Vietnam Tightens Cybersecurity Rules, Orders Tech Firms To Store Data Locally
The data must be stored for at least 24 months, and system logs for criminal investigation purposes must be stored for at least 12 months. | Source: Tin Phung for Vietcetera
In a move to strengthen the regulations in cybersecurity, the Vietnamese government has recently released a decree requiring foreign technology firms to set up local offices and store their users’ data within Vietnamese territory, taking effect on October 1.
The said decree adds specific terms to the country’s existing Cybersecurity Law. It detailed the data captured by tech giants like Google and Meta belonging to and created by users in Vietnam, including account names, credit card info, email and IP addresses, service use time, most recent logins, and registered phone numbers, which must be stored within Vietnam. This includes international firms that provide telecommunication services, store and share online data and perform Internet transactions.
“Data of all internet users ranging from financial records and biometric data to information on peoples’ ethnicity and political views, or any data created by users while surfing the internet must be stored domestically,” the decree stated.
Moreover, information about users’ relationships, including friends and groups that users interact with online, also need to be stored domestically, according to Thu Vien Phap Luat, a website that stores legal documents in Vietnam.
Following the decree, it will grant authorities the right to issue data collection requests for purpose of investigation as well as ask service providers to remove content if it is deemed to violate the government’s guidelines.
The data must be stored for at least 24 months, and system logs for criminal investigation purposes must be stored for at least 12 months. At the same time, firms must complete data storage requirements and set up local offices within 12 months of being asked to do so by the Ministry of Public Security.
Vietnam’s Cybersecurity Law, which took into effect in 2019, bans Internet users from organizing, encouraging, or training other people for anti-state purposes. Users are also prohibited from distorting history, negating the nation’s revolutionary achievements, undermining national solidarity, offending religions, and discriminating on the basis of gender and race.
In addition, the law also forbids the dissemination of incorrect information, which causes confusion among people, damages socio-economic activities, creates difficulties for authorities and those performing their duty, and violates other organizations’ and individuals’ legal rights and benefits.