Data breach liability in Vietnam runs on three tracks: administrative fines, civil compensation and criminal prosecution, and the Personal Data Protection Law No. 91/2025/QH15 (PDPL) keeps all three open (Article 8(1)). What surprises most foreign groups is who sits on each track. The Vietnamese subsidiary is the entity that gets fined and the entity customers sue, even when an employee or a vendor caused the leak. But under the Criminal Code in force today, a company cannot be prosecuted for any of the data offences. Criminal exposure is personal: the employee who sold the data, the manager who directed it, the intruder who stole it.
This guide maps data breach liability in Vietnam for a foreign-invested company: what the entity faces, what individuals face, how compensation to data subjects is measured, how losses can be pushed back to group companies and processors, and where the regime departs from the GDPR. It reflects the texts in force on 27 October 2026, while the National Assembly is debating a new Criminal Code. Fine ranges are covered in our handbook on PDPL penalties, and the notification mechanics in the 72-hour data breach rule. Neither is repeated here.
The three tracks of data breach liability in Vietnam#
The PDPL prohibits "appropriating, intentionally disclosing or causing the loss of personal data" (Article 7(7)). Separately, a controller must apply appropriate management and technical measures and is "responsible to the data subject for damage caused in the course of processing" (Article 37(1)(c) and (g)). A careless leak or a successful cyberattack therefore still engages the company's liability: most administrative violations do not require intent, while the criminal offences do.
| Track | Who can be liable | Main basis | Practical threshold |
|---|---|---|---|
| Administrative | The company; an individual who commits a violation personally (at half the organisation's fine) | PDPL Article 8; Decree 330/2026/ND-CP | One-year limitation period for sanctions (Decree 330, Article 3(1)) |
| Civil | The company as controller, towards data subjects; then recourse against the employee or processor at fault | Civil Code Articles 584, 585, 592, 597, 600; PDPL Article 37(1)(g) | Actual damage must be proved; three-year limitation period (Civil Code Article 588) |
| Criminal | Individuals only | Criminal Code Articles 288, 289, 291 | Intentional conduct reaching thresholds of illicit gain, damage or consequences; commercial legal entities are outside these offences (Article 76) |
Article 8(1) of the PDPL says a violator "may be administratively sanctioned or criminally prosecuted", in the alternative. In our reading this prevents double punishment of the same act by the same person, but it does not stop the subsidiary being fined for weak security while an employee is prosecuted for selling the data. Those are different acts by different persons.
Can the Vietnamese subsidiary be prosecuted for a data breach?#
Not under the current Criminal Code. Vietnam has had corporate criminal liability since 2018, but only for the offences listed in Article 76: smuggling, tax evasion, money laundering, certain environmental and market offences, and a few others. None of the provisions used for data cases is on the list:
- Article 288, unlawfully providing or using information on computer or telecommunications networks. Point (b) of clause 1 covers buying, selling, exchanging, giving away, altering or making public the lawful private information of an organisation or individual on a computer or telecoms network without the owner's permission. It is a crime only where the illicit gain is VND 50 million or more, the damage is VND 100 million or more, or the conduct "causes adverse public opinion that lowers the reputation" of the person concerned. The basic penalty is a fine of VND 30 million to 200 million, non-custodial reform for up to three years, or six months to three years in prison, rising to two to seven years in the aggravated bracket (clause 2).
- Article 291, unlawfully collecting, storing, exchanging, trading or publishing bank account information. The threshold is far lower: information on 20 accounts, or an illicit gain of VND 20 million. Payment and fintech businesses should look at this one first.
- Article 289, unauthorised intrusion into a computer network or electronic device. This targets the attacker, not the company that was attacked.
Even for listed offences, an entity is liable only where the act was committed in its name, for its benefit and with its direction, management or approval (Article 75(1)), and its liability does not exclude that of individuals (Article 75(2)). So if local management decides to sell a customer list to a partner, the managers involved face prosecution under Article 288 if the elements are met, and the company faces fines and damages claims.
Which individuals carry data breach liability in Vietnam?#
The Criminal Code applies to every offence committed in Vietnam, whatever the nationality of the offender (Article 5(1)). An expatriate general director is in the same position as local staff.
