietnam from thueVPS or another local provider. You do not need to build your own data center, a rented Linux VPS with a dedicated IPv4 is sufficient for many SaaS businesses.

What about enforcement?

Vietnamese authorities can require service providers to submit compliance reports, and non-compliance can result in fines, service suspension, or blocking of the service in Vietnam. The Ministry of Information and Communications (MIC) is the primary enforcement body. If your service fits any of the ten categories and you have more than a threshold number of users (as defined in related decrees), you must comply.

For foreign services, the practical requirement is: (1) store the data of Vietnamese users in Vietnam, and (2) have a local contact office or representative. Many companies use local hosting providers or cloud partners like thueVPS to meet the storage part.

FAQ

My service is a small forum with 1,000 users in Vietnam. Do I fall under social media?

Yes, if the forum allows content sharing and user interaction, it qualifies as a social networking service under category 4. The decree does not specify a minimum user threshold for this category, the requirement is based on the nature of the service, not its size. Even a small forum may need to comply if it is public. However, enforcement may be less aggressive against very small services. When in doubt, consult a Vietnamese lawyer.

I use AWS globally. Does AWS have servers in Vietnam?

As of 2026, AWS does not yet have an operating region in Vietnam (it has announced plans but no launch date). Google Cloud also lacks a Vietnam region. Microsoft Azure has announced plans as well but has not deployed a Vietnam datacenter as of this writing. This means if your service requires Vietnam data storage, you must either use a local hosting provider (like thueVPS, Viettel Cloud, or VNPT Cloud) or partner with a local colocation provider. Many foreign firms rent a cheap VPS in a Vietnamese data center, often at Viettel IDC or VNPT IDC, to store the required subset of data.

Do I need to store ALL my data or just Vietnamese user data?

Only data related to Vietnamese users (subscribers, customers, or visitors located in Vietnam) must be stored in Vietnam. If your global platform has users in many countries, you only need to extract the subset of data belonging to your Vietnamese users and store it on a server inside the country. You can keep other data outside Vietnam. This is called data localization, not full migration.

What is the penalty for not storing data in Vietnam?

Fines can range from 30 million to 80 million VND (~1,200 to 3,200 USD) for individuals, and up to 100 million VND (~4,000 USD) for organizations, per violation. More seriously, the Ministry of Information and Communications can block your service in Vietnam by ordering internet service providers to restrict access to your platform. This is the real teeth of the law.

Does the decree affect my use of Google Analytics or Facebook Pixel?

Yes, potentially. If you are a Vietnamese business using Google Analytics (which stores usage data on Google's servers) or a Facebook Pixel (which sends Vietnamese user data to Meta's US servers), you should review whether that data falls under any of the 10 categories. For advertising services (category 3), the data used for ad targeting is covered. The decree creates a tension between using global analytics tools and storing data locally.

Can I use a virtual office for the local presence requirement?

Yes, a registered address in Vietnam with a point of contact (phone, email) that authorities can reach is sufficient. You do not need a physical office with staff, a registered address and a local representative (which could be a legal or consulting firm) typically meets the requirement. However, the data storage requirement is separate: you must actually store the data on servers physically in Vietnam.

Disclaimer: This article is for general informational purposes only and does not constitute legal advice. Decree 53 and related data protection laws in Vietnam are subject to interpretation and amendment. You should consult a qualified Vietnamese lawyer regarding your specific compliance obligations.

Related articles

Note: This guide is for general reference. Every system and infrastructure has its own specifics, so test each step in a safe environment and consult a qualified engineer before applying it in production.

越南数据存储要求覆盖的服务类别

第53号法令点名了电信、电商、社交网络、在线支付、数据存储与共享、网络游戏、视频与OTT、域名服务等类别。判断是否在范围内，看的是业务实质而不是公司注册地。属于范围内的企业应提前准备越南境内的存储方案。