Legal handbook for investing in data centers in Vietnam

Legal Handbook for Investing in Data Centers in Vietnam 2026

Data center investment in Vietnam is entering a boom phase: the waves of artificial intelligence, cloud computing and domestic data-localization demand are pulling in a series of hundred-million-USD data center projects from both domestic and foreign investors. But behind the opportunity lies a multi-layered legal framework — telecoms, investment, land, personal data protection, cybersecurity — where any misstep can delay the project, inflate costs or trigger penalties.

This investing in data centers Vietnam legal guide systematizes the entire legal framework a foreign investor needs to grasp before committing capital to a data center in Vietnam, updated to September 2026: from the legal positioning of data centers under the Telecommunications Law, service-provision registration procedures, FDI investment procedures and investment incentive packages, to personal-data protection duties under the new Law effective 01/01/2026 and data-localization requirements in Vietnam.

Table of contents

• 1. The legal landscape at a glance: 5 pillars you cannot skip
• 2. Legal positioning: data centers as value-added telecom services
• 3. FDI investment procedures for data center projects
• 4. Investment incentives: data centers as the policy "star"
• 5. Personal data protection: new duties effective 01/01/2026
• 6. Cybersecurity and data-localization requirements in Vietnam
• 7. Power, construction, fire protection and environment: the technical "gates"
• 8. 10-step checklist for foreign investors
• 9. Common risks and how to prevent them
• 10. Frequently asked questions
• Conclusion

1. The legal landscape at a glance: 5 pillars you cannot skip

As this investing in data centers Vietnam legal guide maps out, a data center project in Vietnam is simultaneously governed by at least these 5 groups of instruments:

The biggest difference between data centers and ordinary FDI projects lies in pillar 1: from 01/01/2025, data centers and cloud computing were formally brought within telecom-law management. That means investors must not only complete investment procedures like an ordinary industrial project, but also satisfy telecom business conditions.

2. Legal positioning: data centers as value-added telecom services

2.1. From policy to specific rules

Right in Article 4 of the 2023 Telecommunications Law, the State sets the policy of enabling organizations and individuals of all economic sectors to participate in telecom investment and business to develop data centers and cloud computing in a sustainable, modern direction, forming digital infrastructure for the digital economy and digital society.

The 2023 Telecommunications Law (effective 01/7/2024) devotes Articles 28 and 29 to the provision of basic telecom services over the Internet, data center services and cloud computing services. Note the timing carefully: under Article 72(3) of the Law, Articles 28 and 29 take effect on 01/01/2025 — six months later than the Law's general effective date.

Decree 163/2024/ND-CP (issued and effective 24/12/2024, replacing Decree 25/2011/ND-CP) is the detailing instrument. It classifies data center services, cloud computing services and basic Internet-based telecom services (OTT) as value-added telecom services, and details registration and notification procedures for service provision. Under Article 84 of the Decree, the provisions on managing data center and cloud computing services take effect on 01/01/2025 — synchronized with Articles 28 and 29 of the Telecommunications Law.

2.2. Service-provision registration: the mandatory condition before operation

This is the most important legal requirement investors easily miss. Article 44(1) of Decree 163/2024/ND-CP is explicit: before providing data center services, an enterprise must register and be granted a Certificate of registration for telecom service provision.

Registration conditions (Article 44(2)) fall into two groups:

• Legal standing: holding an enterprise registration certificate or an investment registration certificate. For foreign investors, this means the investment registration (IRC) and enterprise registration (ERC) procedures must be completed before filing for telecom service registration.
• Technical plan: consistent with information-communication infrastructure planning; compliant with technical standards and regulations; ensuring telecom infrastructure safety, network information safety and information security.

In practice, the technical plan is the most preparation-intensive part of the dossier: investors must demonstrate the data center design meets technical standards on power, cooling, fire protection, information security and connectivity with national telecom infrastructure. Preparing the technical plan in parallel from the project design stage — instead of waiting until construction is done — materially shortens the time to commercial operation.

