Vietnam introduces new penalties for cybersecurity and personal data protection violations

27 October 2026

On 19 August 2026, Vietnam issued Decree No. 330/2026/ND-CP on administrative penalties for violations in the fields of cybersecurity and personal data protection (“Decree 330”), which took effect on the same day. Decree 330 establishes penalties and remedial measures for violations of Vietnam’s cybersecurity and personal data protection requirements, including those under the Law on Cybersecurity No. 116/2025/QH15 and the Law on Personal Data Protection No. 91/2025/QH15.

Decree 330 is particularly relevant to businesses that collect, process, or transfer personal data in Vietnam, including multinational companies that share employee, customer, or other personal data with overseas affiliates or service providers. It introduces financial penalties for a range of compliance failures, including failures to (1) obtain valid consent; (2) maintain required impact assessment documentation; (3) notify authorities of personal data breaches; and (4) implement appropriate safeguards for cross-border data transfers. Certain violations may also result in the suspension of business activities or data processing operations.

This article discusses some of the key provisions of Decree 330 for businesses and foreign investors.

Scope and penalties

Decree 330 applies to Vietnamese and foreign individuals and organisations that commit administrative violations within its prescribed territorial scope. The organisations covered expressly include foreign enterprises and their branches, representative offices, and business locations providing telecommunications, internet, information technology, cybersecurity, online content, and cross-border services. Foreign organisations directly involved in or connected with the processing of personal data of Vietnamese citizens and certain other persons residing in Vietnam are also subject to the Decree.

The Decree distinguishes between cybersecurity and personal data protection violations when determining fines. For cybersecurity violations, the fines prescribed in Sections 1 to 5 of Chapter II apply to individuals, with organisations subject to twice the corresponding amount. Conversely, the fines for personal data protection violations in Section 6 apply to organisations, with individuals subject to half the prescribed amount.

The maximum fines for organisations are as follows:

Category of violation	Maximum fine
Cybersecurity violations	VND200 million
Unlawful purchase or sale of personal data	10 times the revenue obtained from the violation
Violations concerning cross-border personal data transfers	5% of the organisation’s revenue for the immediately preceding year
Other personal data protection violations	VND3 billion

Where the proceeds-based or revenue-based maximum is below VND3 billion, or there are no relevant proceeds or revenue, the Decree specifies VND3 billion as the applicable maximum.

In addition to monetary fines, Decree 330 provides for supplementary penalties, including the suspension of operations or specified licences for periods of between one and 24 months, where prescribed for the relevant violation. Remedial measures may include deleting unlawfully processed personal data, correcting information, implementing additional security measures, and surrendering proceeds obtained through unlawful activities.

Key provisions

Cross-border transfers of personal data

One of the most significant aspects of Decree 330 for multinational businesses is its treatment of cross-border personal data transfers. These transfers are relevant to common business arrangements involving overseas headquarters, regional shared service centres, cloud service providers, and other foreign recipients of personal data.

Decree 330 provides for fines ranging from VND30 million to VND50 million for failures concerning cross-border transfer impact assessment documentation. These include failing to prepare the required impact assessment, failing to submit it to the competent authority within 60 days from the first day of transfer, failing to update or maintain the assessment records as required, and failing to establish mechanisms to control onward transfers to third parties where this results in the processing of Vietnam citizen personal data outside the scope declared in the assessment.

Higher fines of VND50 million to VND100 million apply to certain other violations, including failing to establish appropriate contractual arrangements between the transferring and receiving parties, failing to obtain required consent or provide information concerning overseas transfers, failing to implement appropriate security measures, and failing to cooperate with inspections. The same penalty range applies to continuing transfers after the competent authority has ordered them to stop.

More substantial penalties apply to specified cross-border transfer violations, including transfers without the required impact assessment, concealing or falsely declaring data flows resulting in the disclosure or loss of personal data, and continuing transfers following a suspension decision. The Decree provides for revenue-based penalties calculated by reference to the organisation’s total revenue in the Vietnam market in the preceding financial year, with the applicable percentage depending on the number of Vietnam citizens affected or the nature of the violation.

