Investing in Data Centers in Vietnam: Key legal considerations for investors

Data has become a fundamental asset and a key enabler of the digital economy. The rapid growth of cloud computing, artificial intelligence, e-commerce, digital finance and online platforms has significantly increased demand for secure, reliable and uninterrupted data storage, processing and protection. Against this backdrop, data centers have become critical infrastructure supporting business operations and Vietnam's digital transformation.

In Vietnam, data center projects are attracting growing interest from both domestic and foreign investors. However, investing in, constructing and operating a data center involves far more than technical and engineering considerations. It also requires compliance with a broad range of legal and regulatory frameworks, including investment, telecommunications, construction, land, environmental protection, fire safety, electricity, cybersecurity and personal data protection.

This publication, “Investing in Data Centers in Vietnam: Key Legal Considerations for Investors”, has been prepared by HM&P to provide investors and businesses with a practical overview of the legal framework governing the development, construction, operation and commercialization of data center projects and services in Vietnam. Presented in a question-and-answer format, it focuses on key legal issues and compliance obligations commonly encountered in practice.

This publication is intended solely for general informational purposes and should not be regarded as legal advice for any specific project. Applicable legal requirements may vary depending on the project's scale, location, investment structure, service model and operational scope. HM&P hopes that this publication will help investors identify key legal considerations at an early stage and structure and implement their projects in Vietnam more effectively.

In the event that you have any questions regarding the content of the publication or have a need to use the legal services provided by HM&P, please contact us at the information below:

Our Managing Partner:

Lawyer Nguyen Van Phuc

Phone: 0932 768 630

Email: phuc.nguyen@hmplaw.vn

HM&P Law Firm

Address: 10th Floor, ITAXA House, 126 Nguyen Thi Minh Khai, Xuan Hoa Ward, HCMC

Phone: +84 28 73080839

Email: counsel@hmplaw.vn

Website: hmplaw.vn

ABOUT THE DATA CENTER

1.What Is a Data Center?

HM&P:

A data center is a telecommunications facility comprising buildings, stations, cable systems, computer systems, electrical systems and supporting equipment installed to process, store and manage data for one or more organizations or individuals.[1]

Telecommunications facilities are construction works comprising passive telecommunications infrastructure and the equipment installed within them to support telecommunications activities.[2]

From a legal perspective, a data center is more than a facility housing servers or information technology equipment. Under Vietnamese law, it is recognized as a specialized telecommunications facility comprising both passive telecommunications infrastructure, such as buildings, stations, power systems and cables, and the information technology equipment installed within it to process, store and manage data.

2.What Are Data Center Services?

HM&P:

A data center service is a telecommunications service that provides users with information processing, storage and retrieval through a telecommunications network by making all or part of a data center available to them.[3]

The statutory definitions of “data center” and “data center service” make clear that merely investing in, constructing or owning a data center does not, by itself, constitute the provision of data center services. Where a data center is used solely for an enterprise's internal needs, such as storing internal data or operating its own information technology systems, the enterprise is not regarded as a data center service provider.

In practice, an enterprise is regarded as providing data center services where it makes all or part of a data center available to customers for information processing, storage or retrieval through a telecommunications network. Such services may include colocation, server hosting, infrastructure leasing, storage capacity, data processing and similar offerings.

3.What Legal Framework Governs a Data Center Project?

HM&P:

Vietnam does not currently have a standalone law governing data centers. Depending on the investment model, scope of services and stage of implementation, a project may be subject to several areas of law concurrently.

The applicable legal framework may be broadly summarized as follows:

No.	Stage	Principal areas of law
1	Investment preparation	Investment, enterprise and foreign investor market access requirements.
2	Site selection and construction	Planning, land, construction, environmental protection, fire safety, electricity and water resources.
3	Commissioning and operation	Telecommunications, standards and technical regulations, and conformity declarations.
4	Service provision	Cybersecurity, information system security, personal data protection and cross-border data transfers.
5	Commercial operation and transfer	Tax, investment incentives, competition, capital or project transfers, and sector-specific licences.

The principal legislation includes the Law on Investment, the Law on Enterprises, the Land Law, the Law on Construction, the Law on Environmental Protection, the Law on Fire Prevention, Firefighting and Rescue, the Law on Electricity, the Law on Telecommunications, the Law on Cybersecurity, the Law on Personal Data Protection and their implementing regulations.

Compliance for a data center project should be viewed as an ongoing process rather than a one-time licensing exercise. Legal requirements must be addressed throughout the project lifecycle, from investment preparation and construction to operation and eventual transfer.

INVESTMENT CONDITIONS FOR DATA CENTER PROJECTS

4.Are Data Center Activities Prohibited, Restricted or Conditional Business Lines?

