Enterprises that collect or process personal information, relationship data or data created by users in Vietnam must protect it and store it in Vietnam. Decree 333 lists the data (users' personal information; account names, usage time, card information, email, latest login and logout IP addresses, registered phone numbers). Domestic enterprises must store it in Vietnam; foreign enterprises in telecom, cloud storage and sharing, domain services, e-commerce, online payment, ride-hailing, social media, online games, online applications and messaging or calling services must do so and open a branch or representative office when their service has been used for violations and, after 3 written requests over up to 6 months, they have not remedied or complied, within 12 months of the Minister of Public Security's decision. Storage runs for at least 24 months, in a form the enterprise chooses that allows timely retrieval.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.