Whether a fintech must place servers in Vietnam has no one-word answer, because the domestic storage duty comes from two different systems with different subjects. The Cybersecurity Law imposes in-country storage on a defined group of service providers, while the Personal Data Protection Law regulates outbound data transfers through an impact assessment mechanism. Laying both systems over a fintech’s actual operations produces the real duty to comply with.
Layer one: in-country storage under the Cybersecurity Law
Article 26 of Law on Cybersecurity 24/2018/QH14 and Decree 53/2022/ND-CP require enterprises providing listed cyberspace services, such as telecommunications and information storage and sharing services, to store certain data types in Vietnam, including personal information data of service users in Vietnam, data on user relationships and data created by users. Foreign enterprises in this group may also have to place a branch or representative office in Vietnam.
For a fintech, falling inside the storage group depends on the specific service it provides and the data it processes. An e-wallet or a platform with a user community and user-generated content faces a higher likelihood of being in scope than a software company selling solutions to banks under an outsourcing contract. This classification must be done by legal assessment on the concrete business model; it cannot be inferred from the fintech label.
Layer two: outbound transfers under personal data law
Even where the Cybersecurity Law storage group does not apply, a fintech must still comply with Law on Personal Data Protection 91/2025/QH15 and Decree 356/2025/ND-CP when transferring Vietnamese users’ personal data abroad, including placing data on overseas cloud infrastructure. The central duty is preparing an impact assessment dossier for outbound transfer of personal data and filing it with the specialised authority as required, with proportionate data protection measures.
Beyond these two layers, financial transaction data also carries document and data retention duties for anti-money laundering, audit and dispute purposes under the banking framework. A workable data architecture is often hybrid: data under mandatory storage and sensitive data sit in Vietnam, while anonymised or de-identified analytics data is processed abroad under the impact assessment dossier already prepared.
Penalties and designing compliance from the start
Breaching storage and transfer duties can lead to administrative fines under the cybersecurity and data protection frames, orders to stop unlawful outbound transfers, and in serious cases effects on the ability to keep providing the service. For a fundraising fintech, the data compliance file is also an increasingly scrutinised due diligence item, so a breach at this layer costs far more than the fine.
Compliance design should start with a data map: list every data type the company collects, its current storage location, every outbound transfer flow and the legal basis for each flow. From that map the company decides which data moves to storage in Vietnam, which flows need an outbound transfer impact dossier, and updates its privacy policy and infrastructure provider contracts accordingly. Mapping data after the system is live always costs multiples of designing it at the architecture stage.
Frequently Asked Questions
Must fintech companies store data in Vietnam?
It depends on the specific service. Enterprises providing services in the group defined by Article 26 of Law on Cybersecurity 24/2018/QH14 and Decree 53/2022/ND-CP must store in Vietnam data on personal information of users in Vietnam, user relationships and user-created data. A fintech purely supplying software to banks under a service contract may fall outside that group, but classification needs a legal assessment on the concrete model.
Which data must be stored domestically?
The central data types are personal information data of service users in Vietnam, data on users’ relationships on the service and data created by users, under Article 26 of Law on Cybersecurity 24/2018/QH14. For financial activity, transaction data and customer files must additionally be retained under banking and anti-money laundering requirements, independently of the cybersecurity layer.
Can data be stored on foreign cloud services?
Yes, with conditions. Placing data on foreign cloud infrastructure is a form of outbound personal data transfer, governed by Law on Personal Data Protection 91/2025/QH15 and Decree 356/2025/ND-CP, including preparing an outbound transfer impact assessment dossier where required. Data under mandatory in-country storage under the Cybersecurity Law cannot be held only abroad.
What are the penalties for violations?
Violations can draw administrative fines under the cybersecurity and personal data protection frames, orders to end unlawful outbound transfers and duties to remediate the storage architecture. A foreign enterprise required to maintain a presence in Vietnam that fails to do so can face measures directly affecting service provision. Remediation after detection always costs more than designing correctly from the start.
Bottom line for fintech data architects
A fintech’s data storage duty in Vietnam is the sum of the cybersecurity and personal data layers, plus banking retention requirements. The right answer for each company appears only after a data map exists; any yes or no asserted before that map is a risky guess.