Vietnam’s rapid digital transformation has positioned it as an emerging hub for data center investments, fueled by surging demand for data storage, processing, and cloud services across industries. As the country embraces the Fourth Industrial Revolution, its government has prioritized data centers as a critical infrastructure component, introducing a robust and evolving legal framework to regulate this sector. This blog article provides an in-depth exploration of Vietnam’s data center regulations, offering detailed insights into market entry, licensing, real estate, environmental compliance, data protection, and more—essential knowledge for investors and operators aiming to capitalize on this fast-growing market.
Vietnam’s Strategic Vision for Data Centers
The Vietnamese government has made data centers a linchpin of its digital economy strategy, recognizing their role in supporting cloud computing, artificial intelligence, and other advanced technologies. Under the Law on Investment 2020 and the Prime Minister’s Decision 38/2020/QD-TTg, data centers are classified as a high-priority technology sector, eligible for investment incentives and development support. This classification reflects a broader ambition to enhance Vietnam’s technological competitiveness, as outlined in Decision 2117/QD-TTg, which designates cloud computing—a key enabler of data center operations—as a critical area for research and application. By fostering a supportive policy environment, Vietnam aims to attract both domestic and foreign investment, positioning itself as a regional leader in digital infrastructure.
This proactive stance is not merely rhetorical. The government has backed its vision with actionable policies, including tax breaks, streamlined approval processes, and infrastructure development in industrial zones and high-tech parks. However, this encouragement comes with a caveat: a complex web of regulations that businesses must navigate to ensure compliance while maximizing opportunities.
The Legal Framework: A Multi-Layered Regulatory Ecosystem
Data centers in Vietnam are formally regulated under the Law on Telecommunications No. 24/2023/QH15, effective July 1, 2024, which defines them as telecommunications facilities designed to process, store, and manage data for multiple users. “Data center services” are categorized as value-added telecommunications services under Decree 163/2024/ND-CP, involving the leasing of these capabilities over telecom networks. This legal recognition marks a significant step in formalizing the sector, but it’s just one piece of a broader regulatory puzzle. Key laws and decrees include:
- Law on Cybersecurity (2018) and Law on Network Information Security (2015): These govern data protection, network safety, and cybersecurity compliance.
- Law on Data (2024): Introduced in November 2024, this law sets stringent standards for handling “Core Data” (e.g., national security-related information) and “Critical Data” (e.g., data impacting public health or social stability).
- Land Law (2024): Regulates land use rights and real estate considerations for data center construction.
- Decree 147/2024/ND-CP: Addresses content security and the removal of illegal digital content.
- Circular 03/2013/TT-BTTTT (amended 2023): Establishes technical standards for data center infrastructure, such as fire safety and lightning protection.
This multi-layered framework reflects Vietnam’s dual focus on fostering innovation and safeguarding national interests, particularly in areas like data privacy and cybersecurity. For businesses, understanding these interconnections is crucial to avoid regulatory pitfalls.
Market Entry Options: Flexibility for Foreign Investors
Foreign investors eyeing Vietnam’s data center market have several entry options, shaped by the Investment Law, Telecoms Law, and Vietnam’s WTO commitments:
- Wholly Foreign-Owned Entities (FIEs): Investors can establish a 100% foreign-owned company, offering full control over operations. This option suits those seeking independence but requires navigating Vietnam’s investment approval processes.
- Joint Ventures: Partnering with a Vietnamese enterprise through capital contributions or share purchases is another route. Notably, there’s no cap on foreign ownership, providing significant flexibility compared to other regulated sectors.
- Business Cooperation Contracts (BCCs): This allows collaboration with a local firm without forming a new legal entity, ideal for short-term projects or testing the market.
Each option has trade-offs. FIEs offer autonomy but demand greater upfront investment and compliance efforts, while joint ventures and BCCs leverage local expertise and networks but may involve shared decision-making. Investors must weigh these factors against their strategic goals and risk tolerance.
Approvals and Licensing: A Step-by-Step Process
Establishing and operating a data center in Vietnam involves a rigorous approval and licensing regime:
- Investment Registration Certificate (IRC) and Enterprise Registration Certificate (ERC): Issued by the provincial Department of Finance (formerly the Department of Planning and Investment), these certificates are foundational for foreign-invested entities. The IRC approves the investment project, while the ERC legalizes the business entity.
- In-Principal Investment Approval: Required for projects involving land allocation, leasing without auction, or land use conversion—common scenarios for data centers due to their real estate needs.
- M&A Approval: Necessary for acquiring stakes in existing data center businesses, given the sector’s classification as a conditional investment area under telecom regulations.
- Telecom Service Registration: Providers must register with the Ministry of Science and Technology (MOST), submitting a detailed application (Form No. 25, Decree 163) that includes a technical plan for infrastructure safety and security. MOST typically reviews applications within three business days and issues a certificate within five, though delays can occur.
Post-registration, data centers must declare conformity with national technical standards (e.g., TCVN 9250:2021 or ANSI/TIA-942-B:2017). For higher-tier facilities (levels 3–4), third-party certification is mandatory, while lower tiers (1–2) allow self-assessment or optional external evaluation. This tiered approach balances flexibility with accountability, ensuring operational reliability.