Violation	Applicable fine
Disclosure or loss of personal data affecting 10,000 to fewer than 100,000 Vietnam citizens	1%-2% of revenue
Disclosure or loss affecting 100,000 to fewer than one million Vietnam citizens	2%-3% of revenue
Disclosure or loss affecting one million or more Vietnam citizens, or continued transfers after a suspension decision causing harm to national defence and security	3%-5% of revenue

Where the organisation has no revenue in the Vietnam market in the immediately preceding financial year, or the calculated revenue-based penalty falls below the specified threshold, Decree 330 prescribes alternative fines according to the severity of the violation, ranging from VND200 million to VND3 billion. Serious violations may also result in suspension of cross-border personal data transfer activities for six to 12 months.

For multinational groups, these provisions highlight the importance of understanding how personal data is transferred between Vietnamese operations, overseas affiliates, and external service providers. Businesses should also review their intra-group arrangements and third-party contracts to ensure that appropriate safeguards are in place, including provisions governing onward transfers of personal data and the responsibilities of overseas recipients in the event of a data breach or other violation.

Personal data processing and consent

Decree 330 prescribes fines ranging from VND20 million to VND40 million for violations of basic personal data protection principles. These include processing personal data beyond the specified purpose or what is necessary to achieve that purpose, failing to ensure data accuracy, and retaining personal data for longer than necessary, unless otherwise permitted by law. Businesses may also be required to delete unlawfully processed data, correct inaccurate records, and surrender gains obtained from certain violations.

The Decree also addresses deficiencies in obtaining and recording consent. Fines ranging from VND30 million to VND50 million apply to violations such as using default consent settings, failing to provide clear information about processing purposes, failing to obtain separately identifiable consent for each processing purpose, and failing to maintain records demonstrating that consent was obtained. Higher fines of VND50 million to VND70 million apply to deliberately continuing processing after a request to stop or restrict it, or treating a data subject’s silence as consent.

These provisions are relevant to businesses that rely on standardised customer registration processes, online consent forms, employee privacy notices, and digital marketing platforms. Existing arrangements should be assessed to determine whether consent is sufficiently specific, demonstrable, and consistent with the purposes for which personal data is subsequently used.

Personal data processing impact assessments

Decree 330 establishes penalties for failures to comply with personal data processing impact assessment requirements. A fine of VND20 million to VND30 million may be imposed for commencing personal data processing without preparing or maintaining the required impact assessment documentation, failing to submit the assessment report within 60 days from the commencement of processing, or failing to update the documentation as required.

More serious violations, including deliberately falsifying information in an impact assessment report or refusing to correct or complete the report when requested by the competent authority, attract fines of VND50 million to VND100 million. The Decree also provides for remedial measures requiring businesses to prepare, complete, and submit the necessary documentation. For specified failures to maintain impact assessment documentation, processing may be required to cease until the relevant obligations have been fulfilled and confirmed by the competent authority.

Personal data breaches and incident reporting

Decree 330 imposes fines for failures to report and address personal data protection violations. A fine of VND10 million to VND20 million applies to certain failures, including a processor’s failure to promptly notify the relevant controller of a violation and a controller’s failure to document a personal data protection violation. The same penalty range applies to deliberately concealing or providing false information in reports concerning data breaches or leaks.

Fines of VND20 million to VND40 million apply to specified failures to notify the competent personal data protection authority. A higher fine of VND40 million to VND60 million applies to notifications made more than 72 hours after discovering violations that cause or may cause certain serious harm, including harm to national security or the rights and interests of data subjects. Failures to implement remedial measures or cooperate with the competent authority may attract fines of VND60 million to VND80 million.

Businesses should ensure that internal incident response procedures provide for the timely identification, escalation, and assessment of potential personal data protection violations, particularly where IT security, legal, and compliance functions are managed outside Vietnam.

