US$3.5–4.0B
Vietnam cloud market, 2025, by two analyst estimates23. That is –.
Strategy document · internal / partner briefing
XcellHost|Vietnam Go-To-Market Strategy
A US$39 billion digital economy rewrote its data and cyber rulebook in 2025–2026. This is how XcellHost enters: partner-led, data kept in Vietnam, and backed 24×7 from Mumbai.
Cloud · Cyber Security · Data Protection · Digital Trust · AI · Training. Every market number and legal status on this page is sourced and dated, as of 4 November 2026.
Cloud in a Vietnam partner DC
SOC through licensed partners
Backup, DR & privacy operations
PKI, HSM & certificate lifecycle
AI platforms, RAG & GPU
AI & cyber training cohorts
01
Market · where the money isSimplified outline, not to scale · figures sourced below
BRIEF
Executive summary
Enter Vietnam through partners, with data kept local
The case on one screen: what the market is worth, why the timing works, how to enter and what we aim to reach in 18 months.
7 laws
Seven new laws took effect between July 2024 and July 2026, each with implementing decrees. Each one starts a compliance project.
- Personal Data Protection Law and Decree 356 in force since 1 Jan 2026. Fines reach 5% of prior-year revenue for cross-border violations25.
- Cybersecurity Law 2025 in force since 1 Jul 202619. Decrees 331, 332 and 333 followed on 19 Aug 202621.
- AI Law in force since 1 Mar 2026. Existing systems have grace periods to 1 Mar 2027, or 1 Sep 2027 in health, education and finance32.
- New capacity is arriving: AWS Local Zone Hanoi went live on 19 Jun 202614, and a 140 MW Viettel campus is under way7.
Partner-led
Vietnam DC partner plus local SI/MSP resellers first. Decide on an entity or JV at month 12.
- Host in-scope data in a Vietnam partner data centre. Vietnam-incorporated firms must store certain user data locally21.
- Deliver managed SOC through an MPS-licensed partner. A cyber-services licence needs a Vietnamese-national legal representative21.
- Run tooling, playbooks and the second line from the Mumbai 24×7 NOC & SOC, after a transfer impact assessment for any data that leaves Vietnam25.
18-month goalsTargets for leadership to confirm. They are not forecasts. Accounts and revenue follow the revenue model (base case by default).
Goal · active partners62 DC/cloud + 4 SI/MSP
Goal · paying accounts44across 10 verticals
Goal · annualised revenueUS$1.1M≈ ₹10.5 crore
Goal · readiness assessments20PDPL + Cybersecurity Law
Market size
Sized from published sources, as ranges
Analysts differ, sometimes widely. Where they do, we show both figures. INR equivalents use ₹95.17 per US$, the close on 26 Oct 202643. They are labelled and shown for orientation only.
Cloud computingUS$3.5–3.97B2025 · CAGR 10.1% (to 2034) – 13.7% (to 2032)≈ – IMARC2 · P&S Intelligence3
Cyber securityUS$0.32–1.37B2025 · CAGR 13.3% (to 2034) – 16.3% (to 2032)≈ – P&S5 · IMARC4. The 4× gap reflects scope.
Data-centre marketUS$1.42–2.2B2025 · 17.5% CAGR to 2032 (P&S); ~3.7% a year to 2029 (Statista via ITA)≈ – P&S9 · US ITA6
E-learning / skillsUS$2.0B2025 · US$8.7B by 2034 · CAGR 17.7%≈ IMARC13. No reliable IT-training-only figure was found.
Sources: 2, 3, 4, 5, 6, 9, 10, 13
Source: e-Conomy SEA 2025 via VIR, 26 Nov 2025 (1)
Sources: JLL via Tuoi Tre (8) · BMI via TechNode (7) · MST via US ITA (6)
Sources: IMARC (2, 4). Interpolation is ours.
TAM · SAM · SOM for XcellHost
From the whole market to what we can realistically win
TAM is the sum of four separate IMARC 2025 estimates. They overlap, for example cloud AI, so treat TAM as an upper bound. SAM and SOM are our assumptions. You can change them in the revenue model.
SAM · serviceable · assumptionUS$820M10% of TAM: managed and partner-delivered services in our six pillars, in Hanoi, Da Nang and HCMC
SOM · obtainable in ~18 months · assumptionUS$1.1MBottom-up: target accounts × win rate × ACV across 10 verticals. That is 0.14% of SAM.
