Must FDI enterprises store data in Vietnam? Current requirements

Not every FDI enterprise must place servers in Vietnam, but the group providing services over telecommunications networks and the internet to Vietnamese users carries a clear data localisation duty in the Cybersecurity Law. The right question is not whether FDI in general must store data domestically, but whether one’s own enterprise falls into the subjects and data types that Article 26 of this law targets.

Subjects and data types that must be stored domestically

Article 26 of Cybersecurity Law 24/2018/QH14 requires domestic and foreign enterprises providing services over telecommunications networks, the internet and value-added services in cyberspace in Vietnam to store in Vietnam data comprising personal information of service users in Vietnam, data on relationships of service users, and data created by service users in Vietnam. Decree 53/2022/ND-CP details the scope of services and data in this class.

For FDI that means a purely manufacturing company with global internal systems does not automatically fall under Article 26 localisation, while an e-commerce company, social network, cloud service for Vietnamese customers or consumer application with Vietnamese users almost certainly does. The trigger is a service directed at users in Vietnam collecting and generating the listed user data, not the enterprise’s foreign capital ratio.

Local presence and storage duration

The same Article 26 of the Cybersecurity Law sets a presence requirement: foreign enterprises in the regulated class must place a branch or representative office in Vietnam in statutory cases, tied to services of a certain scale and character. Minimum storage periods in Vietnam are set by Decree 53/2022/ND-CP by data type, and the enterprise must ensure the ability to retrieve and provide data to competent authorities upon lawful request for cybersecurity purposes.

Localisation does not mean a ban on moving data abroad: the enterprise may still back up and process overseas for global operations, but the regulated data copy must exist and be retrievable in Vietnam, while cross-border transfer of personal data must satisfy the frame of Personal Data Protection Law 91/2025/QH15 and Decree 356/2025/ND-CP, including transfer impact assessment files in many cases.

Violation handling and a self-assessment for FDI

Breaching the data storage and local presence duties is handled under penalty decrees in cybersecurity and telecommunications and internet fields, with measures possibly including fines and orders to remediate the data architecture. The larger practical risk is operational: being ordered to produce data that cannot be retrieved in Vietnam, or being assessed non-compliant when regulators review large online services, are situations that genuinely disrupt business.

A practical self-assessment for an FDI enterprise has three steps: determine whether it provides Article 26 services to Vietnamese users; map which user data types are created and where they sit in the global architecture; and design a domestic storage node for the regulated data portion, together with cross-border transfer files under the personal data protection law. Doing these three steps before being asked is far cheaper than re-architecting a system under pressure from a regulator’s request.

Frequently Asked Questions

How does cybersecurity law require FDI companies to store Vietnamese user data?

Yes, if the enterprise falls under Article 26 of Cybersecurity Law 24/2018/QH14: enterprises providing services over telecommunications networks and the internet in Vietnam must store in Vietnam data comprising personal information of users in Vietnam, data on user relationships, and data created by users in Vietnam. A purely manufacturing FDI enterprise not providing such services to Vietnamese users does not automatically fall in this class.

What data must be stored in Vietnam?

The three data groups to be stored in Vietnam under Article 26 of the Cybersecurity Law and Decree 53/2022/ND-CP are: personal information of service users in Vietnam; data on relationships of service users in Vietnam; and data created by service users in Vietnam on the service. The services in scope and minimum storage periods per group follow the detailed guidance of Decree 53/2022/ND-CP.

Can data be stored only on overseas servers?

An enterprise may back up and additionally process overseas, but overseas servers cannot substitute the storage duty in Vietnam: for data within Article 26 of the Cybersecurity Law, a copy of the data must exist and be retrievable domestically. The common compliant model places a domestic storage node for the regulated data portion, synchronised with the global system, while completing cross-border personal data transfer impact assessment files under Personal Data Protection Law 91/2025/QH15 and Decree 356/2025/ND-CP when data moves abroad.

What happens if local storage is not done?

Failure to meet the domestic data storage and presence duties draws administrative fines under penalty decrees in cybersecurity, telecommunications and internet fields, with remediation orders. Operationally, the enterprise also faces the risk of being ordered to produce data for cybersecurity purposes that cannot be retrieved domestically, and of non-compliance findings in online service reviews, disrupting business far beyond the fine amount.

Bottom line for FDI holding Vietnamese user data

The Vietnam data storage duty targets services and user data, not capital nationality. Any FDI providing online services to Vietnamese users should check itself against Article 26 of the Cybersecurity Law at the data architecture design stage, because localisation built afterwards always costs more than localisation designed in from the start.