- Drafted by: the Ministry of Public Security
- Public consultation: 16 to 26 March 2026
- Outcome: adopted, with substantial changes, as Decree 330/2026/ND-CP on 19 August 2026
- Source: Ministry of Public Security portal — draft dossier (Vietnamese)
Warning: archive only, do not use for current obligations. The fines in this draft differ significantly from the final text. For example, the draft capped fines at VND 2 billion for organisations and applied 5% of revenue to many types of violation. The final Decree 330/2026/ND-CP sets a general cap of VND 3 billion for organisations (half for individuals) and uses revenue-based fines only for certain cross-border transfer violations. Do not cite figures from this page. Use the Decree 330/2026/ND-CP page instead.
Legal basis in the draft
The Law on Handling Administrative Violations of 2012 (as amended in 2020), the Law on Cybersecurity of 2018 and the Law on Personal Data Protection of 26 June 2025, on the proposal of the Minister of Public Security.
Chapter I: General provisions
Article 1. Scope
The draft covered violations, types and levels of penalty, remedial measures and the power to record violations and impose penalties in cybersecurity and personal data protection. It grouped violations into:
- principles of personal data protection and data subject rights;
- protective measures and impact assessments (DPIA);
- transfers of personal data abroad;
- cybersecurity of information systems.
Article 2. Types of penalty and maximum fines
- Main penalties: a warning or a fine.
- Proposed caps for personal data protection violations: VND 1 billion for individuals and VND 2 billion for organisations, or up to 5% of total revenue in Vietnam in the preceding financial year for certain serious violations (such as large-scale leaks of sensitive data or unlawful transfers abroad).
Chapter II: Violations, penalties and remedial measures (as drafted)
Article 3. Data subject rights
- VND 20–40 million for not notifying data subjects about the processing of their data.
- VND 50–100 million for obstructing or not acting on requests to withdraw consent, delete or provide data within the statutory time.
Article 4. Data processing impact assessment (DPIA)
- VND 80–120 million for not preparing, or incompletely preparing, the DPIA dossier.
- VND 100–200 million for not sending the assessment report to the Ministry of Public Security (A05 Department) on time.
Article 5. Transfers of personal data abroad
- VND 300–500 million for not preparing the overseas transfer impact assessment dossier.
- 1% to 5% of total revenue in the preceding financial year for transferring Vietnamese citizens’ sensitive personal data abroad without meeting security conditions or without the approval of the competent authority.
Chapter III: Implementation
Article 6. Responsibility for implementation
The Ministry of Public Security, other ministries, People’s Committees at all levels and the organisations and individuals concerned would implement the Decree once issued.
For the penalties that actually apply, see Decree 330/2026/ND-CP and data protection fines in Vietnam.