Key verticals · top 10 services · buying triggers
Ten verticals, each with its own top 10
Pick a vertical. Each one shows why it matters, with sourced facts, then its regulatory drivers, who buys, the ten XcellHost services to lead with and the events that open a deal. Every service links to its XcellHost page.
XcellHost service pages describe the Indian offer, with INR pricing and Indian compliance. For Vietnam, each service will be re-scoped with partners for local hosting, licensing and VND billing. Priority waves are our judgement.
Buying triggers · calendar
Dated events that open budgets
Compliance deadlines, platform end-of-life dates and certificate-lifetime cuts give sales a calendar. Undated triggers, such as a ransomware incident, an audit finding or a new factory, are listed under each vertical above.
Local IT & data-protection laws · status at 4 Nov 2026
Laws, their status and how we respond
A neutral summary of laws we checked against law-firm and official sources. Not legal advice: confirm each point with Vietnamese counsel before contracting. The Ministry of Information and Communications merged into the Ministry of Science and Technology (MST) in February 202548. Older texts still say "MIC".
| Law / instrument | Status & dates | Key obligations | Implication & XcellHost response |
|---|---|---|---|
| Law on Cybersecurity 2025No. 116/2025/QH15 | In forcePassed 10 Dec 2025 · effective 1 Jul 2026. Replaces the 2018 Cybersecurity Law and the 2015 Network Information Security Law19. | Five security levels for information systems. Telecom, internet and value-added service providers that process Vietnamese user data store it in Vietnam. Covered foreign providers need a branch or representative office. Content removal within 24 h, or 6 h if urgent1920. | Implication: Vietnamese user data in scope must stay in-country. Response: host in-scope workloads in a Vietnam partner DC. Use Mumbai only for workloads cleared for transfer. |
| Decree 333/2026/ND-CPDetailing the Cybersecurity Law | In forceIssued and effective 19 Aug 202621. It keeps a substantial part of the Decree 53/2022 framework22. | Vietnam-incorporated companies, including FIEs, store users' personal data and user-generated data in Vietnam automatically. Offshore providers must localise and open a local presence only after a Ministry of Public Security (MPS) decision, with 12 months to comply. System logs are kept at least 12 months212223. | Implication: our FIE customers must keep this data local. Response: offer in-country hosting, backup and log retention by default, and document the data flows for each customer. |
| Decree 331/2026/ND-CPProtecting information systems | In forceEffective 19 Aug 202621. | Five-level classification for systems serving state-agency IT and online public services. Levels 3–4 need logical segregation of cloud and DC environments. Level 5 needs physical segregation and an independent licensed assessment. Serious incidents are reported within 24 h, with a full report within 72 h21. | Implication: government and critical work demands segregated, assessed environments. Response: offer dedicated or private cloud through licensed local primes, with incident runbooks built for the 24 h / 72 h timelines. |
| Decree 332/2026/ND-CPCyber security products & services | In forceEffective 19 Aug 202621. | A 10-year MPS business licence for cyber security services. The legal representative must be a Vietnamese national. At least 5 qualified staff are needed for assessment and consulting, and at least 12 for monitoring. An FIE's remaining project term must exceed 5 years. Annual report due by 31 Jan21. | Implication: XcellHost cannot sell managed SOC or assessments directly from India. Response: deliver through an MPS-licensed partner. XcellHost supplies the SOC platform, playbooks and second-line analysts. |
| Law on Cybersecurity 2018 + Decree 53/2022No. 24/2018/QH14 | SupersededThe 2018 Law ceased on 1 Jul 202619. Decree 333 now governs localisation. Whether Decree 53 was formally repealed is not confirmed in our sources22. | Introduced data localisation and the local-office test for foreign providers. Decree 333 carries these forward with changes. | Response: use Decree 333 for new contracts. Check that legacy contracts do not cite repealed rules. |
| Decree 85/2016/ND-CPInformation-system security by level | VerifyIssued under the 2015 Network Information Security Law, which ceased on 1 Jul 202619. Level classification now sits under Law 116/2025 and Decree 331/202621. We could not confirm its formal repeal. | Five-level classification and protection plans for information systems. SBV Circular 09/2020 referred banking systems with online customer services to Decree 8539. | Response: map customer systems to Decree 331 levels. Ask counsel how Decree 85 references in sector rules are now read. |
