Cybersecurity, data localisation and cross-border transfers: the Cybersecurity Law 2025 and Decree No. 333/2026/ND-CP, who must store data in Vietnam and open a local office, the Data Law and core and important data, transfer impact assessments under the PDPL, information system protection, penalties, and a decision guide for group IT and HR data

Three regimes, one question

A foreign-invested company that wants to run its Vietnamese operations on group systems hosted abroad, whether an ERP, a CRM, an HR platform or a public cloud, must ask whether the data may leave Vietnam and whether any of it must also stay there. Three laws answer the question, each with its own regulator logic but all supervised by the Ministry of Public Security. The Cybersecurity Law decides who must store data in Vietnam and open a local office. The Data Law controls the transfer abroad of data classified as core or important, whether or not it is personal. The Personal Data Protection Law requires a transfer impact assessment for every transfer of personal data abroad (FAQ 82). They overlap, and a single transfer can engage all three.

There is no general prohibition on sending data abroad and no general rule that all data must be stored in Vietnam. For most foreign-invested manufacturers, traders and service companies, the practical requirements are the PDPL transfer impact assessment and good security, with the localisation and core-data rules relevant only in specific sectors or after specific triggers. The detailed PDPL rules are in Personal data protection.

The Cybersecurity Law 2025 and its decrees

Law No. 24/2018/QH14 on Cybersecurity introduced data localisation, implemented from 1 October 2022 by Decree No. 53/2022/ND-CP. Law No. 116/2025/QH15 on Cybersecurity, in force from 1 July 2026, consolidated it with the 2015 Law on Network Information Security into a single law on cybersecurity and network information security, and expanded the powers of the Ministry of Public Security. On 19 August 2026 the Government issued seven implementing decrees: Decree No. 327/2026/ND-CP on online information harmful to national security and public order; No. 328/2026/ND-CP on fake and false information, effective 5 October 2026; No. 329/2026/ND-CP on cybersecurity protection forces; No. 330/2026/ND-CP on administrative sanctions for cybersecurity and personal data protection; No. 331/2026/ND-CP on protection of information systems, with a five-level classification; No. 332/2026/ND-CP on cybersecurity products and services businesses; and No. 333/2026/ND-CP, which details the law and carries forward, with revisions, the parts of Decree No. 53/2022/ND-CP that remain appropriate, including the localisation rules. Transitional provisions preserve certain earlier arrangements for existing systems, contracts and licence applications received before 1 July 2026.

Decree No. 331/2026/ND-CP requires owners of information systems to classify them into one of five levels according to the harm a breach would cause and to apply the protection measures for that level, with higher levels subject to approval and inspection. Most private commercial systems sit at the lower levels, but operators of large consumer platforms, financial services and systems important to national security should check their classification.

Who must store data in Vietnam and open an office

Decree No. 333/2026/ND-CP distinguishes domestic and foreign enterprises. Domestic enterprises, which includes Vietnamese companies owned by foreign investors, that provide telecommunications, internet and value-added services in cyberspace in Vietnam must store prescribed data in Vietnam: personal information of service users in Vietnam and data created by those users, such as account names, service-use times, credit card information, email addresses, the latest log-in and log-out IP addresses and linked telephone numbers.

Foreign enterprises are covered only if they provide listed services in Vietnam: telecommunications, online data storage and sharing, domain name registration, e-commerce, online payment and payment intermediation, online transport connection, social networks and social media, online games, online applications and certain other online information services. Even then, the obligations arise only on a trigger. The service must have been used to commit a cybersecurity violation; the Ministry of Public Security's specialised force must have notified the violation and issued written requests for cooperation, up to three over up to six months; and the enterprise must have failed to remedy the violation or comply, or have obstructed or disabled protective measures. The Ministry may then decide that the enterprise must store the data in Vietnam and establish a branch or representative office responsible for compliance. The enterprise has 12 months from the decision to comply, must keep the data for at least 24 months, and must maintain the office until it stops operating in Vietnam or providing the service (FAQ 82). Telecommunications and hosting providers must remove or block unlawful content within 24 hours of a request from the specialised force, provide IP address identification within 24 hours or within three hours in urgent national security and serious crime cases, and keep logs for at least 12 months.

The Data Law: core and important data

Law No. 60/2024/QH15 on Data, in force from 1 July 2025 and implemented by Decree No. 165/2025/ND-CP of 30 June 2025, governs digital data generally, personal or not. It classifies data by importance and controls the transfer abroad of important data and core data, the latter a subset of the former whose unlawful use would directly threaten national defence, security, foreign relations, the macro-economy, social stability or public health and safety. The categories are listed in Decision No. 20/2025/QD-TTg. For private organisations, important data includes basic personal data of 100,000 or more people, sensitive personal data of 10,000 or more people and bank account, payment or debt data of 10,000 or more enterprises; core data includes the corresponding categories at one million people, 100,000 people and 100,000 enterprises, as well as defence, security and cryptography data and State-held data on critical infrastructure, health and finance.

The transfer abroad of core data requires prior approval: the transferor files an impact assessment dossier with the Ministry of Public Security, or the Ministry of National Defence for military, defence and cryptographic data, and receives a written decision. Important data may be transferred without prior approval, but the transferor must carry out a risk assessment covering legality, necessity, scope, the recipient's protection standards, leakage risks and responsibilities, and file the dossier with the Ministry. Decree No. 356/2025/ND-CP provides that where the data is personal data that is also core or important data, only the PDPL processing and transfer impact assessment dossiers are required, not a separate assessment under Decree No. 165/2025/ND-CP. Separately, providers of data intermediary services must locate their infrastructure in Vietnam and have a Vietnamese citizen as legal representative.

Cloud, outsourcing and sector rules

Data centre and cloud services may be 100% foreign-owned and need only registration, or notification for offshore providers, under the telecommunications law (FAQ 94), so a group can host Vietnamese data in a Vietnamese data centre operated by a foreign-owned provider if it chooses to localise. Several sectors add their own rules: banks and payment intermediaries are subject to State Bank requirements on data centres, backup sites and outsourcing of information technology; securities, insurance and health data have their own controls; and State agencies' data and data classified as State secrets cannot leave Vietnam. A foreign-invested company in a regulated sector should check its sector rules before any offshore migration. The penalties for cybersecurity violations under Decree No. 330/2026/ND-CP reach VND 200 million for organisations and VND 100 million for individuals; the penalties for personal data transfer violations, which are revenue-based, are set out in Personal data protection.