Which data shall be subject to storage in Vietnam?

Which data shall be subject to storage in Vietnam?

Pursuant to Clause 1 Article 26 of the Decree 53/2022/NĐ-CP stipulating data subject to storage in Vietnam as follows:

a) Data on personal information of service users in Vietnam;

b) Data created by service users in Vietnam: account names, service use time, information on credit cards, emails, IP addresses of the last login or logout session, and registered phone numbers in association with accounts or data;

c) Data on relationships of service users in Vietnam: friends and groups such users have connected or interacted with.

What are regulations on the data storage and establishment of branches or representative offices in Vietnam of foreign enterprises?

Pursuant to Clause 3 Article 26 of the Decree 53/2022/NĐ-CP stipulating the data storage and establishment of branches or representative offices in Vietnam of foreign enterprises as follows:

a) Foreign enterprises conducting business in Vietnam in one of the following fields: telecommunications services; storage and sharing of data in cyberspace; provision of national or international domain names for service users in Vietnam; e-commerce; online payment; payment intermediaries; services of connection and transportation in cyberspace; social media and social communication; online games; services of provision, management, or operation other information in cyberspace in forms of messages, calls, video calls, emails, online chatting, shall store data prescribed in Clause 1 of this Article and establish branches or representative offices in Vietnam in case services provided by such foreign enterprises are used for violations of laws on cybersecurity, notified and requested for cooperation, prevention, investigation, and handling in writing by the Department of Cyber Security and Hi-tech Crime Prevention of the Ministry of Public Security of Vietnam but they fail to comply or incompletely comply with such documents or prevent, obstruct, disable, or nullify the effect of cybersecurity protection measures performed by cybersecurity protection forces;

b) In case of inability to comply with regulations of laws on cybersecurity due to force majeure, foreign enterprises shall notify send notifications to the Department of Cyber Security and Hi-tech Crime Prevention of the Ministry of Public Security of Vietnam within 3 working days for inspection of the verification of such force majeure. In such cases, enterprises will have 30 days to adopt remedial methods.

What are procedures for requesting data storage and establishment of branches or representative offices of foreign enterprises in Vietnam?

Pursuant to Clause 6 Article 26 of the Decree 53/2022/NĐ-CP stipulating procedures for requesting data storage and establishment of branches or representative offices of foreign enterprises in Vietnam as follows:

a) The Minister of Public Security of Vietnam shall promulgate decisions on the request for data storage and establishment of branches or representative offices in Vietnam;

b) The Department of Cyber Security and Hi-tech Crime Prevention of the Ministry of Public Security of Vietnam shall provide notifications and guidelines, monitor, supervise, and urge enterprises to implement requests for data storage and establishment of branches or representative offices in Vietnam while notifying relevant agencies of the implementation of state management functions according to entitlements;

c) Within 12 months from the promulgation date of decisions of the Minister of Public Security of Vietnam, enterprises prescribed in Point a Clause 3 Article 26 of this Decree shall complete the data storage and establishment of branches or representative offices in Vietnam.

Best regards!