Ask “what certification does a data centre need” in Vietnam and in Singapore and you will hear two different kinds of answer. In Singapore, the answer starts with the state capacity-allocation mechanism. In Vietnam, it starts with the data the facility will hold: which data class, whose data, and must it stay in-country. This article rebuilds the DC certification question in three layers so the two pictures can sit side by side.
The engineering layer: market standards rule, the state stands behind
Neither country issues a traditional “DC quality licence”. The engineering layer is standardised by the market: the Uptime Institute Tier classification (Tier I to Tier IV by redundancy and fault tolerance), design and facility construction certifications, and the ISO family for operations — ISO 27001 for information security, ISO 27017/27018 for cloud services, and PCI DSS when the facility serves payment customers. Large enterprise tenants and global cloud providers check these certifications in their tenders, so a DC in Vietnam courting international tenants must hold them whether or not domestic law asks. The state touches this layer mainly through construction codes, fire protection, environmental conditions for cooling systems and generators, and electrical safety — necessary conditions that do not by themselves make a facility grade.
The data layer in Vietnam: where the law truly tightens
The heaviest legal layer for a Vietnamese DC sits in data. The Data Law 60/2024/QH15 (effective 1 July 2025) establishes data classification, under which core data and important data carry a stricter management regime, including requirements when transferred abroad. Earlier, the Cybersecurity Law 24/2018/QH14 together with Decree 53/2022/ND-CP placed in-country storage duties on certain data of Vietnamese users collected by regulated businesses, along with local-presence requirements in cases the law specifies. For a DC operator, the consequence is that the tenant map must be drawn by data: tenants in the local-storage group are anchor tenants that keep the DC in Vietnam, while services for global tenants must be architected so that sensitive data flows do not cross the line the law has drawn.
The telecommunications and investment layer
A pure colocation DC and a DC providing cloud and connectivity services do not stand in the same legal position. The Telecommunications Law 24/2023/QH15 regulates telecommunications services and data centre and cloud computing services provided over telecom infrastructure; a foreign investor must therefore review whether any component of its service bundle falls into a licensed category or carries market-access conditions, before fixing the project structure and applying for an investment registration certificate under the current Investment Law. This boundary is where many international projects trip: the hardware is obvious, the services running on the hardware are the part counsel must read line by line.
Singapore through conditional allocation
Singapore controls new DCs through a capacity allocation mechanism coordinated by the IMDA (commonly called the DC-CFA), under which a project must commit to energy-efficiency and sustainability criteria to be considered for a slice of scarce capacity. In exchange, a Singapore DC enjoys a highly predictable operating environment and a legal reputation for which global financial tenants pay a premium. Everything about Singapore here is framework only: the criteria of each allocation round, capacity quotas and attached conditions change with policy and must be refreshed by local counsel at filing time.
Compliance cost: two opposite structures
In Singapore, the largest compliance cost is the opportunity cost of waiting for a capacity allocation, plus electricity prices among the highest in the region. In Vietnam, compliance cost sits in achieving and maintaining international certifications on the engineering layer, in compliance design on the data layer (data classification, cross-border transfer assessment), and in licensing advice on the service layer. A Vietnamese DC runs markedly cheaper per year, but the first-year budget must reserve a serious share for certification audits and data counsel — two line items that investors used to building factories rarely anticipate.
Frequently Asked Questions
1. What mandatory certification applies to data centres in each country, at framework level?
In Vietnam, a DC has no single sector certificate; the frame combines investment conditions and service licensing under the Telecommunications Law 24/2023/QH15 where the service bundle is regulated, data duties under the Data Law 60/2024/QH15 and Decree 53/2022/ND-CP, plus construction, fire and environmental conditions. Tier and ISO 27001 standards are market requirements. In Singapore, the main gate is the IMDA capacity allocation mechanism with energy-efficiency criteria.
2. Who handles quality assessment for DCs in each country, and how long does it take?
The engineering layer in both countries is assessed by independent certification bodies and the Uptime Institute on audit schedules the operator books, with timing driven by the certification level sought and the facility readiness. The legal layer in Vietnam sits with the data, cybersecurity and telecom regulators for each specific duty. In Singapore, the IMDA is the focal point for allocation and condition monitoring. Real timelines must be planned certification by certification inside the project plan; there is no single figure for every DC.
3. How do EU and US standards apply to DCs in each country?
A DC is a service, so destination standards arrive through tenant requirements and the data laws of the markets tenants belong to: European tenants pull GDPR-compatible processing chains with them, and US financial tenants pull control frameworks such as SOC 2 and PCI DSS. A DC in Vietnam or Singapore must reach these international audit frameworks to serve global tenants either way; the server location mainly changes the host country data-law equation.
4. How do DC compliance costs compare between the two countries?
In Singapore, the biggest item is the opportunity cost of waiting for capacity allocation and high power prices, while certification costs match any other international DC. In Vietnam, operating costs are far lower, but the compliance budget must include Tier and ISO audits, data classification and transfer counsel under the Data Law 60/2024/QH15, and service-licensing advice. The Singapore content here is framework only — check with local counsel before deciding.
