Managed hosting sells management labour — installation, patching, monitoring, backup, incident response — on top of server infrastructure. In licensing terms it splits into two clear layers: the hosting infrastructure layer, if the provider also sells it, follows the cloud services regime, while the pure management layer is an information technology service requiring no permission. Confusing these two layers is the most common classification error of foreign providers new to Vietnam.
What managed hosting includes and which part is regulated
A typical managed hosting package includes: operating system and platform application installation and configuration; security patching and updates; 24/7 performance monitoring and alerting; backup and recovery; incident response support; and periodic operations reporting. The managed servers may be the customer’s own, placed at a third-party data center; the provider’s own cloud infrastructure; or a third-party hyperscale cloud the provider manages on the customer’s behalf.
The law regulates the package not by its name but by the substance of each layer. The management layer — people and process — is an ordinary information technology support service. The infrastructure layer is regulated only when the provider also sells that infrastructure as a service: selling virtual servers and storage to customers is cloud computing service provision subject to notification under Decree 163/2024/ND-CP; leasing physical space is a data center service subject to registration. A provider selling only management on the customer’s infrastructure touches neither regime.
A foreign company managing servers for Vietnamese customers: which procedures apply?
If a foreign company supplies management services cross-border — a team abroad remotely accessing customers’ servers in Vietnam — this activity is not telecommunications service business and has no sector licensing procedure in Vietnam. Duties arise at other layers: tax on income from Vietnamese customers under the foreign-supplier mechanism; and personal data protection where the management team accesses systems holding Vietnamese users’ personal data — the provider then acts as a processor or sub-processor in the customer’s chain under Personal Data Protection Law No. 91/2025/QH15.
If a company is incorporated in Vietnam to supply managed hosting, it registers information technology and computer-related service lines under the economic sector system — sectors not on the conditional investment list for foreign investors in their pure management form. A Vietnamese company is also the subject that signs contracts, issues invoices and answers directly to customers and regulators, which large Vietnamese enterprise customers usually require.
How does it differ from colocation in licensing?
Colocation sells physical infrastructure: space, power, cooling and security of a specific facility — the colocation provider is a data center operator and must register to provide data center services under Decree 163/2024/ND-CP for that facility. Managed hosting sells management capability: the provider may own no data center at all, works on the customer’s or a third party’s infrastructure, and needs no data center service registration for the management activity.
In the market the two services are often sold as one bundle, blurring the boundary: the same provider leases racks and also manages the servers in them. The legal duties then accumulate layer by layer: registration for the data center layer, cloud notification for any virtualised infrastructure layer, and no licence for the management layer. Contracts should separate these layers into distinct service annexes so each layer’s duties and service levels are clear — also how large customers diligence providers.
Operating personnel: certification is a contract matter, not a State licence
Vietnamese law sets no State practice-certificate requirement for commercial server administrators: there is no mandatory “systems administration certificate” to operate managed hosting. Competence requirements come from three other sources: customer contracts — large customers usually require vendor or international operations certifications of the team; cybersecurity requirements where the managed system is a level-classified system — the protection plan under Decree 331/2026/ND-CP must staff cybersecurity personnel of commensurate capability; and labour law where personnel are foreigners working in Vietnam, in which case a work permit under Decree 219/2025/ND-CP is a mandatory condition.
One point foreign providers often miss: foreign engineers’ remote administrative access into systems in Vietnam is still data processing that must be authorised by the customer in writing, access-logged and revoked immediately when the contract ends. In data incidents, administrative access logs are the first evidence demanded — operating managed hosting without logging discipline is this model’s largest legal risk.
Frequently asked questions
Must a foreign company managing leased servers for Vietnamese customers obtain permission?
No sector permission is required for the management activity. Pure managed hosting — administering leased servers for customers — is an information technology service, not a telecommunications service. A foreign company’s duties comprise: tax on income from Vietnamese customers; compliance with Personal Data Protection Law No. 91/2025/QH15 when accessing systems holding personal data in a processor role; and, if the company also sells hosting infrastructure to customers, that infrastructure part falls under the cloud computing service notification of Decree 163/2024/ND-CP. A Vietnamese-incorporated provider registers ordinary IT service lines.
How does managed hosting differ from colocation in licensing?
Colocation sells the physical infrastructure of a data center — the provider must register to provide data center services under Decree 163/2024/ND-CP for its facility. Managed hosting sells management capability on top of infrastructure — the provider may own no data center and needs no data center service registration for the management part. When one provider sells both in a bundle, duties accumulate by layer: registration for the colocation layer, cloud notification for any virtualised infrastructure layer, and no licence for the management layer.
Are there certificate requirements for operating personnel?
There is no mandatory State practice certificate for server administrators in Vietnam. Certificates — vendor or international-standard — are requirements customers set in contracts and a basis for assessing provider capability. Two exceptions to remember: a system under level-based protection in Decree 331/2026/ND-CP must staff cybersecurity personnel of commensurate capability in its protection plan; and foreign personnel working in Vietnam must hold a work permit under Decree 219/2025/ND-CP regardless of any international certificates they hold.
This article has been quality-reviewed by the FLAW AI Legal Council