Cybersecurity Policy Report, Vietnam Government Cybersecurity Law Decree Requires Data Localization, (Aug 18, 2022)
By Tony Foley
The Vietnamese government issued a decree on Monday detailing a number of articles in the Law on Cybersecurity that included requirements related to storage of data in Vietnam and the establishment of a branch or representative office in the country.
The decree, No. 53/2022/ND-CP, discusses these concepts in Chapter 5, Arts. 26-27. The new provisions specify that the following types of data must be stored in Vietnam:
Data on the personal information of service users in Vietnam;
Data created by service users in Vietnam, including account names, service usage time, credit card information, e-mail addresses, registered network (IP) addresses, login and logout information, and registered phone numbers associated with an account or data; and
Data on the relationships of service users in Vietnam, including friends and groups with which the user interacts.
All domestic enterprises must store the data described above in Vietnam. Specified foreign enterprises conducting business in the country, including telecommunications providers, online payment intermediaries, social networks and media, and other businesses provided for in the decree, also must store the data described above in Vietnam and must set up a branch or representative office in the country in case the services provided by the enterprise are used to commit acts in violation of the law on network security.
The decree also specifies orders and procedures for data storage, providing that the Department of Cybersecurity and High-Tech Crime Prevention and Control under the Ministry of Public Safety is responsible for notifying, guiding, and supervising enterprises to fulfill requests to store data locally and to set up a branch or representative office in Vietnam, as well as notifying relevant agencies to perform state management functions within their competence. Within 12 months from the date on which the ministry issues a decision, an enterprise must complete data storage, set up a branch or representative office, and store data in Vietnam.
The period of local storage required above starts from the time the enterprise receives a data storage request until the end of such request. Covered enterprises must store the data for a minimum of 24 months. Similarly, the branch or representative office established in Vietnam must be set up from the time the enterprise receives a set-up request until the enterprise ceases operations in Vietnam or the specified service is no longer available in the country.
The decree also specifies a variety of cybersecurity activities to be undertaken by state and local agencies and organizations, including the regulation of internal computer networks and information systems to ensure security. The decree takes effect on October 1.
News: InternationalLegislation DataSecurity DataPrivacy