Legal Update - Data Center and Cloud Computing Services in Vietnam

Vietnam's data center and cloud service industry is experiencing strong growth, with increasing demand and foreign and domestic players eager to enter the market. Revenue in the Vietnamese data center and cloud markets is projected to reach US$1.73 billion¹ and US$710.4 million², respectively, in 2023. However, the lack of a solid legal framework in this area has caused difficulties for investors in their market entry and operations. The government's legislative efforts, which will be discussed in this article, may quickly change this situation.

The current legal framework for regulating data center and cloud computing services in Vietnam is relatively underdeveloped. Data center services are classified as conditional services under the Law on Investment 2020, but there is no specific legislation. A number of existing regulations, such as the Law on Information Technology 2006 and the Law on Cybersecurity 2018, briefly mention the liabilities of cloud hosting providers in ensuring information security, including the obligation to identify users, block or remove illegal hosted content, and/or terminate the services of violating users. Onshore companies are also subject to technical regulations and standards for constructing data centers, as set out in Circular No. 03/2013/TT-BTTTT of the Ministry of Information and Communications (MIC) (amended by Circular 23/2022/TT-BTTTT). These include national data center-telecoms technical infrastructure requirements (TCVN 9250:2021), national technical regulations on lightning protection for telecoms stations and outside cable networks (QCVN 32:2020/BTTTT), national technical regulations on earthing for telecoms stations (QCVN 9:2016/BTTTT), and national technical regulations on fire safety for buildings and structures (QCVN 06:2021/BXD).

Since 2022, the Ministry of Information and Communications (MIC) has been trying to consolidate the regulation of data center and cloud computing services through its Draft Law to amend the Law on Telecoms 2009 (Telecoms Law). The Draft Amendment to the Telecoms Law (“Draft Law”) was first released in October 2022 for public consultation and has since been revised significantly in response to industry feedback. For the first time, the Draft Law defines "data center services" (as services that provide information processing, storage, and retrieval features for users via telecoms networks by leasing part or all of a data center), "cloud computing" (as a model that allows flexible use, adjustment, and management of shared computing resources (network, server, storage device, application) according to needs), and "cloud computing services" (as services that provide information processing, storage, and retrieval features for users over telecoms networks through a cloud computing model) set out respectively in Articles 3.11, 3.12, and 3.13 of the Draft Law.

Despite the government's intention to regulate data center and cloud computing services with the Telecoms Law, these services are likely to be regulated less stringently than traditional telecoms services (such as telephone, data transmission, Internet connection, and Internet access). In the latest version of the Draft Law (released in September 2023), providers of data center and cloud computing services are only required to comply with registration and notification requirements. This is unlike traditional telecoms services, which are subject to service licenses with onerous conditions, procedures, and documentation. This regulatory approach is more progressive and business-friendly than that of the earlier versions of the Draft Law, which proposed subjecting data center and cloud computing services to telecom service licenses.

Specifically, "registration" under the Draft Law means that companies must self-declare information about their business and service type, and commit to ensuring that the provision of their services adheres to telecoms regulations and standards. Further, "Notification" means that companies must provide information about their business, service type, and service quality. These requirements will be elaborated in the government's Decree to guide the implementation of the new Telecoms Law.

Other significant obligations of data center and cloud computing providers under Article 29 of the Draft Law include:

(a) ensuring connectivity with telecoms providers;

(b) blocking access to illegally hosted information upon requests by competent authorities; and

(c) announcing service quality and conformity to applicable technical regulations and standards

Notwithstanding the less stringent approach in the regulation of data centers and cloud computing services, it is noted that  providers are nonetheless subject to general requirements imposed on telecoms service providers, including:

(a) ensuring the safety of telecoms infrastructure, network, and information security (Article 5);

(b) protecting the confidentiality of state secrets and users (Article 6);

(c) registering of the provider’s model service contract and terms of service use with the competent authority (Article 20.4);

(d) respecting and protecting users' interests in case of service termination (Article 23); and

(e) adhering to local invoicing regulations (Article 60)

The rights and obligations of offshore companies to provide data center and cloud computing services on a cross-border basis to users in Vietnam will be elaborated in the government's decree to implement the new law (Article 29.4a).

A notable new addition in the latest version of the Draft Law is Article 29.1a, which emphasizes that foreign investors in data center and cloud computing businesses in Vietnam are not subject to any cap on foreign ownership. This provision is likely to be a relief for foreign investors, as traditional telecoms businesses are subject to strict restrictions on foreign ownership, with the cap ranging from 49% to 65%, depending on the category of services (Vietnam's WTO Commitments to Services).

The National Assembly is scheduled to review and discuss the latest version of the Draft Law in October 2023. The new Telecoms Law is set to come into effect on July 1, 2024, but the provisions regulating data center and cloud computing services will not take effect until July 1, 2025.

Another upcoming regulation to regulate data center and cloud computing services is the Draft Decree to amend Decree 72/2013/ND-CP on the Management, Provision, and Use of Internet Services and Online Information (Draft Amendment to Internet Decree). The latest version of the Draft Amendment to Internet Decree (released in July 2023) reiterates the information security obligations of data center and web hosting service providers, with details about the authority of state agencies. Specifically, data center and web hosts are required pursuant to Art 83.3 to:

(a) Prevent and remove online content, services, and applications that violate the law within 24 hours of receiving a request from the Authority of Information Security under the MIC.

(b) Refuse to provide or temporarily suspend services to users who abuse the services to post illegal information, at the request of the Authority of Broadcasting and Electronic Information under the MIC.

The Draft Amendment to Internet Decree is expected to be issued and take effect in 2023.

Conclusion: As the data center and cloud computing services industry continue to develop in Vietnam, the Draft Law is vital and a much-needed legislation in providing a regulatory framework for both local and foreign service providers.  This will help to create a level playing field for all businesses and promote innovation in this area. The regulation of data centers and cloud computing services is also an important step in Vietnam's digital transformation journey. By providing a clear and predictable regulatory environment, the law will encourage businesses to invest in data center and cloud computing services, which are essential for the development of the digital economy. Furthermore, the Draft Law, after incorporating updates to take into account the private sector's legislative contributions, is a well-balanced piece of legislation that considers the interests of all stakeholders. It is expected to play a significant role in promoting the growth and development of the data center and cloud computing services industry in Vietnam.