Vietnam Launches Sovereign Cloud Initiative to Replace Foreign Providers for Government Data

Vietnam’s sovereign‑cloud push

Vietnam’s government announced on 13 May 2026 that it will build a domestic cloud platform to host all state‑run applications and data. Prime Minister Lê Minh Hùng signed Decision 808/QD‑TTg, which lists twenty strategic technologies the country plans to master by 2030. A national cloud sits at number 13 on that list.

Legal basis for the move

Vietnam’s Law on Cybersecurity (effective 2019) requires that personal information and state secrets be stored on servers located within the country’s borders. The law also obliges public‑sector entities to use “domestic” services when feasible, and it imposes administrative fines of up to VND 200 million (≈ US$8,600) for non‑compliance, plus possible criminal liability for repeated violations.

While the decision is a domestic policy, it intersects with EU GDPR and California CCPA because many Vietnamese agencies process data of EU citizens and Californians. Under GDPR Art. 32, controllers must ensure appropriate technical and organisational measures for data security, which includes respecting data‑localisation requirements of the controller’s jurisdiction. A breach of Vietnamese localisation rules could be deemed a GDPR violation, exposing the foreign provider to fines of up to €20 million or 4 % of global turnover.

Impact on users and companies

• Government agencies – will have to migrate workloads from Amazon Web Services, Microsoft Azure, Google Cloud, and Tencent Cloud to the new Vietnamese platform. Migration timelines are tight: the decision sets a 2030 deadline for full migration and a 2035 target for a fully data‑driven smart government.
• Foreign hyperscalers – AWS, Alibaba, Huawei and others have announced plans to place Local Zones or data centres in Vietnam, but those facilities would still be subject to Vietnamese law. Failure to provide a compliant domestic tenancy could mean loss of all public‑sector contracts, which represent an estimated US$1.2 billion in annual cloud spend for the region.
• Vietnamese citizens – will see their personal data stored on servers owned by a state‑run entity. The government promises “centralised, secure and reliable” infrastructure, but the shift raises concerns about transparency, auditability, and the potential for state surveillance.

Compliance implications

1. Data‑localisation audits – Companies that continue to host Vietnamese government data abroad must conduct a GDPR‑style Data Protection Impact Assessment (DPIA) and demonstrate that adequate safeguards (e.g., Standard Contractual Clauses) are in place. Regulators in the EU and California are expected to scrutinise those safeguards closely.
2. Contract renegotiations – Existing service agreements will need clauses that specify local storage, government‑level encryption, and right‑to‑audit provisions. Failure to amend contracts could trigger the VND 200 million penalty or, in extreme cases, criminal charges for “illegal data export.”
3. Technical readiness – The Vietnamese sovereign cloud must support quantum‑resistant encryption, UEBA (user‑entity behaviour analytics), and a next‑generation SIEM as outlined in Decision 808. Providers that cannot meet these specifications will be disqualified from future tenders.

What changes are coming?

• Infrastructure rollout – By 2027 the government expects the first phase of the national cloud – a multi‑region, high‑availability platform – to be operational. Subsequent phases will add AI‑driven security operations, a national firewall, and integration with the country’s upcoming 5G backbone.
• Policy enforcement – The Ministry of Information and Communications will launch a compliance portal where agencies must upload migration plans and certify that data residency requirements are met. Non‑compliant entities will face automatic suspension of cloud services and the aforementioned fines.
• Industry response – Hyperscalers are lobbying for a “Vietnam‑only” data‑center model that isolates Vietnamese workloads from other regions while still using the provider’s global control plane. If accepted, this could preserve cross‑border analytics while satisfying localisation.

Bottom line

Vietnam’s sovereign‑cloud mandate is a clear signal that data‑sovereignty concerns are reshaping public‑sector IT strategy in the Asia‑Pacific. Companies that rely on foreign cloud services must reassess their legal exposure under GDPR and CCPA, renegotiate contracts to include local‑storage guarantees, and invest in the technical capabilities demanded by the Vietnamese government. For Vietnamese citizens, the promise of a “smart government” hinges on whether the state‑run cloud can deliver the security and privacy protections that international standards require.