2.3. Notification for cloud computing service provision

Alongside registration, Article 45 of Decree 163/2024/ND-CP provides the notification procedure for telecom service provision before supply, applying to enterprises providing cloud computing services (plus certain others such as telecom OTT, email, voicemail, value-added fax).

The investor-friendly point: where cloud computing and data center services are provided together, no separate notification is needed — the enterprise only notifies information on the cloud service in the telecom service registration application on the form issued with Decree 163, and may provide cloud services after completing the filing of a valid registration dossier.

2.4. Cross-border service provision: notification mechanism, no commercial-agreement restriction

For global technology groups wanting to provide data center or cloud services from overseas infrastructure to users in Vietnam, Decree 163 requires foreign organizations to notify telecom service provision to the regulator (the Telecommunications Authority).

Notably: the general rule requiring cross-border telecom service provision to Vietnamese users to go through a commercial agreement with a licensed Vietnamese telecom enterprise does NOT apply to data center services, cloud computing services or basic Internet-based telecom services. This is a significant "open door", letting global cloud/data center providers access the Vietnamese market without being forced to partner with a domestic telecom operator — although in practice many groups still choose cooperation or direct infrastructure investment to optimize service quality and data-compliance duties.

3. FDI investment procedures for data center projects

3.1. Investment registration certificates under Investment Law 2025

Investment Law 2025 (Law No. 143/2025/QH15, passed 11/12/2025) takes effect 01/3/2026, replacing Investment Law 2020. Articles 7 and the conditional business lines list in Appendix IV separately take effect 01/7/2026.

For a foreign investor's data center project, the standard sequence is:

1. Propose and obtain investment policy approval (where required by scale or location, e.g. projects using land that requires land-use-purpose conversion under land law).
2. Investment Registration Certificate (IRC): the provincial investment registration authority or the management board of the industrial park / high-tech park (if the project sits inside one) is the receiving focal point. The dossier comprises the application document, investor legal-standing documents, the investment project proposal, financial capability report, and land-use demand proposal.
3. Enterprise registration (ERC): establishing the economic organization in Vietnam to implement the project.

Practical experience shows large data center projects are often sited in high-tech parks or high-tech industrial parks — such as the hyperscale data center complex in the Ho Chi Minh City High-Tech Park with registered capital of hundreds of millions of USD and tens of MW of designed capacity — because they simultaneously enjoy land, tax and ready technical-infrastructure (power, telecoms) incentives.

3.2. Land: the biggest bottleneck for data center projects

Data centers are land- and power-hungry: a hyperscale data center can need hectares of land and tens of MW of power capacity. Land legal issues to address early:

• Land-use form: land lease with one-off or annual payment; projects in high-tech parks or industrial parks sublease land from the infrastructure developer.
• Land-rental exemption/reduction: among the most valuable incentives for data center projects — some projects are exempted from land rental for the entire lease term (up to dozens of years) when all statutory conditions are met.
• Land-use and construction planning: the project location must fit planning; carefully check the regional grid's power-supply capability — a technical precondition that is also tied to state authorities' commitments during investment approval.

4. Investment incentives: data centers as the policy "star"

4.1. Added to the incentivized-sectors list

On 25/6/2025, the National Assembly passed Law No. 90/2025/QH15 amending 8 laws, effective 01/7/2025. Article 6(1) of this Law amends the incentivized sectors in Article 16 of Investment Law 2020, adding:

"Investment in building large data center infrastructure, cloud computing infrastructure, 5G-and-above mobile infrastructure and other digital infrastructure in strategic technology sectors per the Prime Minister's decision."

This is the first time data centers are named directly in the investment-incentive list at statute level. Investors should note the phrase "per the Prime Minister's decision" — the criteria for what counts as a "large data center" in a "strategic technology sector" will be detailed in the Prime Minister's documents; when preparing the incentive application dossier, cross-check the decision in force at procedure time.