Employees. An employee who leaks customer data can face:
- an administrative fine of VND 20 million to 30 million for collecting, using, disclosing or accessing another person's data without authorisation and causing damage (Decree 330, Article 42(2)(a), which states the amount "for individuals"), or half the organisation's fine under Article 53 if the data was sold (Article 7(1));
- prosecution under Article 288 or 291 where the thresholds are met, with an aggravated bracket for abusing network administration rights (Article 288(2)(b)), which matters for IT staff;
- dismissal, if the internal labour rules list the conduct. The Labour Code allows dismissal for disclosing business or technology secrets or causing serious damage to the employer's property or interests where the internal labour rules provide for it (Article 125(2)), and no discipline is allowed for conduct the rules, contract or law do not cover (Article 127(3)). Customer data is not named, so the rules should name it;
- a claim to reimburse what the company paid out (Civil Code Articles 597 and 600). In setting the amount, the employee's fault, the actual damage, and their family circumstances and assets must be taken into account (Labour Code Article 130(1)), so full recovery from an individual is rare.
Directors and managers. A manager who commands or instigates the sale of data is a co-offender, as organiser or instigator (Criminal Code Article 17(3)); where there is close collusion between the participants (Article 17(2)), organised commission is an aggravating factor under Article 288(2)(a). We have found no provision in Decree 330 that fines a director or legal representative personally for the company's own violation. A manager who neither knew nor took part is not criminally liable simply because of the position held.
The DPO. The PDPL and Decree 356/2025/ND-CP assign tasks to the personal data protection staff or unit but set no separate sanction for them when the company suffers a breach. In our reading, an internal or outsourced DPO answers to the company under the employment or service contract, unless the DPO personally commits a violation. Group policies that make the local DPO "accountable" for breaches create an internal allocation, not a statutory one.
Compensation to data subjects after a breach#
Data subjects have the right to complain, sue and claim damages (PDPL Article 4(1)(dd)). The claim is brought under the Civil Code:
- Basis. Infringing another person's lawful rights and interests and causing damage (Article 584(1)). Article 38 protects private life and personal secrets, requires consent to collect, use or publish such information, and bars contracting parties from disclosing each other's personal secrets learned in the course of the contract.
- Material loss must be compensated in full and promptly (Article 585(1)): money stolen with leaked account details, the cost of replacing cards or documents.
- Harm to honour, dignity or reputation covers reasonable mitigation costs, lost income and a sum for mental suffering, which, absent agreement, is capped at ten times the statutory base salary per person (Article 592). With the base salary at VND 2,530,000 per month from 1 July 2026, that is VND 25.3 million per person. In our reading this head applies only where the leak actually harms honour, dignity or reputation (for example health data or details of private life); the Civil Code has no separate damages rule for breach of privacy (Article 38), and the cap is a ceiling absent agreement, not a per-person tariff.
- Reductions. No compensation for the share of loss caused by the data subject's own fault, or by failing to take reasonable steps to limit it (Article 585(4) and (5)).
- Several wrongdoers are jointly liable, apportioned by fault (Article 587).
- Limitation. Three years from the date the claimant knew or should have known of the infringement (Article 588). A breach notice to customers will usually start that clock.
Where an employee causes the loss while performing assigned work, the company pays first and then seeks reimbursement (Articles 597 and 600). If the employee sold data for private gain, the company may argue the act fell outside assigned duties. In our view that argument is weak where the company granted wider access than the job needed, because the over-broad access is itself a breach of the company's own duty under PDPL Article 37.
Administrative exposure: what caps apply to the subsidiary#
The administrative caps in the PDPL are per organisation and are not linked to group turnover (Article 8(3) to (6)): VND 3 billion for most violations; up to ten times the revenue from the violation for buying or selling personal data; up to 5% of the organisation's prior-year revenue for cross-border transfer violations. Individuals face half these caps. Decree 330 sets the fine for each violation within those caps, at organisation level, and halves it for individuals (Article 7(1) and (4)).
For a breach, the provisions most likely to be used against the subsidiary are the failure to deploy appropriate protection measures that leads to data being exposed or lost (Article 47(2)(a)), the lack of internal controls to stop staff sharing data with third parties without authorisation (Article 52(1)(b)), weak cloud security and cloud contracts (Article 69(1)(b) and (2)), and the notification failures in Article 54. The only revenue-based fine for a leak sits in Article 56(3): 1% to 5% of total revenue in the Vietnamese market in the preceding financial year, where data is transferred abroad without a transfer impact assessment, or the data flow is concealed or misdeclared, and this leads to the exposure or loss of data of 10,000 or more Vietnamese citizens, with a fixed fallback of VND 200 million to 3 billion where there is no Vietnamese revenue or the percentage yields less than VND 3 billion (Article 56(4)). Finance, banking and credit information businesses that fail to notify both the authority and the affected customers within 72 hours of a leak of sensitive data face VND 50 million to 70 million (Article 64(1)(a)). Ranges for each provision are in the PDPL penalties handbook.
