Data protection fines in Vietnam: penalties for personal data violations under the latest Decree 330/2026/ND-CP
Decree No. 330/2026/ND-CP (issued and in force from 19 August 2026) sets out the framework of administrative penalties in the fields of cybersecurity and personal data protection, with a maximum fine of VND 3 billion for organisations; by exception, unlawful buying and selling of personal data may be fined up to 10 times the proceeds, and certain cross-border personal data transfer violations (Clause 3, Article 56) may be fined 1–5% of total revenue in the Vietnamese market for the preceding financial year, within the overall cap of 5% of the preceding year's revenue (Point b, Clause 4, Article 7).
Decree No. 330/2026/ND-CP & Law 91/2025/QH15
Official legal texts
Key takeaways for businesses
- Decree 330/2026/ND-CP is currently the main instrument setting out in detail the violations, administrative penalties and sanctioning powers in the field of personal data protection; criminal liability and civil compensation are governed by other legislation.
- Decree 330 sets fines, remedial measures and additional sanctions for each specific violation; the specific provision must be checked rather than assuming a single suspension period for every violation. Certain cross-border data transfer violations may lead to suspension of data transfer activities for 06 to 12 months (Point b, Clause 5, Article 56).
- An individual who buys, sells, exchanges or discloses personal information over computer or telecommunications networks without permission may be prosecuted under Article 288 of the Criminal Code where the illicit gain is VND 50 million or more, the damage is VND 100 million or more, or the act causes serious public harm; bank account information falls under Article 291. Under the current Criminal Code a company (commercial legal entity) cannot itself be prosecuted for these offences (Article 76).
What are the data protection fines in Vietnam for personal data violations from 2026?
Penalties for personal data violations are a top concern for the business community now that Decree No. 330/2026/ND-CP has formally taken effect from 19 August 2026, establishing a strongly deterrent framework of data protection fines in Vietnam and completely ending the 'reminder, no fine' period. Some older materials still quote figures from the March 2026 consultation draft; always check fines against the adopted decree. The sections below summarise the fine ranges for four typical groups of violations.
What are the data protection fines in Vietnam for processing without consent?
Processing without consent, or not obtaining consent, carries a fine of VND 30–50 million (Clause 1, Article 43), which also covers setting consent as the default or making consent to other purposes a mandatory condition; fine of VND 50–70 million for treating silence as consent or intentionally continuing processing after the data subject has asked for it to stop or be restricted (Clause 2, Article 43).
Collecting personal data using unlawful technological or technical measures (Clause 3, Article 48), calculated by number of data subjects: VND 100–200 million (fewer than 500 data subjects of basic data or fewer than 100 data subjects of sensitive data), VND 200–300 million (500 to under 1,000 / 100 to under 200), VND 300–500 million (1,000 to under 5,000 / 200 to 1,000), VND 500–800 million (5,000 or more data subjects of basic data or 1,000 or more data subjects of sensitive data).
What are the fines for failing to prepare a DPIA or cross-border transfer dossier?
Failing to prepare, maintain or submit a DPIA dossier within 60 days: fine of VND 20–30 million (Clause 1, Article 55); intentionally falsifying figures or providing false information in a DPIA dossier: fine of VND 50–100 million (Clause 2, Article 55).
Cross-border transfer impact assessment dossier: fine of VND 30–50 million (Clause 1, Article 56); no transfer contract, no consent ensured or no security measures: fine of VND 50–100 million (Clause 2, Article 56 of Decree 330/2026/ND-CP). The fine of 1–5% of the preceding year's revenue in the Vietnamese market applies only to certain cross-border personal data transfer violations under Clause 3, Article 56 of Decree 330/2026/ND-CP.
How much is the fine for violating data breach notification rules?
For violations of the data breach notification rules, Article 54 sets ranges of VND 10–20, 20–40, 40–60 and 60–80 million for organisations depending on the conduct; the correct clause and circumstances must be checked.
How is unlawful buying and selling of personal data fined?
Unlawful buying and selling of personal data carries a fine of 2–10 times the unlawful proceeds (Clause 1, Article 53); where there are no proceeds (Clause 3, Article 53): VND 70–100 million (fewer than 1,000 data subjects of basic data or fewer than 200 data subjects of sensitive data), VND 100–300 million (1,000 to under 2,000 / 200 to under 400), VND 300–500 million (2,000 to under 10,000 / 400 to 2,000), VND 500 million–1 billion (10,000 or more data subjects of basic data or 2,000 or more data subjects of sensitive data), and VND 1–3 billion where national defence, security and public order, foreign affairs, the macro-economy, or life, health, honour, dignity or property are harmed.
Summary of data protection fines in Vietnam for common violations
Summary of fines for some common violations
| Group of violations | Fine for organisations | Additional sanctions / remedial measures |
|---|---|---|
| Processing without consent (no consent, pre-set consent, silence treated as consent) | VND 30,000,000 – 70,000,000 (Article 43); collection using unlawful technology: VND 100–800 million depending on the number of data subjects (Clause 3, Article 48) | Confiscation of exhibits and means; compulsory deletion and destruction of data collected or processed without valid consent |
| Failing to prepare / submit a DPIA dossier | VND 20,000,000 – 30,000,000 (falsifying figures: VND 50–100 million) | Compulsory preparation, completion and submission of the dossier; compulsory suspension of processing until the filing obligation is fulfilled (Point b, Clause 3, Article 55) |
| Failing to notify an incident, or notifying later than 72 hours | Ranges of VND 10–20, 20–40, 40–60 or 60–80 million depending on the conduct (Article 54) | Remedial measures under the applicable provision |
| Unlawful buying, selling or exchange of personal data | 2–10 times the unlawful proceeds; where there are no proceeds: VND 70 million–1 billion depending on the number of data subjects, VND 1–3 billion where national defence/security is harmed | Confiscation of exhibits and means; compulsory surrender of proceeds, deletion of the data and notification of affected data subjects (Clauses 4 and 5, Article 53) |
Frequently asked questions
Is it true that the 5%-of-revenue fine applies to every violation?
No. The fine of 1–5% of the preceding year's revenue in the Vietnamese market applies only to certain cross-border personal data transfer violations under Clause 3, Article 56 of Decree 330/2026/ND-CP. Unlawful buying and selling of personal data is fined at 2–10 times the unlawful proceeds, not calculated on revenue.
Which authority has the power to inspect and impose penalties?
The Ministry of Public Security is the lead authority in the field of personal data protection, with the A05 Department as its focal point. However, Chapter III of Decree 330/2026/ND-CP (Articles 72–77) also gives sanctioning powers to chairpersons of People's Committees at all levels, certain inspection forces and officials of sector ministries, including the Ministry of Science and Technology (Article 77). Note: the Ministry of Information and Communications was merged into the Ministry of Science and Technology from 1 March 2025 (the functions of the merged Ministry of Science and Technology are set out in Decree 55/2025/ND-CP).
The Vietnamese original of this entry has been reviewed for legal accuracy against the Personal Data Protection Law No. 91/2025/QH15 and current implementing legislation. This English edition is an unofficial translation for reference; the official legal texts are in Vietnamese.
Meet the LexData teamGo further with LexData
Personal data protection compliance review
Work with our lawyers on the filings and documents, end to end.
Learn about the service