Real Estate and Construction: Building the Foundation
Data centers require significant real estate and infrastructure investments, governed by the Land Law (2024) and Law on Construction (2024):
- Land Use Rights: Investors can lease land in industrial zones or high-tech parks, where infrastructure is pre-developed, or directly from local People’s Committees outside these areas. The latter requires alignment with national telecom and land use planning.
- Construction Permits: Issued by local authorities or park management, these are mandatory and contingent on compliance with technical standards, including:
- Fire Safety (QCVN 06:2021/BXD): Ensures buildings can withstand fire risks.
- Lightning Protection (QCVN 32:2020/BTTTT): Critical for protecting sensitive equipment.
- Grounding (QCVN 9:2016/BTTTT): Prevents electrical hazards.
These regulations underscore Vietnam’s emphasis on safety and resilience, particularly given the energy-intensive nature of data centers.
Operational – Connectivity and Sustainability
- Rental of In-Building Cable Networks: Governed by Circular 07/2024/TT-BTTTT, this regulates pricing for leasing telecom infrastructure within buildings. Prices are calculated using a formula incorporating construction costs, maintenance, and profit, ensuring transparency and preventing arbitrary pricing. This is vital for data centers relying on robust connectivity.
- Environmental Compliance: Data centers face stringent environmental requirements:
- Environmental Impact Assessments (EIAs): Mandatory for projects with moderate to high environmental risks, per the Law on Environment Protection.
- Energy Efficiency: Facilities consuming over 1,000 tons of oil equivalent (TOE) annually must adopt energy-saving measures and report consumption to the Ministry of Industry and Trade.
- Water and Wastewater Management: Cooling systems must comply with the Law on Water Resources, while wastewater must meet standards under QCVN 40:2011/BTNMT.
These mandates reflect Vietnam’s push for sustainable development, balancing economic growth with ecological responsibility.
Data Protection and Cybersecurity – Safeguarding the Core
Given their role in handling vast datasets, data centers must comply with Vietnam’s stringent data protection and cybersecurity laws:
- Decree 13/2023/ND-CP: Vietnam’s cornerstone personal data protection regulation, it mirrors GDPR principles like consent, transparency, and purpose limitation. It requires breach notifications to the Ministry of Public Security (MPS) within 72 hours and grants data subjects rights to access, delete, or restrict their data.
- Data Localization: The Cybersecurity Law and Decree 53/2022/ND-CP mandate that domestic firms—and certain foreign entities—store user data (e.g., personal info, usage logs) in Vietnam for at least 24 months. This applies to telecom, internet, and value-added service providers.
- Third-Party Processors: Permitted under Decree 13 with a contractual agreement ensuring security measures (e.g., appointing a Data Protection Officer, adopting technical safeguards). In banking, Circular 09/2020/TT-NHNN adds risk assessment requirements for outsourcing IT services.
- Government Access: Authorities can access data for national security or emergencies under Decree 53 and the Data Law, with formal procedures to protect data integrity. The draft decree guiding the Data Law further refines these processes.
- Enforcement: The MPS’s A05 Department and MOST conduct regular inspections, imposing fines up to VND 200 million (USD 8,200) or 5% of annual revenue, alongside suspensions or license revocations for violations.
These rules highlight Vietnam’s focus on data sovereignty and security, posing both challenges and opportunities for operators.
Content Security – Policing the Digital Realm
Under Decree 147/2024/ND-CP, data center providers must block or remove illegal content within 24 hours of a request from authorities like the Ministry of Public Security or MOST. This includes coordinating with regulators to suspend violators’ services, emphasizing the sector’s role in maintaining digital order.
Divestment – Exiting the Market
Investors looking to wind down or sell a data center can choose:
- Asset Transfer: Selling physical infrastructure or land use rights, potentially requiring government approval.
- Share/Stake Transfer: Executing an M&A transaction to offload ownership.
- Liquidation: A formal process involving debt settlement, contract termination, and deregistration.
Each method demands meticulous planning to comply with tax and regulatory obligations, ensuring a smooth exit.
Dispute Resolution – Resolving Conflicts
Vietnam offers multiple dispute resolution avenues:
- Negotiation and Mediation: Informal and cost-effective, with mediation supported by entities like the Vietnam International Commercial Mediation Center (VICMC).
- Arbitration: Popular for commercial disputes, especially foreign-related ones, via the Vietnam International Arbitration Center (VIAC).
- Court Litigation: Available through a tiered court system, from district to Supreme People’s Court.
These options provide flexibility, with arbitration often favored for its binding nature and international enforceability.
Opportunities Amid Complexity
Vietnam’s data center market is a land of opportunity, driven by government support, a growing digital economy, and strategic incentives. Yet, its regulatory complexity—spanning investment, real estate, environmental, and data protection laws—demands careful navigation. For investors and operators, success lies in mastering this framework, leveraging local partnerships, and aligning with Vietnam’s vision for a sustainable, secure digital future. As the sector evolves, staying ahead of regulatory updates will be key to thriving in this dynamic landscape.
Universal Smart Data Center Technology
For media inquiries or further information, please reach out to us at:
Phone: (+84) 28 73080708
Email: info@usdc.vn
