On 15 August 2022, the government promulgated Decree No. 53/2022/NĐ-CP on detailing some articles of Law on Cybersecurity (Decree 53) which will take effect on 1 October 2022. Noticeably, within the new document, (i) information deemed illegal or incorrect shall be deleted as per request of the competent individuals rather than the personal data owner, and (ii) some foreign enterprise operating in telecommunication, e-commerce,...whose branch or representative office located in Vietnam must proceed to store data in Vietnam.

Handling illegal, false information in cyberspace

Decree 53 added the situations when illegal or false information on cyberspace that violates national security, order, social safety, eligible rights, and interests of agencies, organizations, and individuals shall be deleted as per request of competent individuals rather than the data owner.

Mandatory data to be stored in Vietnam

According to Decree 53, the following data ("Mandatory Data“) must be stored in Vietnam:

1. data on the personal information of service users in Vietnam;
2. data created by service users in Vietnam: Account name, time using service, credit card information, e-mail address, latest log-in and log-out IP address, registered phone number linked to account or data; or
3. data on connections of service users in Vietnam: friends, groups that service users connect or interact with.

The implication of Mandatory Data toward foreign and domestic enterprise

Please note that the implication of the Mandatory Data is different between domestic enterprises and foreign enterprises.

Domestic enterprises

Domestic enterprises conducting the following services: telecommunication services, telecommunication-based application services, value-added telecommunication services (including email service, voicemail service, fax service, and internet access service), internet services, and over-the-top content services on the Internet shall store the Mandatory Data in Vietnam.

Foreign enterprises

Any of the foreign enterprises shall establish a branch or representative office in Vietnam and store the Mandatory Data shall store in Vietnam if the foreign enterprise triggered all 4 of the conditions below:

1. the foreign enterprise provides any of the following services in Vietnam (“Subjected Services”):
   1. telecommunication;
   2. store and share data on cyberspace;
   3. provide a national or international domain name for service users in vietnam;
   4. e-commerce
   5. online payment;
   6. payment agent;
   7. connection service through cyberspace;
   8. social network and social media;
   9. electronic game on internet; and
   10. other services providing, managing, or operating information on cyberspace as messages, phone calls, video calls, e-mails, online chat; and
2. the Subjected Services provided by the foreign enterprise are used for committing violations of the Law on Cybersecurity ("Violation”); and
3. the Department of Cybersecurity and High-Tech Crime Prevention (“Cybersecurity Dept”) of the Ministry of Public Security ("MoPS”) has notified the foreign enterprise on the Violation and requested coordination, prevention, investigation, and handling in writing ("Notice”); and
4. the foreign enterprise fails to comply, fails to comply fully in accordance with the Notice, or prevents, obstructs, disables, or invalidates network security protection measure(s) applied by the Cyber Security Task Force (comprising the Cybersecurity Dept and the Military Security Protection Department under the General Political Department and Cyberspace High Command of the Ministry of National Defense).

Timelines for foreign enterprise setting up branch or representative office

Setting up branch or representative office

Branch or representative office must be set up as soon as possible within 12 months from the foreign enterprise received the request from the Minister of MoPS for setting up its branch or representative office in Vietnam.

Maintenance of branch or representative office

Branch or presentative that has been set up under the request of Minister of MoPS must be maintained until cessation of business activities in Vietnam or the Subjected Services are no longer provided in Vietnam.