| Law on Personal Data ProtectionNo. 91/2025/QH15 + Decree 356/2025/ND-CP | In forcePassed 26 Jun 2025 · effective 1 Jan 2026. Decree 356, issued 31 Dec 2025, supersedes Decree 13/20232425. | DPIA and transfer impact assessment (TIA), updated every 6 months on change. Data-protection staff or an outsourced provider. Fines up to 5% of prior-year revenue for cross-border violations, 10× revenue for unlawful data trading, VND 3bn otherwise. Small firms and start-ups get a 5-year grace on DPIA and DPO. Household and micro firms are exempt, with exceptions25. | Implication: every customer needs a DPIA and TIA, and our own Mumbai processing needs a TIA too. Response: a PDPL readiness assessment as the door-opener, then outsourced privacy operations with a local legal partner. |
| Decree 13/2023/ND-CPPersonal data protection | SupersededSuperseded by Decree 356/2025 from 1 Jan 202624. | Vietnam's first comprehensive personal-data decree. Its DPIA and TIA concepts carried into the PDPL25. | Response: refresh any assessments filed under Decree 13 to the new forms. |
| Law on DataNo. 60/2024/QH15 + Decree 165/2025/ND-CP | In forceLaw effective 1 Jul 202526. Decree 165 issued 30 Jun 2025, effective 1 Jul 202527. Decision 20/2025/QD-TTg lists core and critical data26. | Core data: an outbound transfer impact assessment and prior approval from MPS or the Ministry of National Defence. Critical data: the assessment is filed at least 15 days before transfer. Banking example: account, payment and debt data of ≥100,000 organisations is core; ≥10,000 is critical26. | Implication: some BFSI and government data cannot leave Vietnam without approval. Response: design those workloads Vietnam-only, including DR at a second Vietnam site. |
| Law on E-Transactions 2023No. 20/2023/QH15 + Decree 23/2025/ND-CP | In forceLaw effective 1 Jul 202428. Decree 23 issued 21 Feb 2025, effective 10 Apr 202529. | Three e-signature types. Trust services (time-stamping, data-message certification, public digital-signature certification) are conditional and need a 10-year licence28. The service system must be located in Vietnam, with a VND 10bn deposit per 300,000 subscribers or insurance29. To mid-2025, no foreign certification provider had been recognised30. | Implication: legally recognised Vietnamese document signatures need a licensed local provider. Response: partner with a licensed Vietnamese CA for e-signatures. Lead with PKI, HSM, CLM, crypto-posture and PQC services, which are not trust-service licences. |
| Law on Artificial IntelligenceNo. 134/2025/QH1533 | In forcePassed 10 Dec 2025 · effective 1 Mar 20263234. | High, medium and low risk tiers, plus prohibited acts. Machine-readable marking of AI-generated audio, images and video. High-risk providers that need conformity assessment must have a commercial presence or an authorised representative in Vietnam. Existing systems have grace to 1 Mar 2027, or 1 Sep 2027 in health, education and finance. Implementing decrees are still in progress32. | Implication: customers need an AI inventory, risk classification and labelling. Response: AI governance workshops, vCAIO advisory and ISO/IEC 42001 alignment, plus AI platforms hosted in Vietnam where required. |
| Law on Digital Technology IndustryNo. 71/2025/QH15 | In forcePassed 14 Jun 2025. Incentives effective 1 Jul 2025, full effect 1 Jan 202631. Its general AI framework is replaced by the AI Law32. | Tax, land and investment incentives for software, AI, semiconductors and AI data centres. Defines digital assets. Five-year residence cards for qualified experts31. | Implication: a local AI or DC investment may qualify for incentives. Response: evaluate incentives in the month-12 entity decision. |
| Law on Telecommunications 2023No. 24/2023/QH15 + Decree 163/2024/ND-CP | In forcePassed 24 Nov 2023 · effective 1 Jul 2024. Data-centre and cloud provisions apply from 1 Jan 20253536. | Light-touch regime. DC providers register with the Vietnam Telecommunications Authority (VNTA). Cloud providers notify it, and offshore cloud providers notify before serving. 100% foreign ownership is allowed for DC and cloud. Providers may not access user data without consent353637. | Implication: cloud resale needs a VNTA notification by us or the partner. Response: file the notification in phase 1, and keep the option of a 100% FIE for DC and cloud services later. |
