How are Foreign Investors Responding to Vietnam’s New Data Localization Regulation

Vietnam’s new data localization regulation requires domestic and certain foreign companies to locally store personal data. It is unclear how the regulation can be enforced without reneging on its pledge against forced data localization as part of the CPTPP trade agreement. The announcement has rattled business groups and trade partners.

Vietnam will introduce a new law on October 1, mandating that all domestic companies and certain foreign firms providing services in areas like telecommunications, e-commerce, and online payment will have to store specific types of data in-country for a minimum period of 24 months.

The new rules were unveiled in August and require firms to locally store personal data, including credit card information, email addresses, recent logins, phone numbers, and the groups users interact with. The regulation has been met with opposition from business groups, notably those from the United States, as well as Vietnam’s Pacific free trade partners.

US business groups warn that the new regulation will create uncertainty and could have a “considerable impact” on investment. Vietnam has emerged as a popular investment destination amid rising geopolitical tensions between the West and China. The Southeast Asian country – known for its beaches, rivers, Buddhist pagodas, and bustling cities – offers low labor costs, international market access, and less political risk than neighboring manufacturing powerhouse, China.

International firms will have 12 months to ensure that they comply with the new regulations once instructions are received from the Minister of Public Security. Vietnam’s Communist Party has particularly strict media censorship laws and has enacted regulations to increase its oversight in the internet domain – this started with a cyber security law in 2019 and moved forward in 2021 with guidelines on social media.

What’s in the new regulations?

The measures were unveiled within Decree 53/2022/ND-CP (Decree 53) can be summarized in the three following areas:

• Owners of information deemed important are required to, among others, (a) provide certain prescribed information to the relevant government authorities, and (b) comply with prescribed security measures.
• The degree provides authorities with the power to require companies to take certain measures – such as deleting data, providing authorities with data, and suspension of domain names – when the law has been violated, or if there is an infringement of national security, social order, and safety.
• Domestic companies, and certain foreign companies providing specified services (e.g., telecommunications, e-commerce, online payment), will have to store specific types of data in Vietnam for a minimum period of 24 months. System logs relating to violations of the law must be stored for at least 12 months. Foreign companies impacted by the regulatory changes are also required to set up a branch or representative office in Vietnam.

Man-Hung Tran, partner and head of Baker McKenzie Vietnam’s IPtech practice, told Bloomberg that the decree will help establish a “legal basis” from which local authorities can take action against illegal activities in cyberspace.

The nature of the law has similarities to those introduced in China in an effort to crack down on dissenting activity, especially online. Discussing Vietnam’s new regulation, law firm Tilleke & Gibbins said that offenses include “content that infringes national security, propagandizes against the state; incites violence; disrupts security or public order; is humiliating or slanderous” or damages the economy.

Speaking to Bloomberg, Man-Hung Tran contended that “it is reasonable to expect that Vietnamese authorities will be more proactive once their cybersecurity enforcement efforts take effect.”

How will this impact business and investment?

Although there remains some ambiguity around the law and its enforcement, Decree 53 provides more explicit guidelines by specifying 10 types of services that are subject to the data localization requirements. The 10 businesses/services of foreign enterprises subject to storage of regulated data in Vietnam are:

• telecom services;
• services of data storage and sharing in cyberspace (cloud storage);
• supply of national or international domain names to service users in Vietnam;
• e-commerce;
• online payment;
• intermediary payment;
• service of transport connection via cyberspace;
• social networking and social media;
• online electronic games; and
• services of providing, managing, or operating other information in cyberspace in the form of messages, phone calls, video calls, email, or online chat.

It also provides the triggering conditions that lead to foreign enterprises being required to store regulated data and establish a branch or representative office in Vietnam. Operating in one of the above services is the first trigger. The second is being warned by the Department for Cybersecurity and Prevention of High-Tech Crime (A05) under the Ministry of Public Security (MPS) that the services it provides have been used to commit a breach of the law on cybersecurity.

In short, the regulation is likely to create unwanted costs for businesses associated with data localization and setting up representative offices.

Opposition from US business groups

US business groups have raised concerns that the new regulation could have a “considerable impact” on investment. In a joint letter to Prime Minister Pham Minh Chinh, the US Chamber of Commerce, the American Chamber of Commerce Hanoi, and the Asia Internet Coalition contended that the new regulation would make it impossible for companies to accurately assess the cost of doing business in Vietnam.

FIND BUSINESS SUPPORT

We can help with data localization requirements

The groups requested, in their letter, that the government provide more detailed guidance on the interpretation of the regulation. “The wording of certain articles/clauses…is ambiguous and creates uncertainty as to what compliance actions are necessary,” the letter reads.

BSA – a global software trade body funded by Amazon Web Services, Siemens, and others – concurred with the US business groups’ concerns. The trade body said that the decree would put companies at a competitive disadvantage, impairing their ability to choose vendors and find clients.

“Data localization does not improve the security or availability of data to customers or law enforcement,” Jared Ragland, BSA Asia-Pacific policy senior director, told Nikkei Asia. Ragland added that the new regulations enhanced the risk that “companies will shift to other regional markets with more welcoming policies.”

A challenge for the CPTPP

Concerns have also been raised by trade partners, including Japan and Canada, both of which, along with Vietnam, are members of the Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP).

“Canada continues to urge Vietnam to implement its laws and regulations applicable to the transfer and storage/processing of data in a manner that is consistent with its commitments in Chapter 14: Electronic Commerce of the [CPTPP]”, Global Affairs Canada Spokesperson Lama Khodr said in an email correspondence with Nikkei Asia. Khodr added that Ottawa is “following the issue.”

Meanwhile, the Japanese government has also highlighted that the CPTPP trade deal – a free trade agreement between 11 countries (12 should the UK’s accession proceed as planned) –  prohibits data localization and has already “expressed concerns” about the original cyberlaw.

“The Japanese government will keep our close watch on the consistency between the Law on Cybersecurity and Vietnam’s obligations under relevant international agreements, including CPTPP and RCEP,” the Ministry of Economy, Trade and Industry told Nikkei Asia.

Compromising Vietnam’s unique opportunity

Amid growing tensions between Beijing and the West, Vietnam has emerged as an alternative to China as a foreign direct investment destination, particularly around manufacturing. Risks associated with investing in China, especially for manufacturing operations, have become heightened since the start of the trade war with the US in 2018. Concerns have grown in 2022 with Beijing refusing to cut ties with Russia despite its invasion of Ukraine.

Vietnam is an attractive investment destination for companies with a China footprint seeking to diversify their supply chains. Unlike China, Vietnam is a member of the CPTPP free trade pact but offers comparable or even lower labor costs and low material costs in addition to a fast-growing domestic market. The country’s abundant and young workforce is another key appeal.

However, policy moves such as the introduction of data localization laws are likely to detract from this attractiveness, especially as other contenders emerge in the region. There are clear concerns about how the measures will impact the cost of doing business in Vietnam, but equally Western organizations may also be wary of increasing state powers to crack down on dissenting voices.  

• Previous Article How to Set Up an NGO in Vietnam
• Next Article US Presidential Envoy Visit to Vietnam Underlies Cooperation on Climate Change Issues