4.2. Especially incentivized sector under the Digital Technology Industry Law

The Law on Digital Technology Industry No. 71/2025/QH15 (passed 14/6/2025, effective 01/01/2026) goes a step further. Article 21 provides that investment in building digital-technology-industry infrastructure is an especially incentivized sector, enjoying incentives and support under investment, tax, land and other relevant laws. Prioritized infrastructure includes research, design and pilot-production facilities for digital technology products and services; shared key laboratories; measurement and testing facilities; data centers; and concentrated digital-technology zones.

"Especially incentivized" classification opens the highest incentive framework under investment law: CIT incentives (preferential rates, time-bound exemption/reduction), land and water-surface rental exemption/reduction, and investment support as prescribed.

4.3. Special investment incentives and support for large-scale projects

Decree 96/2026/ND-CP guiding Investment Law 2025 details the special investment incentive and support mechanism. Under Article 21 of the Decree, eligible subjects include:

• New investment projects (including expansions) building large data center infrastructure, cloud computing infrastructure, 5G-and-above mobile infrastructure and other digital infrastructure in strategic technology sectors per the Prime Minister's decision: total investment capital of VND 3,000 billion or more, with at least VND 1,000 billion disbursed within 03 years from the IRC issuance or investment policy approval date.
• Projects building artificial intelligence data centers under the digital technology industry law: total investment capital of VND 6,000 billion or more, with at least VND 6,000 billion disbursed within 05 years.

The incentive levels and application periods for special CIT, land and water-surface rental incentives follow the 2025 Corporate Income Tax Law and land law.

At these capital thresholds, foreign investors' hyperscale data center projects can realistically target the special incentive package — but need a workable disbursement roadmap, because the minimum disbursement commitment over 3–5 years carries sanctions for non-performance.

5. Personal data protection: new duties effective 01/01/2026

5.1. The new legal framework

On 26/6/2025, the National Assembly passed Personal Data Protection Law No. 91/2025/QH15 — Vietnam's first statute-level instrument comprehensively governing this field — effective 01/01/2026. To guide implementation, on 31/12/2025 the Government issued Decree No. 356/2025/ND-CP detailing certain articles and implementation measures, replacing Decree 13/2023/ND-CP, also effective 01/01/2026.

For data center operators, this is the change with the most direct impact on the operating model, because data centers store and process huge volumes of customer data — including personal data.

5.2. Is the data center operator a "controller" or a "processor"?

The Law distinguishes two roles: the data controller (deciding processing purposes and means) and the data processor (processing data for the controller under a contract/agreement). In the usual colocation or cloud model, the customer renting server space (the controller) and the data center operator (the processor) only provides storage infrastructure without deciding processing purposes.

Whichever the role, the Law imposes core duties:

• Obtaining data subjects' consent before processing personal data (mainly for controllers, but processors must ensure their customers comply).
• Signing personal-data protection agreements with the processor — a duty striking directly at data center service contracts: every colocation, cloud or managed-hosting contract signed from 01/01/2026 should carry a standalone clause/agreement on personal data protection, allocating responsibility for leak or loss incidents.
• Designating a unit or person in charge of personal data protection, or hiring an organization or individual providing data protection services.
• Applying appropriate technical data-protection measures — for data centers this is a built-in strength (physical access control, encryption, network segmentation), but it must be institutionalized into demonstrable policies and procedures for inspection.
• Completing administrative procedures as prescribed, including personal-data processing impact assessments and procedures for cross-border personal data transfer.

5.3. Specific rules for big data, AI and cloud computing

A distinctive feature of the new framework is dedicated rules for certain special fields: labor management, finance–banking, advertising, online communications, big data processing, AI systems, virtual worlds, blockchain technology and cloud computing. Decree 356 has specified them — for example, when processing big data containing personal data, enterprises must comply with personal-data protection rules from the moment processing begins.

