Vietnam passed a new cybersecurity law in June 2018 requiring companies that collect, analyze or process personal data from Vietnamese citizens to have a physical office and store users' data in the country.

Internet giants Facebook and Google, as well as U.S. lawmakers, have decried the law set to go into effect January 2019.

However, experts have advised companies to take heed of the new cybersecurity law and to take notice of how Vietnam's government is enforcing the regulation.

“In all fairness to Vietnam, it feels it's necessary to come up with a more robust cybersecurity law, that's to be expected,” said Yee Chung Seck, a partner in Baker McKenzie's Vietnam office. “Vietnam is not the first country to do so.”

Indeed, Vietnam joins the governments of China, Indonesia and South Korea in implementing similar cybersecurity legislation, said Gino Bello, FTI Consulting's senior director of computer forensics, technology.

Along with requiring companies to store Vietnamese users' personal data locally, the law also prohibits online service providers from transmitting or posting information that goes against the Vietnamese government or incites riots or “untruthful information,” Bello said. When Vietnamese authorities flag content as prohibited, companies have 24 hours to remove the content, he explained.

“Companies are also obligated to ensure effective monitoring process are in place … [and] verify users' information when they register activities on their sites to enable them to remove any content deemed inappropriate by the authorities,” he added.

However, Seck said the law is unclear on whether data collected on Vietnamese users can be transferred outside of the country as long as the data is also housed in Vietnam. He also noted there are concerns if the localized data will be safer. “[There's] anxiety over if it goes through proper procedures.”

In a plain reading of the law's requirements, Seck explained, the requirements would apply to a small cupcake shop in New York City that accepts online orders and delivers its product to a Vietnam citizen, because the law uses “a very broad definition of folks that provide services online.”

“Strictly speaking, if you take a broad sweep, it could mean everyone has to set up shop in Vietnam,” Seck said. However, Seck believes the online companies targeted for having localized data would be narrow.

Still, the new requirements also would likely create more expenses for affected companies.

“Companies are likely to see costs increase as they will now be required to set up local branches rather than storing in cloud-based offshore platforms,” FTI's Bello explained. Those expenses would include infrastructure, technology, data migration and acquiring and paying personnel.

With the new law, Vietnam follows in the footsteps other countries' governments that have drafted and implemented tougher online regulations to, they say, fight against “fake news.”

 “Vietnam has that same anxiety as other countries … and they can manage and compel social media companies,” Seck said. “The tricky part is concerned [with] what is unlawful content, news that is fake, that can be subjective.”