| Foreign-investment conditionsCloud · DC · telecom · cyber · trust | Verify per serviceAs of 2026 under the Telecom Law, Decree 332 and Decree 23212937. | DC and cloud: no foreign-ownership cap. Network connectivity still faces market-access limits; confirm the current cap with counsel37. Cyber services: MPS licence and a Vietnamese-national legal representative. Trust services: system in Vietnam plus deposit or insurance. | Response: no connectivity resale in phases 1–2. Licensed services stay with partners until the JV or entity decision. |
| Decree 147/2024/ND-CPInternet services & online information | In forceIssued 9 Nov 2024 · effective 25 Dec 202438. | Hosting and DC providers report or remove violating content within 24 h and report annually on storage rented to foreign cross-border providers. Social networks authenticate users. Offshore providers above thresholds notify contacts and store Vietnamese users' data38. | Implication: as a hosting provider, we inherit takedown and reporting duties. Response: an abuse desk and takedown SLA in partner contracts, plus annual reporting. |
| SBV Circular 09/2020/TT-NHNNBanking information-system security | In forceEffective 1 Jan 202139. We did not confirm later amendments; check the consolidated text49. | Five system levels. Cloud use requires impact classification, backup plans for Level 3+ components, provider-selection criteria and contracts covering security, continuity, DR and breach notice39. | Response: provide a Circular 09 mapping pack, audit rights and an exit plan, as in our BFSI Cloud offer. |
| SBV Circular 50/2024/TT-NHNNOnline banking security | In forceIssued 31 Oct 2024 · effective 1 Jan 2025, phased: 1 Jul 2025, 1 Jan 2026 and 1 Jul 202640. | Risk-based authentication by transaction value and type: OTP, biometrics or e-signature for larger transfers. Firewall and DMZ standards extend to more services40. | Response: WAAP, app security testing and PKI/HSM for signing. Assess app and API security for banks and fintechs. |
| Securities & insurance IT rulesMinistry of Finance regulators | Not verifiedWe could not verify the current instruments from primary sources for this briefing. | Brokers suffered a high-profile ransomware outage in March 202447, so expect scrutiny of security and continuity. | Response: commission a local legal memo before targeting brokers and insurers. |
Competitive landscape
Strong local players, so partner, don't fight
Domestic telecom and IT groups lead today's data-centre market, and the hyperscalers are arriving. We list the facts neutrally. Most local providers are partner candidates as much as competitors.
| Provider | Type | What we verified | Our stance |
|---|---|---|---|
| Viettel (Viettel IDC) | Domestic telecom group | Broke ground in Apr 2025 on a 140 MW hyperscale campus in HCMC (Tan Phu Trung), aiming for up to 560 MW by 20307. | DC capacity partner candidate |
| VNPT | Domestic telecom group | Named among the main domestic DC operators68. | DC or cloud partner candidate |
| FPT (FPT Telecom, FPT Smart Cloud) | Domestic IT and telecom group | DC operator6. Announced a US$200M AI factory with NVIDIA in Apr 202416. | Competitor in AI and cloud. Possible SI partner. |
| CMC (CMC Telecom, CMC Cloud) | Domestic IT and telecom group | Approved hyperscale DC at Saigon Hi-Tech Park, 30 MW expandable to 120 MW, more than US$250M79. | DC partner candidate |
| VNG Cloud | Domestic cloud provider | Local public-cloud provider. We have no verified capacity figures. | Neutral: partner or competitor |
| Bizfly Cloud | Domestic cloud provider | Local public-cloud provider. We have no verified capacity figures. | Neutral: partner or competitor |
| AWS | Hyperscaler | Local Zone in Hanoi generally available since 19 Jun 2026 (parent region ap-southeast-1)14. | Co-sell. Manage it through Managed AWS. |
| Google Cloud | Hyperscaler | Reported (Reuters) to be considering a hyperscale DC near HCMC. Not confirmed by Google15. BMI expects operations from 20277. | Co-sell through Managed Google Cloud |
| Alibaba Cloud | Hyperscaler | BMI expects a first hyperscale DC in HCMC, operating from 20277. | Watch |
| Microsoft Azure | Hyperscaler | Our research found no Vietnam in-country Azure region. Customers are served from regional cloud regions. | Co-sell through Managed Azure. XcellHost is a Microsoft Gold Partner. |
| NTT DATA, ST Telemedia GDC, Gaw Capital and others | Foreign DC investors | Listed among the 12 DC investors in Vietnam6. | Colocation partner candidates |
Go-to-market plan
Four entry models, one recommendation
We compare the options on speed, cost, compliance fit and control. Ratings are our judgement from the laws above.
