Chinese tech companies operating in Vietnam — must they locate servers in Vietnam? From July 1, 2026, the Cybersecurity Law 116/2025/QH15 fully replaced the 2018 Cybersecurity Law, bringing an entirely new data storage obligation framework. This article updates what Chinese tech companies must know.
1. New Legal Framework from July 1, 2026
| Regulation | Effective | Role |
|---|---|---|
| Cybersecurity Law 116/2025/QH15 | July 1, 2026 | Replaces the 2018 Cybersecurity Law + 2015 Network Information Security Law |
| Decree 333/2026/ND-CP | August 19, 2026 | Detailed guidance (data storage) |
| Personal Data Protection Law 91/2025/QH15 | January 1, 2026 | Cross-border personal data transfers |
| Data Law 60/2024/QH15 | July 1, 2025 | Core/important data |
Critical warning: the 2018 Cybersecurity Law and Decree 53/2022/ND-CP expired on July 1, 2026. Any material still citing them as current authority is outdated.
2. Who Must Store Data in Vietnam?
The data storage obligation does not apply blanket-wide to all tech companies. It arises when an enterprise (domestic or foreign):
- Provides services on telecommunications networks/the Internet/value-added services in Vietnam; and
- Collects, exploits, analyzes, or processes data on personal information, data created by Vietnamese users, or data on Vietnamese users’ relationships.
For foreign enterprises, the obligation is tied to a written request from the Ministry of Public Security — a “trigger” mechanism, not automatic application.
3. Three Data Groups Subject to Storage
- Data on personal information of service users in Vietnam.
- Data created by users in Vietnam (account names, usage time, emails, IP addresses, phone numbers…).
- Data on relationships of users in Vietnam.
The storage form is at the enterprise’s discretion (domestic data centers, local cloud…).
4. Establishing Branches/Representative Offices
Foreign enterprises in regulated sectors may be required to establish a branch or representative office in Vietnam when their services are used to commit cybersecurity violations, they have been notified and asked to cooperate, but fail to comply fully.
5. Second Layer: Cross-Border Personal Data Transfers
In parallel with storage, Chinese tech companies must comply with the Personal Data Protection Law 91/2025:
- Transferring Vietnamese users’ personal data to servers in China → must prepare an impact assessment dossier and submit it to the specialized authority within 60 days (Article 20).
- Penalties up to 5% of prior-year revenue (Article 8).
This is the biggest risk point for the “servers in China serving Vietnamese users” model.
6. Third Layer: Core/Important Data
Under the Data Law 60/2024, if data falls into the core/important data groups (per the Prime Minister’s List), cross-border transfers face stricter conditions. Companies must classify their data before designing storage architecture.
7. Checklist for Chinese Tech Companies
- Review whether your services fall within scope.
- Classify data being processed (personal / core / important).
- Assess current storage architecture (where are the servers?).
- Prepare cross-border transfer impact assessments (if applicable).
- Monitor written requests from the Ministry of Public Security.
- Check whether business lines are conditional (Appendix IV, Investment Law 143/2025) when establishing an entity in Vietnam.
Note: This article summarizes current regulations for reference. Detailed article numbers of Law 116/2025 and Decree 333/2026 should be verified against the Official Gazette. For specific cases, consult professionals.
Transparency: This article was researched and drafted by the AI Legal Council from original legal texts, through independent cross-checking. Content is for reference only and does not replace legal advice from a licensed lawyer.