HM&P:

The answer depends on the specific operating model. Not every activity relating to a data center constitutes a conditional business line.

In practice, the following distinctions should be made:

• Investment in, construction and operation of data center infrastructure are not automatically regarded as conditional business activities merely because the project involves a data center.
• The provision of data center services is governed by telecommunications law and may be subject to specific registration or licensing requirements depending on the type of service provided.
• Foreign investors must also consider applicable market access conditions under the Law on Investment and the international treaties to which Vietnam is a party.

Accordingly, whether a project falls within a conditional business line should be assessed by reference to the substance of the activities and services actually carried out, rather than the generic label “data center”.

Note: A data center project may be subject to multiple regulatory regimes, including investment, construction, environmental, telecommunications, cybersecurity and personal data protection requirements. This does not mean, however, that every activity of the project is a conditional business activity.

5.May Foreign Investors Provide Data Center Services in Vietnam?

HM&P:

Yes. Vietnamese law permits foreign investment in the data center sector. However, applicable market access conditions, including any foreign ownership restrictions, depend on the project's specific operating model and the services to be provided rather than the generic label “data center”.

In practice, the following cases should be distinguished:

• Enterprises that only invest in, construct and lease data center infrastructure, such as colocation or storage infrastructure, are generally not subject to data-center-specific foreign ownership limits beyond the general requirements of investment law.
• Enterprises providing data center services under the Law on Telecommunications must satisfy the applicable telecommunications requirements, including registration or licensing obligations for the relevant type of service.
• Where the enterprise also operates in a conditional business sector or a sector subject to foreign investor market access restrictions, such as certain telecommunications services or network-based services, the investor must also satisfy the corresponding requirements under Vietnamese law and applicable international treaties.

The extent to which foreign investors may participate in the sector therefore varies depending on the business model, scope of services and regulations applicable to the particular project.

Before determining the investment structure, investors should consider at least the following matters:

• whether the enterprise will only invest in and operate infrastructure or will directly provide telecommunications services;
• whether the proposed services fall within a conditional business line or a sector subject to foreign investor market access restrictions; and
• the international commitments and sector-specific regulations applicable to each type of service.

Ultimately, foreign investor participation should be assessed by reference to the substance of the business rather than the project title or registered business line. This approach helps manage legal risk from the outset of the investment structuring process.

6.Do Data Center Projects Require Investment Policy Approval?

HM&P:

The applicable investment procedures vary depending on the project's scale, location, investment structure and proposed services. A data center project will typically involve the following key legal stages:

No.	Stage	Main procedures
1	Investment preparation	Review market access conditions and determine whether investment policy approval is required.
2	Project establishment	Obtain an Investment Registration Certificate (IRC), where required, and establish the project company and obtain its Enterprise Registration Certificate (ERC).
3	Construction implementation	Complete the applicable land, construction, environmental, fire safety and other sector-specific procedures.
4	Commissioning and operation	Complete acceptance, conformity declaration, registration or licensing procedures for data center services, where applicable, and other relevant sector-specific procedures.

Depending on the project, investors may also need to complete additional procedures relating to electricity, water resources, cybersecurity, personal data protection and other sector-specific requirements.

There is no single regulatory process applicable to every data center project. Investors should define the business model, project location and proposed services at the investment preparation stage in order to develop an appropriate regulatory roadmap and minimize unnecessary procedures and subsequent project amendments.

7.Is a Construction Permit Required for a Data Center Project?

HM&P:

This depends on the particular project. Whether a Construction Permit is required must be determined under the Law on Construction and its implementing regulations, taking into account the type, grade and location of the facility and any applicable statutory exemption.

Most newly constructed data center projects will need to complete the relevant construction procedures, which may include design appraisal, obtaining a Construction Permit where required, carrying out construction works, completing acceptance procedures and commissioning the facility.

Certain facilities or individual project components may be exempt from the Construction Permit requirement if all statutory conditions are satisfied. However, the fact that a data center is governed by telecommunications law or includes telecommunications infrastructure does not exempt the entire project from construction permitting requirements.

To determine whether a Construction Permit is required, investors should review:

• the type, grade and scale of the facility;
• the construction location;
• the approved construction planning; and
• whether any statutory exemption from the Construction Permit requirement applies.

Whether a Construction Permit is required should therefore be determined on a case-by-case basis, taking into account the characteristics of the project, the applicable exemptions and the requirements of construction law.

8. Must a Data Center Project Conduct an Environmental Impact Assessment, Obtain an Environmental Permit or Complete Environmental Registration?

HM&P:

Not every data center project is subject to the same environmental procedures. The applicable obligations depend on the project's scale and location, its potential environmental impact and the type and volume of waste generated.

