Regulations on penalties for administrative violations in field of personal data protection

October 27^th, 2026

As part of the continued completion of the legal framework on personal data protection in Vietnam, the Government issued Decree No. 330/2026/ND-CP on August 19^th, 2026 (“Decree 330”) on penalties for administrative violations in the fields of cybersecurity and personal data protection, which officially came into effect on August 19^th, 2026. Accordingly, some provisions on penalties for administrative violations in the field of personal data protection are noted as follows:

1. Forms of penalties and remedial measures

1.1. Principal penalties

Decree 330 stipulates 02 forms of principal penalties for administrative violations in the field of personal data protection, including:

- Warning; or

- Fines.

1.2. Additional penalties and remedial measures

(i) Additional penalties:

In addition to the principal of penalties, violating enterprises in the field of personal data protection may also be subject to one or more additional penalties, depending on the violation, such as:

- Suspension of the right to use licenses, practicing certificates in the field of personal data protection for a definite-term;

- Suspension of operations for a definite-term;

- Confiscation of exhibits, means used in violations;

- Deportation of foreigners.

(ii) Remedial measures:

Violating enterprises may also simultaneously be subjected to one or more remedial measures, such as:

- Enforced correction, updating, supplementation personal data for accuracy;

- Enforced destruction, irrecoverable deletion of personal data that is illegally appropriated, traded, exchanged/personal data that is illegally processed, beyond the scope, purpose;

- Enforced suspension of personal data processing activities until fully meeting prescribed compliance requirements;

- Enforced remittance of illegal proceeds from the violations, etc.

2. Sanctioning competence

Decree 330 stipulates the competence to impose penalties and implement remedial measures for administrative violations in the field of personal data protection to the individuals, authorities, based on their functions, duties and areas of jurisdiction, specifically:

(i) People’s Public Security Force;

(ii) President of a commune-level, provincial-level People’s Committee;

(iii) Inspectorates;

(iv) Border Guard;

(v) Coast Guard;

(vi) Authorities performing state management duties in specialized sectors and fields and others: Directors of Departments, Directors of Agencies, Chief of Office of the Ministry, Heads of inspection teams assigned by the Minister of Science and Technology of Vietnam, etc...

