Navigating data centre opportunities across APAC 2026 - Vietnam

The Law on Telecommunications 2023 (Telecoms Law) confirmed that there is no limit on foreign ownership of companies providing data centre services or cloud services in Vietnam.

While this is not officially a change in law as there was no specific limit previously, this is the first time that it has been confirmed in law. The regulatory clarity will provide foreign investors with more confidence to invest in the local data centre industry.

Vietnam has several high-tech parks and special economic zones (SEZs) in central and strategic locations.

These offer favourable conditions and incentives for data centre investments, including:

• supporting infrastructure well-suited to data centre operations such as access to power and telecommunications networks, and
• tax breaks and other incentives including corporate income tax incentives, import duty exemptions and land and water surface rent exemptions.

Data and cyber security obligations heighten the compliance burden for companies.

Following a series of data localisation, security and privacy reforms in recent years, the Law on Data 2024 as amended by the Law on Cyber Security 2025 (Data Law) came into effect on 1 July 2025. To support the implementation of the Data Law, the Data Decree was issued on 30 June 2025 and came into effect on 1 July 2025.

The Data Law and Data Decree:

• heighten obligations for handling important data, including by foreign-owned enterprises, to address national security concerns
• restrict the transfer of important data outside of Vietnam (see ‘Data Localisation’ below for further details) and its use by Vietnamese and foreign entities, and
• introduce licensing or registration for certain data-related products and services, which may include data centre and data processing services.

Separately, the Law on Cybersecurity 2025 classifies information systems into five cyber security levels based on the potential impact of cyber security incidents or breaches. Each level carries corresponding protection obligations, including requirements to detect, respond to, and remediate cyber security incidents, and to safeguard the confidentiality of information relating to the registration, creation, management and use of digital accounts.