Vietnam’s New Data Localization Regulation Concerns US Investors


Vietnam’s new data localization regulation requires domestic and certain overseas companies to store personal data locally. It’s unclear how the regulation can be enforced without breaking its promise against forced data localization under the CPTPP trade deal. The announcement has rocked corporate groups and trading partners.


Vietnam will introduce a new law on October 1 that will require all domestic companies and certain foreign firms that provide services in areas such as telecommunications, e-commerce and online payments to keep certain types of data in the country for a minimum period of 24 days Years need to save months.

Unveiled in August, the new rules require companies to store personal information locally, including credit card information, email addresses, last logins, phone numbers, and the groups users interact with. The regulation met with opposition from business groups, particularly from the United States, as well as from Vietnam’s Pacific free trade partners.

US business groups warn that the new regulation creates uncertainty and could have a “significant impact” on investments. Vietnam has emerged as a popular investment destination amid rising geopolitical tensions between the West and China. The Southeast Asian country – known for its beaches, rivers, Buddhist pagodas and bustling cities – offers low labor costs, access to international markets and less political risk than neighboring manufacturing hub China.

International companies have 12 months to ensure they comply with the new rules once they have received instructions from the Minister for Public Safety. The Vietnamese Communist Party has particularly tough media censorship laws and has enacted regulations to strengthen its oversight of the internet — starting with a cybersecurity law in 2019 and continuing with social media guidelines in 2021.

What does the new regulation say?

The measures were presented there Decree 53/2022/ND-CP (Decree 53) can be summarized in the following three areas:

  • Owners of information deemed important are required, among other things, to (a) provide certain required information to appropriate government agencies and (b) comply with required security measures.
  • The deal gives governments the power to oblige companies to take certain actions — such as deleting data, providing data to authorities, and blocking domain names — when the law has been violated or when there is a violation of national security or the social order exists and security.
  • Domestic companies and certain foreign companies that provide certain services (e.g. telecommunications, e-commerce, online payments) are required to store certain types of data in Vietnam for a minimum period of 24 months. System logs on legal violations must be kept for at least 12 months. Foreign companies affected by the regulatory changes are also required to set up a branch or representative office in Vietnam.
READ:  Bloomberg Adds Lukka Prime, The First Institutional Fair Market Value Crypto Data Provider, On The Bloomberg Terminal And B-Pipe

Man-Hung Tran, Partner and Head of Baker McKenzie Vietnam’s IPtech Practice, narrates Bloomberg that the decree will help create a “legal basis” on which local authorities can take action against illegal activities in cyberspace.

The nature of the law bears similarities to those introduced in China to crack down on deviant activity, particularly online. Law firm Tilleke & Gibbins said of Vietnam’s new regulation that crimes “include content that violates national security, promotes anti-state; calls for violence; disturbs security or public order; is demeaning or defamatory” or harmful to the economy.

Speak with BloombergMan-Hung Tran claimed that “it is reasonable to expect that the Vietnamese authorities will be more proactive once their cybersecurity enforcement efforts take effect”.

How will this affect business and investments?

Although there is some ambiguity regarding the law and its enforcement, Decree 53 provides more explicit guidelines, specifying 10 types of services that are subject to data localization requirements. The 10 foreign company businesses/services subject to storage of regulated data in Vietnam are:

  • telecommunications services;
  • data storage and sharing services in cyberspace (cloud storage);
  • Delivery of domestic or international domain names to service users in Vietnam;
  • e-commerce;
  • online payment;
  • interim payment;
  • Providing transport connections via cyberspace;
  • social networks and social media;
  • online electronic games; and
  • providing, managing or operating other information in cyberspace in the form of messages, phone calls, video calls, email or online chat.

It also provides the triggering conditions that result in foreign companies being required to store regulated data and establish a branch or representative office in Vietnam. Working in any of the above services is the first trigger. The second is warned by the Department of Cybersecurity and High-Tech Crime Prevention (A05) of the Ministry of Public Security (MPS) that the services it provided were used for a cybersecurity law violation.

READ:  Data Co. Cerebri AI Dives Into Corporate Travel Arena

In short, the regulation is likely to create unwanted costs for businesses related to data localization and representative office setup.

Resistance from US corporate groups

US business groups have expressed concerns that the new regulation could have a “significant impact” on investments. In a joint letter to Prime Minister Pham Minh Chinh, the US Chamber of Commerce, the American Chamber of Commerce in Hanoi and the Asia Internet Coalition claimed that the new regulation would make it impossible for companies to accurately estimate the cost of doing business in Vietnam.

In their letter, the groups asked the government to provide more detailed guidance on how to interpret the regulation. “The wording of certain articles/clauses … is ambiguous and creates uncertainty as to what compliance measures are required,” the letter reads.

BSA — a global software trade organization funded by Amazon Web Services, Siemens and others — agreed with the US business groups’ concerns. The trade organization said the decree would put companies at a competitive disadvantage and affect their ability to select suppliers and find customers.

“Data localization does not improve the security or availability of data for customers or law enforcement,” said Jared Ragland, BSA Asia-Pacific Policy Senior Director Nikkei Asia. Ragland added that the new regulations increase the risk that “companies will migrate to other regional markets with more welcoming policies.”

A challenge for the CPTPP

Concerns have also been raised by trading partners, including Japan and Canada, both of which are members of the Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP) along with Vietnam.

“Canada continues to require Vietnam to implement its laws and regulations on the transfer and storage/processing of data in a manner consistent with its obligations in Chapter 14: Electronic Commerce of the [CPTPP]Global Affairs Canada spokesman Lama Khodr said in an email correspondence with Nike Asia. Khodr added that Ottawa is “watching the issue.”

READ:  5 Top Data Recovery Trends 

Meanwhile, the Japanese government has also highlighted that the CPTPP trade deal – a free trade agreement between 11 countries (12 if the UK joins as planned) – bans data localization and has already raised “concerns” about the original cyber law.

“The Japanese government will closely monitor compliance between the cybersecurity law and Vietnam’s commitments under relevant international agreements, including CPTPP and RCEP,” the Ministry of Economy, Trade and Industry said Nike Asia.

Endangering Vietnam’s unique opportunity

Amid rising tensions between Beijing and the West, Vietnam has emerged as an alternative to China as a destination for foreign direct investment, particularly in the manufacturing sector. The risks associated with investing in China, especially for manufacturing companies, have increased since the start of the trade war with the US in 2018. Concerns have grown in 2022 as Beijing refuses to sever ties with Russia despite its invasion of Ukraine.

Vietnam is an attractive investment destination for companies with a presence in China looking to diversify their supply chains. Unlike China, Vietnam is a member of the CPTPP Free Trade Pact, but offers comparable or even lower labor costs and low material costs alongside a rapidly growing domestic market. The country’s large and young workforce is another important incentive.

However, policy measures such as the introduction of data localization laws are likely to undermine this appeal, especially as other competitors emerge in the region. There are clear concerns about how the measures will affect the cost of doing business in Vietnam, but equally, Western organizations may balk at increasing state power to crack down on dissenting voices.


about us

Vietnam Briefing is produced by Dezan Shira & Associates. The company supports foreign investors across Asia from offices around the world including in Hanoi, Ho Chi Minh City and Danang. Readers can write to [email protected] for further assistance with doing business in Vietnam.

We also maintain offices or have alliance partners that support foreign investors in Indonesia, IndiaSingapore, The PhillipinesMalaysia, Thailand, Italy, Germany and the United States as well as practices in Bangladesh and Russia.



Source link