| Entry model | Time to revenue | Upfront cost | Compliance fit | Control & margin | Verdict |
|---|---|---|---|---|---|
| Partner-led via local SI / MSP | Fast | Low | StrongPartners hold MPS cyber and trust-service licences | Lower | Start here |
| Vietnam DC partner + resale | Medium | Low–mediumReserved racks or capacity | StrongIn-country hosting. VNTA notification | Medium | Start here, combined with the above |
| Joint venture with a local player | Slow | Medium–high | StrongLocal licences and a Vietnamese-national representative | Shared | Phase 3 option for government and licensed SOC |
| Direct entity (100% FIE) | Slow | High | MixedDC and cloud open to 100% foreign ownership. Cyber licence needs a local representative and a >5-year project term | High | Decide at month 12 on traction |
Phased plan · 0–18 months
0–6 monthsProve
- Sign 1–2 Vietnam DC or cloud partners and 2–3 SI/MSP partners
- File the VNTA cloud notification, or use the partner's. Get a local legal memo on PDPL, Decrees 331–333 and tax
- Localise 10 lead offers and the readiness assessment into Vietnamese
- Run 5 paid pilots: Indian and regional FDI firms, fintech, e-commerce
6–12 monthsScale
- Partner enablement: technical certification, demo tenants, deal registration
- Managed SOC live through an MPS-licensed partner. XcellHost provides the second line
- AI and cyber training cohorts in Hanoi and HCMC, with university partners
- Co-hosted roundtables on PDPL and Cybersecurity Law readiness
12–18 monthsCommit
- Board decision: FIE, JV or stay partner-led, based on ARR and licence needs
- Hire local presales and customer success. Add a second DC site for Vietnam-only DR
- Government and SOE work through licensed prime contractors only
- Goal: ~44 accounts and ~US$1.1M annualised revenue (base case)
Channel & partner programme
- Referral partner: introduces deals. XcellHost contracts and delivers through licensed partners.
- Resell partner: buys the XcellHost catalogue in USD and bills customers in VND.
- Managed-service partner: holds local licences and runs L1. XcellHost runs L2/L3 and the platform.
- DC/cloud partner: provides in-country racks, cloud capacity and the second site for DR.
XcellHost has no published partner-programme page yet. Margins and tiers are for leadership to set. Partner enquiries: contact us.
Pricing & tax approach
- USD price book for partners. Local VND billing by the partner, or by our entity later. Review FX quarterly.
- VAT: rates of 0%, 5% and 10%. A 2-point reduction for certain goods and services runs from 1 Jul 2025 to 31 Dec 2026. Since 1 Jul 2025, foreign suppliers of digital services without a permanent establishment pay 10%41.
- Foreign contractor tax on cross-border services: deemed VAT of 5% or 10% and CIT of 5% or 10%. Software products and services are VAT-exempt. Royalties carry 10% CIT42.
- Rates are as summarised by PwC, reviewed 23 Sep 2026. Get local tax advice per contract.
Marketing
- Vietnamese-language microsite, offer sheets and webinar decks, reviewed by native speakers. No machine-only translation.
- Partner-hosted events in Hanoi and HCMC timed to the trigger calendar: PDPL, Cybersecurity Law and AI Law grace dates.
- Content: a PDPL readiness checklist, a Decree 333 localisation explainer and an AI Law inventory template.
- LinkedIn and partner co-marketing, plus outreach through India–Vietnam business networks.
Sales motions
- Compliance-led: a fixed-fee PDPL and Cybersecurity Law readiness assessment that leads into managed services.
- Follow the customer: Indian and regional FDI manufacturers with plants in Vietnam.
- Training-led: AI cohorts that open AI platform and RAG projects.
- Co-sell: with partners, plus AWS and Microsoft, where XcellHost runs the managed layer.
Team (assumption)
| Role | Base | From |
|---|---|---|
| Country lead (Vietnamese-speaking) | HCMC or Hanoi | Month 0 |
| Partner managers ×2 | Hanoi + HCMC | Month 1–6 |
| Solutions architect | Mumbai / remote | Month 0 |
| Privacy & compliance lead | Mumbai + local counsel | Month 0 |
| Presales + customer success | Vietnam | Month 12 |
| Delivery: NOC/SOC L2/L3 | Mumbai 24×7 | Existing team |
KPIs (goals, not forecasts)
| KPI | M6 | M12 | M18 |
|---|---|---|---|
| Active partners | 3 | 5 | 6 |
| Readiness assessments sold | 5 | 12 | 20 |
| Paying accounts | 5 | 20 | 44 |
| Qualified pipeline (US$) | 0.5M | 1.5M | 3M |
| Annualised revenue (US$) | 0.1M | 0.45M | 1.1M |
| Gross margin on managed services | Track from month 1; set the target after pilots | ||
Risks & mitigations
HighLicensing
Managed SOC and assessments need an MPS licence. E-signature trust services need an MST licence.