For data center investors serving AI (AI data centers), compliance duties are therefore "dual": both as infrastructure providers and tied to the big-data processing characteristics of AI customers. Practical recommendation: build the personal-data compliance framework from the service-design stage (privacy by design), rather than patching after signing large customers.

5.4. Sanctions: no longer "recommendations"

The new framework turns personal data protection from "recommendation" into mandatory legal duty, with severe penalties. According to public legal analyses, fines can reach 10 times the proceeds of the violation or 5% of revenue, with a minimum fine of VND 3 billion depending on the case — not to mention the risk of being ordered to suspend or restrict data processing, which directly hits data center operations. For an operating data center, suspension of data processing means paralysis of the entire business.

6. Cybersecurity and data-localization requirements in Vietnam

Since 01/07/2026 the cybersecurity legal framework has fundamentally changed: Cybersecurity Law 116/2025/QH15 replaces the 2018 Cybersecurity Law, and Decree 333/2026/ND-CP (issued and effective 19/08/2026) is the implementing instrument. Decree 53/2022/ND-CP retains only transitional value for dossiers validly received before 19/08/2026 that remain unresolved (Article 31 of Decree 333/2026/ND-CP). Investors must apply the new instruments, not the old rules as if still in force.

6.1. Which data must be stored in Vietnam?

Article 19 of Decree 333/2026/ND-CP identifies two data groups subject to in-Vietnam storage:

• Personal information data of service users in Vietnam;
• Data created by service users in Vietnam.

Compared with the former Decree 53/2022, the new instrument no longer keeps "data on users' relationships" (friends, connected groups, interactions) as an independent data group.

6.2. When are foreign enterprises ordered to localize and establish presence in Vietnam?

Decree 333/2026/ND-CP makes data storage and branch/representative-office placement in Vietnam not an automatic duty for every foreign enterprise. The duty arises only when all of the following conditions are met:

1. The enterprise operates in sectors within scope: telecom services; data storage and sharing in cyberspace; e-commerce; online payment; social networks; online games; online applications and certain other cyberspace services;
2. Its services are used to commit acts violating the cybersecurity law;
3. The competent authority has requested cooperation, prevention, investigation or handling but the enterprise fails to comply, complies incompletely, or obstructs;
4. A decision of the Minister of Public Security orders data storage and branch/representative-office placement in Vietnam.

Once the decision is issued, the enterprise has 12 months to complete data storage and place a branch/representative office. The storage form is for the enterprise to decide, but must ensure retrievability, timely provision upon competent-authority request, and information security per national technical standards and regulations.

However, for cross-border data center/cloud providers, proactively having a Vietnam data-storage plan (leasing a domestic data center, building own infrastructure) is prudent preparation — both to respond when ordered and as a competitive edge with Vietnamese corporate customers increasingly attentive to data sovereignty.

6.3. Retention periods

Under Decree 333/2026/ND-CP: the minimum data retention period is 24 months; the branch or representative office must be maintained until the enterprise ceases operations or no longer provides services within scope in Vietnam. System logs serving connection-session identification (IP address identification tied to subscribers/users) are retained at least 12 months. These timelines must be reflected in the data center's data retention policy.

6.4. Account authentication and violation handling (Article 16)

A key new feature of Decree 333/2026/ND-CP is the Article 16 duties on network information security, applying to both domestic and foreign enterprises providing services on telecom networks, the Internet and value-added cyberspace services in Vietnam:

