Cloudy with a chance of compliance: Vietnam’s regulations for foreign cloud computing providers

1. The Vietnamese Cloud Computing Landscape

Vietnam's cloud computing market has been expanding exponentially, driven by digital transformation initiatives across various sectors. According to Research and Markets, Vietnam’s data centre market is expected to grow at a CAGR of 10.68 per cent between 2022 and 2028, increasing from $561 million in 2022 to $1.037 billion by 2028. This growth presents lucrative opportunities for foreign cloud providers, but it also comes with a complex regulatory framework designed to protect national interests and data security.

2. Key Regulatory Bodies and Laws

Several government entities play pivotal roles in shaping and enforcing cloud computing regulations in Vietnam:

• Ministry of Information and Communications (MIC)

• Ministry of Public Security (MPS)

• Vietnam Computer Emergency Response Team (VNCERT)

The primary laws and decrees governing cloud services in Vietnam include:

• Law on Investment (2020): Classifies data center services as conditional services, establishing a legal framework for cloud computing investments.

• Law on Information Technology (2006): Outlines general provisions for information technology, including service provider responsibilities for information security and user data protection.

• Law on Cybersecurity (2018): Mandates online service providers to ensure user data security and comply with cybersecurity standards.

• Decree No. 72/2013/ND-CP: Governs internet services and online information management, with provisions relevant to cloud services.

• Decree No. 53/2022/ND-CP: Provides detailed guidance on the Cybersecurity Law, enhancing the regulatory framework for online activities and data protection.

• Draft Telecoms Law (Amendment): Aims to create a comprehensive regulatory framework for data center and cloud computing services, proposing a registration system for service providers.

• Decree No. 13/2023/ND-CP: Focuses on personal data protection, outlining rights and obligations for organizations handling personal data.

3. Key Regulatory Requirements for Foreign Cloud Providers

3.1 Licensing and Registration

Foreign cloud providers must obtain appropriate licenses and registrations to operate in Vietnam (Point a, Clause 2, Article 29 and Article 41 of the Telecommunications Law). This process often involves partnering with local entities and demonstrating compliance with Vietnamese laws. 

3.2 Data Localization and Storage

One of the most significant requirements is data localization. The Cybersecurity Law mandates that certain types of data must be stored within Vietnam's borders. This includes:

• Personal data of Vietnamese users

• Data generated by Vietnamese users

• Data concerning Vietnamese users' relationships

Foreign providers must establish data storage and processing centers within Vietnam to comply with these regulations (Article 26 of Decree 53/2022/ND-CP guiding the Law on Cyber ​​Security).

3.3 Cybersecurity Compliance

According to Article 41 of the Law on Cyber ​​Security, Cloud providers must implement robust cybersecurity measures, including:

• Regular security audits

• Incident response plans

• Cooperation with Vietnamese authorities on cybersecurity matters

3.4 Privacy and Data Protection

While Vietnam lacks a comprehensive data protection law, various regulations govern data privacy. Cloud providers must ensure:

• Proper consent mechanisms for data collection and processing (Clause 2, Article 11 of Decree 13/2023/ND-CP)

• Adequate data protection measures (Article 26 to 28 of Decree 13/2023/ND-CP)

• Compliance with cross-border data transfer restrictions (Articles 24 and 25 of this Decree)

4. Challenges and Considerations for Foreign Providers

Foreign cloud providers face several challenges in the Vietnamese market:

• Navigating the complex and sometimes ambiguous regulatory environment

• Balancing global operations with local requirements

• Potential restrictions on certain types of data or services

• Competition from local providers who may have an easier time complying with regulations

5. Strategies for Compliance and Success

To thrive in Vietnam's cloud computing market, foreign providers should consider the following strategies:

5.1 Partnering with Local Firms

Collaborating with Vietnamese companies can help navigate regulatory complexities and meet local partnership requirements.

5.2 Investing in Local Infrastructure

Establishing data centers and other infrastructure within Vietnam demonstrates a commitment to the market and facilitates compliance with data localization laws.

5.3 Engaging with Regulatory Bodies

Proactively communicating with Vietnamese authorities can help clarify regulatory requirements and build trust.

5.4 Customizing Services for the Vietnamese Market

Tailoring cloud offerings to meet specific local needs and regulatory requirements can provide a competitive edge.

6. Future Outlook

Vietnam's cloud computing regulations are likely to evolve as the market matures. Potential changes on the horizon include:

• More detailed implementation guidelines for existing laws

• Increased focus on AI and emerging technologies

• Possible easing of some restrictions to attract foreign investment

Despite regulatory challenges, the growth prospects for compliant foreign providers in Vietnam remain strong. The country's digital economy is projected to reach $52 billion by 2025, with cloud services playing a crucial role in this expansion.

Conclusion

Navigating Vietnam's cloud computing regulations requires careful planning, local partnerships, and a commitment to compliance. While the regulatory landscape presents challenges, it also offers significant opportunities for foreign providers who can successfully adapt to local requirements. By staying informed, engaging with local stakeholders, and demonstrating a commitment to Vietnam's digital development, foreign cloud providers can position themselves for success in this dynamic market.

For foreign cloud computing providers looking to enter or expand in the Vietnamese market, seeking expert legal advice and staying updated on regulatory changes is crucial. With the right approach, the clouds over Vietnam's regulatory landscape can part to reveal a bright horizon of opportunities.