Mitigation: deliver only through licensed partners until a JV or entity holds licences.HighData localisation
Decree 333 and the Data Law restrict where data sits and how it moves.
Mitigation: Vietnam-first hosting, a documented TIA for any Mumbai processing, and Vietnam-only designs for core data.MediumFast-moving rules
AI and cyber decrees landed in 2026, and more are expected.
Mitigation: a quarterly legal review with local counsel, and refreshes to this page.MediumPrice competition
Domestic telcos own capacity and bundle connectivity.
Mitigation: lead with managed security, digital trust and AI skills, not raw compute.MediumHyperscaler expansion
The AWS Local Zone is live. Google and Alibaba DCs are expected from 2027.
Mitigation: co-sell, and manage hyperscaler estates instead of competing on IaaS.MediumLanguage & talent
Enterprise buying happens in Vietnamese, and skilled staff are scarce.
Mitigation: a native country lead, localised content, and partner engineers trained by XcellHost.LowerFX & collections
Changes in VND, INR and USD rates, plus partner credit risk.
Mitigation: a USD price book, prepaid or quarterly billing, and partner credit limits.LowerPower cost in DCs
BMI reports DCs moved to commercial tariffs in Feb 2026, with opex up more than 50%7.
Mitigation: pass-through clauses, and placing GPU workloads in Mumbai where the law allows.Tool · SOM / revenue model
Model the 18-month revenue
Segments × target accounts × win rate × annual contract value (ACV). Every default is an assumption for discussion, not a forecast. Change any cell and the totals, the TAM/SAM/SOM block and the goals at the top update.
| Vertical | Target accounts | Win rate % | ACV (US$) | Won | Revenue (US$) |
|---|---|---|---|---|---|
| Total | 0 | — | — | 0 | 0 |
Obtainable revenue (SOM) · assumption
US$0
≈ ₹0
Accounts won0
Blended ACVUS$0
SAM (TAM × SAM %)US$0
SOM as % of SAM0%
Illustrative. TAM = sum of IMARC 2025 estimates (sources 2, 4, 10, 13). Not a financial forecast.
Tool · vertical × service heatmap
Where each pillar lands hardest
Switch the view. Service fit counts how many of a vertical's top-10 services fall in each pillar, from our own mapping. Regulatory pull counts the laws in the table above that drive that pillar in that vertical. Both are our assessment, not market data. Click a cell to see its services.
Select a cellThe mapped services and the laws driving that pillar appear here.
Why XcellHost for Vietnam Go-to-Market Strategy
Since 199927 years of managed cloud and security from Mumbai
Tier IV data centreMumbai home for DR, tooling and non-restricted workloads
ISO 9001 · 27001 · 27017 · 27018 · 20000-1SOC 2 Type I & II · MeitY empanelled
24×7 NOC & SOCSecond-line support behind licensed Vietnamese partners
Microsoft Gold PartnerM365, Entra, Defender and Sentinel depth
Six pillars, one providerCloud to digital trust to AI training, so partners resell one catalogue
Context: India–Vietnam trade reached about US$16.46B in 2025, up 10.5%17. Indian companies already operating in Vietnam are a natural first customer segment.
FAQ
Questions partners will ask
Short answers based on the laws and sources above. Not legal or tax advice.
Not for phase 1. The plan sells through Vietnam DC partners and licensed SI/MSP partners. DC and cloud services allow 100% foreign ownership under the 2023 Telecommunications Law, and offshore cloud providers notify the Vietnam Telecommunications Authority before serving. Licensed services such as managed SOC and e-signature trust services stay with licensed partners until a JV or entity decision at about month 12.
Sometimes, but not by default. Vietnam-incorporated companies must store certain user data in Vietnam under Decree 333/2026. Any personal data sent abroad needs a transfer impact assessment under the Personal Data Protection Law. Core data under the Law on Data needs prior approval. So in-scope data stays in a Vietnam partner DC, and Mumbai is used for tooling, DR of non-restricted workloads and workloads cleared after assessment.
Not without a licence. Decree 332/2026 requires a Ministry of Public Security business licence for cyber security services. It sets a Vietnamese-national legal representative and minimum qualified staff: 5 for assessment and consulting, 12 for monitoring. XcellHost therefore delivers SOC as the platform and second line behind a licensed Vietnamese partner.
