Compliance

Data localization

Requirement to store specified data within Vietnam's territory.

How the laws define this

Both instruments establish a legal obligation requiring data relating to individuals in a specific nation to be stored on servers physically located within that country. They diverge significantly in the lifecycle stages regulated and the additional conditions imposed. Under the Cybersecurity Law, the rule applies to certain categories of data concerning Vietnamese users and includes an explicit mandate to make specified data available to authorities upon request, often accompanied by a minimum retention period of 24 months. Conversely, Қазақстан Республикасының «Дербес деректер және оларды қорғау туралы» Заңы governs the personal data of Kazakhstani citizens and strictly requires that the primary collection and processing—not merely the storage—must take place on physical servers within Kazakhstan. While the Cybersecurity Law emphasizes storage retention and regulatory access, the Kazakhstani law dictates where the initial collection and handling of personal data must occur.

Synthesised from the 2 statutory definitions below. Each one is quoted in full, with its source.

How jurisdictions differ

What is distinctive in each definition, binding law in force first.

Jurisdiction	Instrument	Status	What is distinctive
Kazakhstan	Law of the Republic of Kazakhstan 'On Personal Data and their Protection'	In Force (Amended)	Specifies primary collection, processing, and storage exclusively for Kazakhstani citizens' personal data, unlike Vietnam's focus on certain categories of data concerning Vietnamese users.
Vietnam	Cybersecurity Law	Repealed	Adds a minimum retention period and availability to authorities on request for specified data, unlike Kazakhstan's definition which omits these elements.

What it triggers

Under Kazakhstan's Law of the Republic of Kazakhstan 'On Personal Data and their Protection', it imposes the legal obligation to perform primary collection, processing, and storage of personal data of Kazakhstani citizens on servers physically located within Kazakhstan.
Under Vietnam's Cybersecurity Law, it required certain categories of data concerning Vietnamese users to be stored on servers physically located in Vietnam and made available to authorities on request, including a minimum retention period for specified data when requested.source

Definitions (2)

A legal obligation requiring certain categories of data concerning Vietnamese users to be stored on servers physically located in Vietnam and made available to authorities on request, including a minimum retention period (commonly 24 months) for specified data when requested.

Cybersecurity LawDefinition 1 of 2

The legal obligation to perform the primary collection, processing, and storage of personal data of Kazakhstani citizens on servers physically located within Kazakhstan.

Қазақстан Республикасының «Дербес деректер және оларды қорғау туралы» ЗаңыDefinition 2 of 2

Not to be confused with

Critical Personal Data

Critical Personal Data refers to data deemed critical to national security or significant public interest, while data localization concerns the geographic requirement to store specified data within a territory.

Providing data to overseas

Providing data to overseas describes actions enabling overseas parties to obtain domestic data, whereas data localization mandates storing data within the domestic territory.

Questions and answers

What data must be stored in Kazakhstan under data localization rules?

Personal data of Kazakhstani citizens must have their primary collection, processing, and storage performed on servers physically located within Kazakhstan.

Does Vietnam's Cybersecurity Law still require data localization?

No, Vietnam's Cybersecurity Law, which required certain categories of data concerning Vietnamese users to be stored on servers in Vietnam, has been repealed.

What are the key differences in data localization between Kazakhstan and Vietnam?

Kazakhstan mandates localization for personal data of its citizens' primary operations, while Vietnam's now-repealed law targeted user data categories with retention and authority access requirements.