The Ministry of Information and Communications ('MIC') announced, on 17 August 2022, the signing by the Deputy Prime Minister, Vu Duc Dam, of Decree No. 53/2022/ND-CP Detailing Some Articles of Network Security Law. In particular, the MIC highlighted that the Decree requires the regulation of data storage, and that data which must be stored in Vietnam includes, among other things, data about the personal data of service users in Vietnam, data created by service users in Vietnam, and data on the relationship of service users in Vietnam. More specifically, the MIC outlined that the Decree specifies the orders and procedures for requesting data storage, and setting up representative branches or offices in Vietnam.

Although the MIC noted that the Decree permits the form of data storage to be decided by the enterprise in questions, the Ministry of Public Security will notify, guide, monitor, supervise, and urge enterprises in complying with data storage requirements. Further, the MIC detailed that the Decree provides that the Minister of Public Security will issue a decision requesting the storage of data, and that the storage period starts from the time enterprises receive a request until the end of the request, with a minimum storage period of 24 months. In addition, the MIC provided that the Decree requires system logs that serve the investigation and handling of violations of Section 26 of the Law on Cybersecurity No. 24/2018/QH14 to be stored for a minimum of 12 months.

Finally, the MIC stated that the Decree will come into effect on 1 October 2022.

You can read the announcement here and the Decree here, both only available in Vietnamese.