The AI Law took effect on 1 March 2026 with high, medium and low risk tiers, labelling of AI-generated media and a local-presence rule for certain high-risk providers. Systems already in use have until 1 March 2027, or 1 September 2027 in health, education and finance. Customers will need an AI inventory and risk classification, which is a natural opening for AI governance advisory and training.
Legally recognised Vietnamese digital-signature certification is a licensed trust service. The provider's system must be in Vietnam, and as of mid-2025 no foreign certification provider had been recognised. We would partner with a licensed Vietnamese CA for document signing. PKI, HSM, certificate-lifecycle management, crypto-posture and post-quantum readiness services do not need that trust-service licence.
Cross-border services can attract foreign contractor tax: deemed VAT of 5% or 10% and CIT of 5% or 10%, with software VAT-exempt and royalties at 10% CIT, as summarised by PwC (reviewed 23 Sep 2026). Since 1 July 2025, foreign suppliers of digital services without a permanent establishment pay 10% VAT. Get advice per contract structure.
Analysts define markets differently. For cyber security, one estimate is US$1.37 billion for 2025 and another is US$322.6 million. Data-centre capacity ranges from about 60 MW of colocation in two cities to 221 MW across 41 facilities. We show both ends with sources and do not average them.
No. The 18-month goals and the revenue model use assumptions for target accounts, win rates and contract values, chosen to start a discussion. Change them in the revenue model. Only the market-size, legal and macro figures come from cited third parties.
Sources
Every number, traceable
Accessed 3–4 Nov 2026. The dates shown are publication or review dates where the source gives one.
- Vietnam Investment Review — "Vietnam's digital economy to touch $39 billion in 2025" (e-Conomy SEA 2025, Google · Temasek · Bain) · 26 Nov 2025
- IMARC Group — Vietnam Cloud Computing Market (US$3,967.1M 2025 → US$9,662.3M 2034; CAGR 10.08%) · accessed 4 Nov 2026
- P&S Intelligence — Vietnam Cloud Computing Market (US$3.5B 2025 → US$8.6B 2032; CAGR 13.7%) · accessed 4 Nov 2026
- IMARC Group — Vietnam Cybersecurity Market (US$1,371.6M 2025 → US$4,365.0M 2034; CAGR 13.32%) · accessed 4 Nov 2026
- P&S Intelligence — Vietnam Cybersecurity Market (US$322.6M 2025 → US$926.8M 2032; CAGR 16.3%) · accessed 4 Nov 2026
- U.S. International Trade Administration — Vietnam Data Centers (MST: 41 DCs, 221 MW; Statista DC revenue ~US$2.2B 2025) · 26 Aug 2025
- TechNode Global — BMI: Vietnam emerges as SEA's next data-centre contender · 20 Jul 2026
- Tuoi Tre News — Vietnam eyes data-center investment boom (JLL: ~60 MW in Hanoi + HCMC, 2025) · 28 Mar 2026
- P&S Intelligence — Vietnam Data Center Market (US$1,416.2M 2025 → US$4,371.4M 2032; CAGR 17.5%) · accessed 4 Nov 2026
- IMARC Group — Vietnam Artificial Intelligence Market (US$865.1M 2025 → US$2,999.0M 2034; CAGR 14.37%) · accessed 4 Nov 2026
- Vietstock / Bizhub — Việt Nam targets ASEAN AI hub status by 2030 (National AI Strategy approved 28 Aug 2026) · 9 Sep 2026
- Vietnam Law Magazine — National strategy for AI research and application approved (Decision 127/QD-TTg) · 5 Feb 2021
- IMARC Group — Vietnam E-Learning Market (US$2.0B 2025 → US$8.7B 2034; CAGR 17.68%) · accessed 4 Nov 2026
- AWS What's New — General availability of a new AWS Local Zone in Hanoi, Vietnam · 19 Jun 2026
- DatacenterDynamics — Google explores plans for Vietnam data center (citing Reuters; Google declined to comment) · undated on page
- VnEconomy — FPT invests US$200 million in NVIDIA partnership · 23 Apr 2024
- VnEconomy — Vietnam–India bilateral trade hits historic high (~US$16.46B in 2025, +10.5%) · 14 Jan 2026
- Vietnam Briefing (Dezan Shira) — Vietnam Economic Performance in 2025 (GSO data) · updated 22 Jan 2026
- Allen & Gledhill — Vietnam's new Cybersecurity Law to come into effect 1 July 2026 · 22 Jan 2026
