As per Circular 18/2018/TT-NHNN, Article 21 issued by the State Bank of Vietnam, data within information systems categorized as level 2 or higher necessitate an automated backup plan commensurate with the frequency of data modifications. This plan must adhere to the principle that newly generated data must be backed up within a 24-hour timeframe. The backup data must be stored on external storage mediums, such as tapes, hard disks, optical discs, or comparable storage mediums, and securely archived, separate from the area of installation of the information system.
For information systems rated at level 2 or higher, it is mandatory to conduct a review and restore process for backup data from external storage mediums at least every six months. In instances where organizations possess both primary and backup information systems situated beyond the borders of Vietnam, they are obligated to store personal information and customer transaction data originating in Vietnam, in compliance with the stipulations of Vietnamese law.