Under the Law on Environmental Protection 2020, investment projects are classified into Groups I, II, III and IV according to their potential environmental impact. Based on that classification, an investor may be required to complete one or more of the following procedures:

No.	Procedure	When it may apply
1	Preliminary Environmental Impact Assessment	Certain Group I projects during the investment preparation stage, as prescribed by law.
2	Environmental Impact Assessment (EIA)	Group I projects and certain Group II projects specified by law.
3	Environmental Permit	Group I, II or III projects that fall within the statutory permit requirements.
4	Environmental Registration	Projects that generate waste, are not subject to an Environmental Permit and are not exempt from registration.

Note: Classification as a Group IV project does not necessarily mean that environmental registration is required. Conversely, a project that generates waste is not automatically required to obtain an Environmental Permit. The applicable obligations must be determined by reference to the criteria under the Law on Environmental Protection and its implementing regulations.

For data centers, environmental issues commonly arise from:

• emissions from backup generators;
• wastewater from cooling systems and domestic activities;
• noise and vibration;
• oil, fuel and chemicals;
• batteries, accumulators, refrigerants and hazardous waste; and
• end-of-life electrical and electronic equipment.

Where a project exploits or uses water resources, discharges wastewater into a water source or carries out other activities regulated by water resources law, the investor must also complete the corresponding sector-specific procedures.

A data center project is not automatically subject to every environmental procedure. At the investment preparation stage, investors should assess the project's classification, location, technology and expected waste streams to determine accurately whether an environmental impact assessment, Environmental Permit or environmental registration is required.

9.What Construction and Fire Safety Requirements Apply to Data Center Projects?

HM&P:

In addition to completing investment procedures, investors must comply with construction and fire safety requirements throughout the development, construction and operation of a data center.

From a construction perspective, the applicable procedures may include planning and land matters, design appraisal, obtaining a Construction Permit where required, construction quality management, acceptance and commissioning of the facility.

Data centers are technically complex facilities that operate continuously and rely on high-capacity electrical systems, backup generators, uninterruptible power supply systems, batteries, cooling systems and high-value electronic equipment. Investors should therefore determine at the design stage whether fire safety design appraisal and acceptance procedures are required.

Investors should also ensure that the project:

• implements appropriate fire prevention, compartmentation and evacuation solutions;
• is equipped with fire alarm, firefighting, firefighting water supply and smoke extraction systems;
• has priority power supplies for fire safety systems;
• properly locates, manages and operates backup generators, uninterruptible power supply systems, batteries and fuel storage areas;
• has fire response plans and properly established fire safety teams; and
• provides for periodic inspection and maintenance of fire safety systems during operation.

Where a data center uses a clean-agent fire suppression system to minimize damage to electronic equipment, the system must comply with the applicable technical standards and regulations and must be properly designed, installed and accepted in accordance with law.

Depending on the type of facility and its operating plan, the investor should also determine whether compulsory fire and explosion insurance is required.

Because data centers must maintain continuous operation and a high level of availability, investors should consider both legal requirements and relevant international standards, such as TIA-942 and the Uptime Institute standards, when selecting fire safety solutions. This can improve system safety and reliability as well as support regulatory compliance.

Completion of construction does not, by itself, permit a data center to commence operation. The facility should only be commissioned after all applicable construction and fire safety requirements have been satisfied.

10. Must Data Center Operators Register or Obtain a Telecommunications Licence?

HM&P:

The specific requirement depends on the services provided.

Under the Law on Telecommunications 2023, data center services constitute telecommunications services. An enterprise that provides such services must register the provision of telecommunications services and obtain a Certificate of Registration for Provision of Telecommunications Services as prescribed.

Where an enterprise also establishes or operates a public telecommunications network, it must, in addition to completing the registration procedure, obtain the relevant telecommunications service licence and satisfy the corresponding statutory requirements.

Investors should therefore define the proposed operating model before implementing the project:

Operating model	Principal legal requirement
Provision of data center services only	Registration for the provision of telecommunications services under the Law on Telecommunications.
Provision of data center services together with the establishment or operation of a public telecommunications network	Registration for the provision of data center services and a telecommunications service licence under the Law on Telecommunications.

In addition to completing registration or licensing procedures, enterprises must maintain the applicable conditions throughout operation, including compliance with technical standards and regulations, telecommunications infrastructure safety, information system security and other sector-specific obligations.

An enterprise that merely invests in or owns a data center is not necessarily required to obtain a Certificate of Registration for Provision of Telecommunications Services. Registration is required where the enterprise actually provides data center services to customers. Any licensing requirement will depend on whether the enterprise also establishes or operates a public telecommunications network.