- Duane Morris Vietnam — Law on Cybersecurity 2026: what you must know · 8 Jan 2026
- Duane Morris Vietnam — Cybersecurity reset: three new decrees (331, 332, 333/2026) · 27 Aug 2026
- EY Vietnam — Legal alert: Decree No. 333/2026/ND-CP · 18 Sep 2026
- LuatVietnam — Decree 333/2026/ND-CP (English text page) · dated 19 Aug 2026
- LuatVietnam — The latest Law on Personal Data Protection and its guiding documents (Law 91/2025, Decree 356/2025) · accessed 4 Nov 2026
- Tilleke & Gibbins — Vietnam's new Personal Data Protection Law: a closer look · 27 Aug 2025
- Chambers and Partners — New regulations on data management (Law on Data 60/2024, Decision 20/2025) · 6 Oct 2025
- Digital Policy Alert — Decree No. 165/2025/ND-CP implementing the Data Law · event 30 Jun 2025
- Vietnam Law Magazine — Law on E-Transactions (20/2023/QH15) · accessed 4 Nov 2026
- LuatVietnam — Decree 23/2025/ND-CP on e-signatures and trust services · issued 21 Feb 2025
- Tilleke & Gibbins — Regulations on e-signatures and trust services in Vietnam · 10 Jul 2025
- Baker McKenzie — Vietnam digital technology law: legal foundations and incentives · 18 Jul 2025
- Baker McKenzie — Vietnam Artificial Intelligence Law: foundation and outlook · 24 Feb 2026
- Apolat Legal — Law on Artificial Intelligence 2025, No. 134/2025/QH15 · accessed 4 Nov 2026
- Ministry of Science and Technology — First-ever Law on Artificial Intelligence approved · 15 Dec 2025
- Global Compliance News (Baker McKenzie) — Vietnam passes new telecoms law regulating data center, cloud and OTT · 20 Dec 2023
- Tilleke & Gibbins — New decree provides guidance on Vietnam's telecom law (Decree 163/2024) · 6 Jan 2025
- Viet Tonkin Consulting — Vietnam data center market opens fully to foreign investors (Law 24/2023/QH15) · accessed 4 Nov 2026
- Tilleke & Gibbins — A closer look at Vietnam's Decree 147 on internet services and online information · 20 Feb 2025
- Mondaq (Tilleke & Gibbins) — Vietnam steps up information security for banks (Circular 09/2020) · 10 Nov 2022
- Tilleke & Gibbins — Circular 50 strengthens security for online banking in Vietnam · 13 Jan 2025
- PwC Worldwide Tax Summaries — Vietnam: other taxes (VAT) · reviewed 23 Sep 2026
- PwC Worldwide Tax Summaries — Vietnam: withholding taxes (foreign contractor tax) · reviewed 23 Sep 2026
- Pound Sterling Live — USD/INR 2026 history (close 95.1675 on 26 Oct 2026) · accessed 4 Nov 2026
- Vietnam Law Magazine — Resolution 57-NQ/TW on breakthroughs in S&T, innovation and digital transformation · accessed 4 Nov 2026
- Duane Morris Vietnam — Resolution No. 68-NQ/TW on private-sector development · 27 May 2025
- Viet Nam News — Nationwide rollout of e-medical records misses target (~760 of 1,650 hospitals) · 1 Oct 2025
- The Investor — Broker VNDirect set to resume operations after ransomware attack (24 Mar 2024) · 29 Mar 2024
- Wikipedia — Ministry of Information and Communications (Vietnam): merged into MST, 18 Feb 2025 · accessed 4 Nov 2026
- Google Cloud — State Bank of Vietnam Circular 09/2020 compliance resource · accessed 4 Nov 2026
- Microsoft Windows Server Blog — Planning ahead for Windows Server 2016 end of support (12 Jan 2027) · accessed 4 Nov 2026
- DNSimple — SSL certificate validity changes 2026–2029 (CA/B Forum ballot SC081v3) · accessed 4 Nov 2026
Disclaimer
This is an internal and partner strategy briefing, not a public offer. It is not legal, tax, investment or financial advice. Market figures come from the cited third parties, which may use different scopes and methods. Law summaries are based on law-firm and official commentary available on 4 Nov 2026. Vietnamese rules are changing fast, so check every point with qualified Vietnamese counsel and tax advisers before any investment or contracting decision. Goals and revenue-model values are assumptions for discussion, not forecasts. XcellHost service pages describe the Indian offer; Vietnamese delivery, licensing and pricing will be set with partners. Third-party names are used for identification only and do not imply partnership or endorsement.