A foreign parent should not assume it is outside the decree. Decree 330 applies to foreign organisations that "directly participate in or are related to" the processing of personal data of Vietnamese citizens (Article 2(1) and (2)(dd)). Article 2(1) covers violations committed within Vietnam, so how far this reaches a parent with no presence here is untested. In our reading, a parent that hosts the subsidiary's customer data in a group platform may be treated as a processor or controller in its own right if the platform is the source of the leak.
Shifting data breach liability in Vietnam to group companies and processors#
The PDPL sets the chain: the controller answers to data subjects, and processor liability under the PDPL runs to the controller for damage caused in processing (Article 37(1)(g) and (2)(d)). In our reading this does not bar a data subject from suing a processor in tort under Civil Code Article 584 where it can prove the processor's fault, but in practice claims go to the controller. The controller must also choose a suitable processor (Article 37(1)(dd)). For a Vietnamese subsidiary that relies on group IT, a regional shared-service centre or local vendors, three points follow.
- Intra-group arrangements need to be contracts, not policies. Recourse against a parent or sister company runs through a contract. A data processing agreement or intra-group transfer agreement that fixes roles, security measures, breach reporting and indemnities is the only reliable route. Without one, the subsidiary may also be fined for a transfer agreement that does not allocate protection responsibilities (Decree 330, Article 52(1)(a)).
- Breach reporting from the processor should be contractual and measured in hours. The PDPL only requires the processor to tell the controller "promptly" (Article 23(1)), yet the controller's 72-hour clock runs from its own discovery. Late reporting by a processor is fined at VND 10 million to 20 million (Decree 330, Article 54(1)(a)). The contract needs a deadline that leaves the controller time to file.
- Indemnities should cover what the subsidiary actually pays: notification costs, forensic investigation, compensation to data subjects and, to the extent the law allows them to be passed on, administrative fines. Caps and exclusions copied from a group template that carve out data loss or consequential loss can leave the subsidiary carrying most of the cost. Buyers in M&A should test these clauses in data protection due diligence.
How data breach liability in Vietnam differs from the GDPR#
| Point | GDPR | Vietnam |
|---|---|---|
| Fine ceiling | Up to EUR 10 million or 2%, or EUR 20 million or 4%, of worldwide annual turnover of the undertaking, whichever is higher, depending on the provision infringed | VND 3 billion per organisation for most violations; revenue-based caps only for selling data (ten times the revenue from the violation) and cross-border transfers (5% of the organisation's prior-year revenue); Decree 330 Article 56(3) uses Vietnamese-market revenue |
| Corporate criminal liability | Left to member states (GDPR Article 84) | Not available for data offences under the current Criminal Code; proposed in a 2026 draft of the new Code, final scope not settled |
| Processor liability to data subjects | Processor directly liable where it breached its own obligations or acted outside instructions; joint and several liability with recourse (GDPR Article 82) | Processor answers to the controller (PDPL Article 37(2)(d)); data subjects claim against the controller, with joint liability under the Civil Code where several parties caused the damage |
| Non-material damages | No statutory cap | Mental suffering capped at ten times the base salary per person (Civil Code Article 592) |
| Regulator | Lead supervisory authority under the one-stop-shop | The A05 Department, Ministry of Public Security, and other authorities empowered by Decree 330; no one-stop-shop for groups |
The practical point for a group privacy team: data breach liability in Vietnam rarely means a headline fine, but it does mean a stack of smaller liabilities (fines per violation, remedial orders, per-customer damages, internal discipline, criminal referrals of staff) that land on the local entity. Inspection practice is described in our guide to A05 data protection inspections.
First steps after discovering a breach#
Detailed steps are in the 72-hour rule handbook. To contain data breach liability in Vietnam, four actions matter most:
- Preserve evidence before fixing systems. Logs support the notification to the A05 Department, the criminal complaint against an employee or intruder, and the recourse claim against a vendor.
- Make a written record of the violation (PDPL Article 23(2)); failing to do so is a separate fine (Decree 330, Article 54(1)(b)).
- Notify accurately. Concealing the scale, data categories or number of affected people in a breach report is fined in its own right (Decree 330, Article 54(1)(c)). Notification to affected individuals within 72 hours is mandatory where location or biometric data is involved (Decree 356, Article 29) and, for finance, banking and credit information businesses, where sensitive data is leaked or lost (Decree 356, Article 8(3); PDPL Article 27(1)(d)); the latter carries a fine of VND 50 million to 70 million (Decree 330, Article 64(1)(a)). For other data it is a judgement call, but early notice helps customers limit loss, which also limits what the company owes.
- Put vendors on notice in writing and request their incident report, so the contractual recourse is preserved.
If you need the local entity's contracts, access controls and incident procedures reviewed before something goes wrong, our PDPL compliance consulting covers that work.