• Account authentication: user information must be authenticated at digital-account registration; accounts are authenticated by a mobile phone number in Vietnam; where the user has no Vietnamese mobile number, authentication uses the personal identification number or another lawful electronic identification method. Users of livestream features for commercial purposes must be authenticated by personal identification number.
• Violation handling: upon request of the cybersecurity protection force under the Ministry of Public Security, the enterprise must restrict posting, prevent and remove violating information, and take down violating services or applications. Repeat-violating accounts may be restricted in display within Vietnam or temporarily locked: 3 or more violations in 30 days — up to 60 days; 10 or more in 90 days — up to 180 days; indefinite lock for acts infringing national security or after 3 or more temporary locks with continued violations.
• Response deadlines: information provision for network information security no later than 24 hours from receipt of the request (emergencies threatening national security or human life: 3 hours); restricting posting, preventing/removing information or taking down violating services/applications within 24 hours (emergencies threatening national security: 6 hours).

For data center operators these duties have direct practical meaning: systems must be able to authenticate users, keep violation history, retrieve information and respond within very short deadlines (3–24 hours) — requiring technical design and operating procedures built in from the start, not merely "policies on paper."

7. Power, construction, fire protection and environment: the technical "gates"

Beyond the 5 legal pillars above, data center projects must clear specific technical requirements — each tied to an administrative procedure:

• Power: data centers are large, 24/7 power loads. Connection agreements with the power utility are needed, assessment of regional grid supply capability, and backup power plans (generators, UPS). Large-capacity power purchase contracts should be negotiated in parallel with investment procedures.
• Construction: construction permits and work acceptance; designs must comply with national technical regulations on telecom works and data centers.
• Fire protection and fighting: data centers face strict fire-safety management — design appraisal and fire-protection acceptance are conditions for putting the works into use. Clean-agent suppression and early smoke detection are near-mandatory for server rooms.
• Environment: environmental impact assessment (EIA) or environmental registration depending on scale; hazardous waste management (batteries, backup-generator oil), noise.
• Network information security: besides the Cybersecurity Law, the data center's information systems may fall under graded security assurance — classification, grading of information-system security levels and corresponding protection plans are required.

8. 10-step checklist for foreign investors

1. Study the legal framework and choose the model: direct infrastructure investment, joint venture with a Vietnamese partner, or cross-border service provision — each model carries a different duty set (investment registration, telecom registration, cross-border notification).
2. Choose the location: high-tech parks, industrial parks or suitably planned areas; check power-supply capability, fiber connectivity, land-use planning.
3. Investment policy approval (where required) and Investment Registration Certificate issuance under Investment Law 2025.
4. Establish the enterprise and register the business in Vietnam.
5. Register telecom service provision (Certificate of registration for telecom service provision) under Article 44 of Decree 163/2024/ND-CP — prepare the technical plan early.
6. Notify cloud computing service provision (if providing cloud) under Article 45 — integrated into the registration dossier to avoid a separate procedure.
7. Complete land, construction, fire-protection and environmental procedures before installing equipment.
8. Build the personal-data and cybersecurity compliance framework: designate the data-protection lead, draft model personal-data protection agreements for customers, conduct processing impact assessments, and set a data retention policy (minimum 24 months for data covered by Article 19 of Decree 333/2026/ND-CP; system logs at least 12 months), plus account-authentication procedures and a process for responding to competent-authority requests within 3–24 hours under Article 16.
9. Register for investment incentives: tax and land incentives under incentivized/especially incentivized sectors; for large projects, prepare the special investment incentive and support dossier (VND 3,000 / 6,000 billion thresholds).
10. Operate with continuous compliance: periodic reporting to the telecom regulator, technical-plan updates on expansion, annual personal-data and cybersecurity compliance reviews.

9. Common risks and how to prevent them

• Missing the telecom registration procedure: many investors are used to the "build first, sort out later" model, but for data centers the Certificate of registration for telecom service provision is a precondition before commercial service. One late step can push back the entire launch schedule.
• Underestimating power requirements: the locality's power-supply commitment should be pinned down in writing during investment approval — avoid the "land but no power" trap.
• Customer contracts lacking data-protection clauses: from 01/01/2026, every colocation/cloud contract should carry a personal-data protection agreement clearly allocating controller/processor responsibilities.
• Confusing voluntary vs. ordered "data storage in Vietnam": proactively having a domestic storage plan keeps the company from scrambling upon receiving a Ministry of Public Security order.
• Not tracking new guiding documents: the data-center legal framework is evolving fast (Investment Law 2025, Decree 96/2026, Digital Technology Industry Law) — the "large data center" criteria and strategic-technology list may be further clarified in subordinate documents.

