Vietnam’s new rules requiring foreign tech companies to store user data in the South-East Asian country impose a “significant burden” and may affect investments, US business groups said in a letter to Prime Minister Pham Minh Chinh.
The letter was posted on Sept 9 and signed by the US Chamber of Commerce and the American Chambers of Commerce in Vietnam along with the Asia Internet Coalition, which includes Amazon, Google and Meta. They say rules make it difficult for companies to accurately assess the cost of doing business in Vietnam.
“These obligations are a significant burden on affected enterprises and may have considerable impact on the investment and business climate in Vietnam,” it reads. The wording of certain clauses is “ambiguous and creates uncertainty as to what compliance actions are necessary”.
The push from the US groups comes as South-East Asia’s fastest-growing economy looks to bolster its appeal as a destination for foreign investment amid trade and geopolitical tensions between America and China.
The new rules, unveiled last month, are expected to take effect on Oct 1 and cover tech companies as well as telco operators and data storage providers. These firms have to store personal data in the country for at least 24 months, including credit card information, email addresses, recent logins, phone numbers and the groups that users interact with.
The companies will have 12 months to set up local data storage once given instructions from the Minister of Public Security. The rules will apply to companies if the services they offer are used in activities that violate Vietnam’s cybersecurity regulations and adequate measures are not taken to contain these issues.
The Communist Party runs Vietnam with tight media censorship and has clamped down on the Internet over the past few years. This started with a cybersecurity law in 2019 and has moved to guidelines on social media last year.
Vietnam’s Ministry of Foreign Affairs as well as Google and Facebook didn’t immediately respond to requests for comments over the letter.
The decree will help set out “legal bases” from which local authorities to take action against illegal activities in cyberspace such as take down requests and requesting data disclosure, said Manh-Hung Tran, Partner & Head of IPTech Practice of Baker McKenzie Vietnam.
“It is reasonable to expect that Vietnamese authorities will be more active in their cybersecurity enforcement efforts once it takes effect,” he said. – Bloomberg