Protection of personal data in recruitment and employment

Decree 330 prescribes penalties for violations involving the personal data of job applicants and employees. Fines ranging from VND20 million to VND50 million apply to practices such as collecting personal data unrelated to recruitment, using applicants’ data for other purposes without their agreement, and failing to delete or destroy the data of unsuccessful applicants unless otherwise agreed.

Fines of VND50 million to VND70 million apply to certain violations involving employee data, including retaining such data beyond the permitted period and implementing workplace monitoring technologies, such as tracking software or surveillance cameras, without adequately informing employees. Unlawfully processing or using employee data collected through technological or technical measures may attract fines of VND70 million to VND100 million.

These provisions are particularly relevant to multinational businesses with centralised human resources systems, regional recruitment functions and workplace monitoring arrangements. Employers should consider whether existing recruitment and employee data management practices comply with the applicable requirements, including those relating to transparency, retention, and deletion.

Personal data protection in advertising and digital services

Businesses providing advertising services face specific penalties for the unlawful collection and use of personal data. Fines of VND30 million to VND50 million apply to violations including using basic personal data to distribute advertisements without consent, failing to provide mechanisms for users to refuse advertisements or withdraw consent, and continuing to share user profiles for advertising after users have opted out.

Higher fines of VND50 million to VND70 million apply to violations involving sensitive personal data, behavioural or targeted advertising without consent, and advertising using the personal data of children under 16 without the consent of their legal representatives. Relevant advertising services may also be suspended for periods of one to six months, depending on the violation.

Separately, Decree 330 imposes obligations on providers of social media platforms, online communication services, and digital content platforms. Violations include failing to provide transparent privacy policies and user controls over personal data, as well as certain forms of unauthorised data collection. Depending on the violation, fines range from VND50 million to VND150 million, and affected services may be suspended for up to six months in Vietnam.

Personal data protection in cloud computing and AI

Decree 330 also addresses personal data protection violations involving cloud computing and AI, two areas of particular relevance to businesses adopting digital technologies across their operations.

For cloud computing, fines of VND20 million to VND50 million apply to violations including failing to clearly define data processing responsibilities in contracts between cloud service providers and their customers, failing to impose appropriate obligations on subcontractors, and failing to establish personal data retention and deletion policies. Higher fines of VND50 million to VND70 million apply to failures involving technical and organisational safeguards, including encryption of personal data in storage and transmission and controls against unauthorised access. These provisions expressly address both cloud service providers and organisations using cloud computing services.

For AI systems, Decree 330 prescribes fines for failures to conduct annual personal data protection compliance assessments and implement measures relating to transparency, risk classification, data subject rights, and system security. Fines range from VND20 million to VND100 million depending on the violation. Certain serious violations involving AI systems may also result in suspension of the relevant systems or platforms for three to six months.

Businesses incorporating AI tools or cloud-based technologies into their operations should therefore consider not only the security of the systems being deployed, but also their contractual arrangements, data processing practices, and mechanisms for demonstrating compliance.

Implications for businesses

Decree 330 gives greater enforcement significance to Vietnam’s existing cybersecurity and personal data protection requirements by specifying the financial and operational consequences of non-compliance. For multinational businesses, the most substantial financial exposure arises from certain cross-border personal data transfer violations, while other provisions make failures in day-to-day data governance, consent management, employee data processing, and incident reporting subject to specific penalties.

Businesses operating in Vietnam may wish to review their personal data processing activities, paying particular attention to cross-border data flows, the completeness of impact assessment documentation, arrangements with overseas affiliates and third-party service providers, and internal procedures for responding to personal data protection incidents. Businesses using cloud computing, AI, or digital advertising technologies should also assess the specific requirements applicable to those activities.

The potential consequences of non-compliance extend beyond monetary fines. The possibility of restrictions on data transfers, suspension of particular services, and mandatory deletion of personal data means that certain violations could materially disrupt business operations, particularly where Vietnamese operations depend on shared regional or global technology infrastructure.