Law on Personal Data Protection, enforcement and data subject rights

Criminal exposureYes

Private right of actionYes

Criminal exposure note

The Law's own Article 8, Clause 1 cross-references potential criminal prosecution ('examined for penal liability') without itself defining an offense. Vietnam's Penal Code (Law No. 100/2015/QH13, as amended by Law No. 12/2017/QH14), Article 288 ('Illegally providing or using information on computer networks or telecommunications networks'), criminalizes unauthorized buying, selling, exchanging, or disclosing of another person's private information on a computer or telecommunications network, punishable in its most serious tier by a fine of up to roughly VND 1 billion and/or imprisonment of up to 7 years; this is a distinct offense from Article 289 ('Illegal access to another person's computer network, telecommunications network, or electronic device'), which addresses unauthorized system access rather than personal-data trading. The Penal Code article itself rests on secondary Vietnamese-language legal commentary (thuvienphapluat.vn and a provincial police department explainer) rather than on the Penal Code's own primary text.

Penalty structure

Article 8, Clause 5 sets the Law's general/default administrative-fine cap at VND 3,000,000,000 for personal-data-protection violations not specifically covered by Clauses 3 or 4 of the same Article, which is the tier this broader enforcement-and-data-subject-rights instrument is scoped to describe. Two narrower, higher-effect tiers sit in the same Article: Clause 3 caps illegal purchase or sale of personal data at ten times the illicit gain from the violation, and Clause 4 caps cross-border-transfer violations at 5 percent of the organization's prior-year revenue; in both narrower cases, if there is no revenue or illicit gain, or the calculated fine is lower than the Clause 5 cap, the Clause 5 cap of VND 3,000,000,000 applies instead, making the general cap effectively a floor under the two narrower tiers as well as the standalone cap for everything else. Clauses 3-5 fines apply to organizations; Clause 6 caps individual violators at half the organizational maximum.

Rule

Fixed only

As of

2 September 2026

Currency

VND

Fixed cap

3,000,000,000

Enforcement body

The agency in charge of personal data protection under the Ministry of Public Security (Article 33, Clause 1, point a), which also functions as the Government's focal state-management agency for personal data protection generally (Article 36, Clause 2), except within the Ministry of National Defence's own scope of management (Article 36, Clause 3). The Law's own text does not name a specific bureau below the Ministry; secondary commentary (not independently confirmed against Decree No. 356/2025/ND-CP's own primary text) attributes this role to the same Ministry of Public Security unit that administered the predecessor Decree No. 13/2023/ND-CP regime, the Department of Cybersecurity and Hi-tech Crime Prevention (A05).

Obligation class

Governance, Data subject rights