VietnamDecree on administrative sanctions for personal data protection violations
In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance, DPIA, Breach notice, Transfer
As of .
What it requires
- Prepare and keep a personal data processing impact assessment dossier at the enterprise's premises before processing personal data, and send one original to the Department of Cybersecurity and High-Tech Crime Prevention of the Ministry of Public Security within 60 days of the first day of processing.
- Notify the specialized personal data protection agency within 72 hours of discovering a violation of personal data protection rules that harms or may harm national defense, security, social order and safety, or the life, health, honor, dignity or property of the data subject.
- Prepare a cross-border personal data transfer impact assessment dossier before or during the transfer, and file one original with the specialized personal data protection agency within 60 days of the first day of transfer.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Article 56(3) prices a cross-border transfer that exposes or loses the data of 10,000 or more Vietnamese citizens at up to 5 percent of the organization's total revenue in the Vietnamese market in the preceding financial year, and Article 56(4) applies fixed fines, up to VND 3,000,000,000, where the organization had no revenue in the Vietnamese market or the percentage fine would be below VND 3,000,000,000.
- Rule
- Higher of
- As of
- Currency
- VND
- Fixed cap
- 3,000,000,000
- Turnover percentage cap
- 5
Who enforces it
Enforcement body
The People's Public Security, whose personnel hold the fining powers set out in Article 72.
What this law does
Decree No. 330/2026/ND-CP of the Government sets administrative sanctions for violations in the fields of cybersecurity and personal data protection. Article 80 states that the Decree takes effect from . Article 2(1) covers Vietnamese and foreign individuals and organizations that commit an administrative violation in cybersecurity and personal data protection within Vietnam's territory.
Under Article 7(4)(c), the maximum fine for personal data protection violations other than buying or selling data and cross-border transfer is VND 3 billion. Under Article 7(4)(d), those maxima apply to organizations, and an individual who commits the same act faces half the organizational maximum. Article 53(1) fines unlawful buying or selling of personal data from two times up to ten times the amount received.
Under Article 56(3)(a), a cross-border transfer that exposes or loses the personal data of 10,000 to under 100,000 Vietnamese citizens is fined 1 to 2 percent of the organization's total revenue in the Vietnamese market in the preceding financial year. Under Article 56(3)(b), the fine is 2 to 3 percent of that revenue where the exposure or loss reaches 100,000 to under 1,000,000 Vietnamese citizens.
Under Article 56(3)(c), the fine is 3 to 5 percent of that revenue where the exposure or loss reaches 1,000,000 Vietnamese citizens or more. Where the organization had no revenue in the Vietnamese market in the preceding financial year, or the percentage fine falls below VND 3,000,000,000, Article 56(4) sets fixed fines in its place, up to VND 3,000,000,000. Article 56(5)(b) adds a suspension of cross-border transfer of personal data for 6 to 12 months for the Article 56(3) violations.
Article 55(1) fines VND 20,000,000 to 30,000,000 an organization that begins processing personal data without preparing and keeping a processing impact assessment dossier. Article 54(3) fines VND 40,000,000 to 60,000,000 a controller, controller-processor or third party that notifies the specialized personal data protection agency later than 72 hours after discovering a harmful violation.
Article 72(1) lets a People's Public Security soldier on duty fine up to 10 percent of the maximum fine in the field of personal data protection.
When LexLint raises it
When your app profile says your app processes personal data.