3. Administrative penalties for some principal obligations

No.	The obligations	Violations	Forms and levels of penalties*
1	Establishing a governance framework for personal data protection in enterprises	The violations of obligations in the appointment of personnel, department responsible for personal data protection (such as failing to enter into a confidentiality responsibility agreement; failing to issue an official document appointing personnel, a decision establishing the department; appointing personnel who do not meet the requirements in accordance with regulations; etc.).	Depending on the violation, enterprises may be subject to: - Warnings or fines ranging from VND 10 to 30 million; and - The remedial measures.
1		The violations of obligations relating to the establishment of a monitoring mechanism for the processing of personal data without consent (such as failing to establish procedures, regulations for personal data processing; failing to establish a mechanism for receiving, handling feedback, recommendations; failing to implement appropriate personal data protection measures resulting in the disclosure, loss of collected personal data; etc.).	Depending on the violation, enterprises may be subject to: - Fines ranging from VND 10 to 50 million; and - The remedial measures.
2	Security and operations	The violations of obligations in the process of obtaining consent from personal data subjects such as: (i) Processing personal data without consent of the personal data subjects, when the personal data subject has requested to stop, restrict processing or upon a request from a competent authority, etc.; (ii) Concealing, preventing or obstructing the exercise of the personal data subject’s right to withdraw consent; keep processing personal data when the personal data subject has withdrawn consent; failing to send a request to stop personal data processing to the Data Processor/Third Party).	Depending on the violation, enterprises may be subject to: - Fines ranging from VND 30 to 70 million or from VND 20 to 30 million; - The additional penalty such as the confiscation of exhibits, means of the violation; and - The remedial measures.
		The violation of obligations in collecting, storing, disclosing, transferring and deleting, destroying of personal data (such as collecting personal data beyond the scope, purpose; collecting, storing, forming a personal data repository from personal data transfer activities for purposes other than the consented scope; disclosing personal data without a specific purpose; exceeding the necessary scope or disclosing personal data without the data subject’s consent; entering into an agreement on personal data transfer that does not specify the responsibilities of the parties.	Depending on the violation, enterprises may be subject to: - Fines ranging from VND 10 to 80 million or from VND 100 to 800 million; - The additional penalty such as the confiscation of exhibits, means of the violation; and - The remedial measures.
		The violations of regulations on the protection of personal data obtained from some specific activities include: (i) Audio and video recording activities in public places; (ii) Advertising service business; (iii) Recruitment, management, employment of employees; big data processing; artificial intelligence systems, metaverse; cloud computing; (iv) Health information, insurance, financial, banking business activities and credit information activities; (v) Blockchain technology; (vi) Social media platforms, online communication services; personal location data, biometric data.	Fines ranging: - From VND 10 to 50 million for violations under group (i). - From VND 30 to 70 million for violations under group (ii). - From VND 20 to 100 million for violations under group (iii). - From VND 50 to 100 million for violations under group (iv). - From VND 20 to 150 million for violations under group (v). - From VND 50 to 150 million for violations under group (vi). Additionally, enterprises may be subject to the additional penalty of confiscation of exhibits, means of the violation and/or suspension of operations for 01 to 06 months depending on the violation and implement the corresponding remedial measures.
3	Assessment, reporting and compliance	The violations of obligations in notifying violations of personal data protection regulations (such as failing to notify/delay to notify to the relevant parties, the specialized authority; intentionally concealing, providing false information when reporting data leakage incidents; failing to implement measures to prevent violations; failing to remedy the consequences; etc.).	Depending on the violation, enterprises may be subject to: - Fines ranging from VND 10 to 80 million; and - The remedial measures.
		The violations of obligations in assessing the impact of personal data processing (such as failing to prepare, maintain, submit, complete, update/delay to update the personal data processing impact assessment dossier as required by the specialized authority and in accordance with regulations; intentionally falsifying data, providing misleading information in the impact assessment dossier; etc.).	Depending on the violation, enterprises may be subject to: - Fines ranging from VND 20 to 30 million or from VND 50 to 100 million; and - The remedial measures.
		The violations of obligations in assessing the impact of cross-border personal data transfer (such as failing to prepare, submit, complete, maintain, update/delay to update the cross-border personal data transfer impact assessment dossier as prescribed; failing to have a transfer contract/written agreement binding responsibilities; failing to ensure security, safety during personal data transfer; concealing/falsely declaring data flows resulting in the disclosure, loss of personal data; continuing to transfer data after being requested to stop such transfer; etc.).	Depending on the violation, enterprises may be subject to: - Fines ranging (i) from VND 30 to 100 million or (ii) from 1% to 5% of revenue in Vietnam; in cases where enterprises have no revenue in Vietnam/where the fine calculated as a percentage of revenue is less than VND 3 billion, then fines will range from VND 200 million to VND 3 billion; - The additional penalty such as the confiscation of exhibits, means of the violation and/or suspension of operations for 06 to 12 months; and - The remedial measures.
4	Violation of other obligations	In addition to the basic violations above, enterprises may also be subject to administrative penalties for non-compliance with other obligations under personal data protection laws, such as the following violations: (i) Violating obligations toward personal data subjects; (i) Violating obligations in preventing unlawful collection of personal data; (iii) Violating other prohibitions, such as: illegal buying, selling of personal data; processing personal data to create, disseminate, incite, etc. causing disruption to security and public order; (iv) Violating obligations to prevent violations, remedy consequences and cooperate with the specialized personal data protection authority.	Depending on the violation, enterprises may be subject to: - Fines ranging (i) from VND 10 million and more or (ii) from 02 to 10 times the proceeds obtained from the violation if violations involving illegal buying, selling of personal data, if there is no proceeds from the violation, maximum fine of VND 3 billion; - The additional penalty of confiscation of exhibits, means of the violation; and - The remedial measures.
* The fine amounts specified in this section shall apply to administrative violations committed by organizations. In cases where an individual commits the same violation, the fine amount applicable to the individual shall be equal to one-half of the fine amount applied to an organization.

----------------------

Thoroughly understanding the obligations on personal data protection and the regulations on penalties for administration is a key factor in enterprise’s risk management, enabling to proactively prevent legal risks and reduce the risk of operational disruption. Therefore, enterprises should proactively review legal documentations, internal procedures, appoint specialized personnel/departments, develop standard personal data protection procedures in accordance with applicable laws and promptly remedy any existing violations to minimize potential risks.

For legal assistance in the assessment of risks associated with violations of personal data protection obligations, advice on setting up and/or improving the internal personal data protection procedures, please contact LA with the following information:

LEGAL ASSOCIATES LAW FIRM
Address: Room D14, Floor 2, 40 Ba Huyen Thanh Quan, Xuan Hoa Ward, Ho Chi Minh City
Phone number: 028 3930 6949
Email: thaianh.luong@la-vn.com