10. Frequently asked questions

Must data center investment in Vietnam register as a telecom service?

Yes. Under Article 44(1) of Decree 163/2024/ND-CP, before providing data center services an enterprise must register and be granted a Certificate of registration for telecom service provision. Conditions include: holding an enterprise registration or investment registration certificate, and a technical plan consistent with information-communication infrastructure planning, technical standards and regulations, ensuring telecom infrastructure safety, network information safety and information security. These provisions take effect 01/01/2025.

Can foreign investors hold 100% of a data center in Vietnam?

The current telecom legal framework sets no separate foreign-ownership cap for data center services as it does for some network-based telecom services. However, the project must comply with the full legal framework: investment registration under Investment Law 2025, telecom service registration under Decree 163/2024/ND-CP, and personal-data protection and cybersecurity duties. The specific ownership ratio also depends on Vietnam's international commitments and the registered business lines.

Do data centers enjoy investment incentives?

Yes — one of the most attractive points. Investment in building large data center infrastructure and cloud computing infrastructure in strategic technology sectors per the Prime Minister's decision has been added to incentivized investment sectors (Article 6(1), Law 90/2025/QH15). Law 71/2025/QH15 on the digital technology industry (Article 21) classifies investment in building digital-technology-industry infrastructure, including data centers, as an especially incentivized sector. For large projects (from VND 3,000 billion, with at least VND 1,000 billion disbursed within 03 years), investors may consider the special investment incentive and support mechanism under Article 21 of Decree 96/2026/ND-CP.

How does the 2026 Personal Data Protection Law affect data center operators?

Personal Data Protection Law No. 91/2025/QH15 takes effect 01/01/2026, with Decree 356/2025/ND-CP replacing Decree 13/2023/ND-CP. Data center operators typically act as data processors (or controllers, depending on the model) and must: sign personal-data protection agreements with controller customers; designate a unit or person in charge of personal data protection; apply appropriate technical data-protection measures; and comply with specific rules for big data, AI and cloud computing. Violations may be severely penalized under the Law and guiding documents.

Must a foreign company providing cross-border data center services into Vietnam register?

It has a notification duty. Under Article 45 of Decree 163/2024/ND-CP, foreign organizations providing cross-border data center or cloud services to users in Vietnam must notify telecom service provision. Favorably, the restriction requiring cross-border provision through a commercial agreement with a Vietnamese telecom enterprise does not apply to data center and cloud services. Also note the data-localization and branch/representative-office duties under Article 19 of Decree 333/2026/ND-CP (implementing Cybersecurity Law 116/2025/QH15, effective 19/08/2026) when ordered by the Minister of Public Security, plus account authentication and violation-handling duties within 3–24 hours under Article 16 of that Decree.

Conclusion

As this investing in data centers Vietnam legal guide shows, data center investment in Vietnam is a game for long-horizon investors with thorough legal preparation: the incentive framework ranks among the most attractive in current FDI policy (especially incentivized sector, special support packages for large projects), but it comes with multi-layered compliance duties — from telecom service registration, personal data protection under the new Law, to cybersecurity and technical requirements on power, fire protection and environment.

With experience advising foreign investors on technology infrastructure projects, our lawyers accompany investors from project structuring, investment approval and telecom service registration, through incentive negotiation, to building data-compliance frameworks and long-term operation.

For consultation: 0988424851 — FLAT LAW FIRM, the trusted legal partner of technology investors in Vietnam.