Scenario: On Monday morning, the IT team of an e-commerce company spotted abnormal access logs: signs that an intruder had exfiltrated a database containing names, phone numbers, emails and addresses of some 40,000 customers. Management split into two camps: one wanting to “handle it quietly internally”, the other worried about legal obligations. 72 hours pass fast — and the law does not allow a company to look away to buy time.
1. The “72-hour” duty: notify whom, counted from when?
Under Article 23.1 of the Personal Data Protection Law 91/2025/QH15 (effective 01/01/2026), when a personal data controller (or a controller-cum-processor, or a third party) discovers a violation of personal data protection rules that may cause harm to national defense, national security, social order and safety, or infringe the life, health, honor, dignity or property of data subjects, it must notify the specialized personal data protection authority no later than 72 hours from discovery of the violation. A data processor discovering a violation must promptly notify the controller.
Three key points:
- The clock starts at “discovery”, not at the incident. “Discovery” includes the moment the company should have known through its monitoring systems — ignoring alerts or delaying investigation to dodge the 72-hour mark is not permitted;
- Not every incident must be notified — the trigger is “may cause harm” (Art. 23.1). However, even leaked names, phone numbers and emails may require notification if they risk being exploited for fraud. When in doubt, notify — safer than staying silent;
- The receiving authority is the Department of Cybersecurity and Hi-Tech Crime Prevention (A05), Ministry of Public Security — notify online via the National Portal on Personal Data Protection (when operational), in person, or by registered post. If information is incomplete within 72 hours, notify in stages, but the initial notification must be on time and state the reasons for incompleteness.
Alongside notification, the company must prepare minutes confirming the violation, cooperate with the specialized authority in handling it, and prevent the violation and remedy its consequences (Art. 23.2 of Law 91/2025).
2. The first-72-hours checklist: what to do hour by hour
Hours 0–4: contain and preserve evidence
- Isolate the compromised systems (disconnect affected servers from the network, but do not power them off immediately so as to preserve logs in RAM);
- Preserve all access logs and a copy of the database as of discovery — evidence for both the authorities and future compensation claims;
- Activate the internal incident response team (IT, legal, communications, leadership).
Hours 4–24: assess scope and determine legal role
- Identify the breached data types (ordinary contact data vs. sensitive data such as location or biometrics — see section 4) and the number of affected data subjects;
- Determine the company’s role: controller, processor or third party — notification duties differ (the processor promptly notifies the controller; the controller bears the 72-hour duty to the specialized authority);
- Review contractual incident-notification obligations to customers and partners.
Within 72 hours: prepare minutes and notify A05
- Prepare minutes confirming the violation;
- Send the initial notification to A05 within 72 hours of discovery, with a prevention and remediation plan;
- Continue investigating and supplement the notification in stages as more information emerges.
In parallel within 72 hours: the customer channel and technical remediation
- Prepare notification to affected customers — both reputation-risk management and a contractual duty, tied to data subjects’ right to know under Law 91/2025 (data subjects have the right to be informed and to claim compensation);
- Review and patch security vulnerabilities; reassess the entire system;
- Work with counsel on civil compensation exposure — administrative remediation does not exclude civil liability.
3. Failure to notify or late notification: fines under Decree 330/2026
Decree 330/2026/ND-CP on administrative sanctions in cybersecurity and personal data protection (effective 19/8/2026 — the official instrument) provides in Article 54:
- Failure to notify the specialized authority: VND 20–40 million;
- Notification more than 72 hours late: VND 40–60 million;
- Concealing or misreporting the violation: VND 10–20 million;
- Failure to prevent or remedy consequences: VND 60–80 million.
These fines apply to organizations; fines for individuals are half the organizational level. Maximum framework for personal data protection (Art. 7.4): trading in personal data is fined up to 10 times the illicit gains; unlawful cross-border transfer of personal data up to 5% of the preceding year’s revenue; other violations up to VND 3 billion. Note: VND 3 billion is the cap for “other violations” — not every breach draws VND 3 billion.
At the criminal level: in serious cases, conduct may be considered for criminal liability under Article 288 of the Penal Code (illegal provision or use of information on computer or telecommunications networks — up to VND 1 billion or imprisonment up to 07 years). This article states it only as “may be considered”, not as a certainty for every breach.
4. Special case: location and biometric data
Under Article 29 of Decree 356/2025/ND-CP detailing Law 91/2025, where location or biometric data is breached, the company must notify the affected data subjects within 72 hours and retain related records for at least 05 years — an additional duty alongside notification to the specialized authority.
5. The new legal framework: do not cite old instruments
From 01/01/2026, Law 91/2025/QH15 replaced the primary regulatory framework — Decree 13/2023/ND-CP retains only transitional value under Article 39 of the Law. This article does not cite Decree 13/2023 as a current basis. Likewise, the Cybersecurity Law 116/2025/QH15 (effective 01/7/2026) replaced the 2018 Cybersecurity Law and the 2015 Law on Network Information Security; its guiding instrument is Decree 333/2026/ND-CP.
FAQs
Only names and phone numbers leaked, no sensitive data — must we notify A05?
It depends on the “may cause harm” condition in Art. 23.1. Names + phone numbers + emails can readily be exploited for fraud, so in most real cases notification is still warranted. When in doubt, notifying is safer than not.
Do the 72 hours run from the attack or from discovery?
From discovery — including when the company should have known through its monitoring systems. Deliberately looking away does not pause the clock.
What if the investigation is incomplete within 72 hours?
Send the initial notification with available information, state why it is incomplete, then supplement in stages. The critical point is that the first notification meets the 72-hour deadline.
We are a data processor for a partner — what is our duty?
A processor discovering a violation must promptly notify the controller; the 72-hour duty to the specialized authority rests with the controller (or controller-cum-processor / third party as prescribed). Review the contract between the parties to clarify roles and coordination.
After paying the administrative fine, can customers still sue for compensation?
Yes. Data subjects have the right to claim compensation under Law 91/2025 — administrative compliance does not exclude civil liability.
Legal sources
- Personal Data Protection Law 91/2025/QH15 (effective 01/01/2026): Art. 23.1–23.2 (72-hour notification duty; minutes; cooperation, prevention, remediation); Art. 7 (prohibited acts); Art. 39 (transition — Decree 13/2023 loses primary regulatory role).
- Decree 356/2025/ND-CP detailing Law 91/2025 (effective 01/01/2026): Art. 29 (location and biometric data — notify subjects within 72 hours, retain records ≥ 05 years).
- Decree 330/2026/ND-CP on administrative sanctions in cybersecurity and personal data protection (effective 19/8/2026): Art. 54 (no notification VND 20–40m; >72h late VND 40–60m; concealment/misreporting VND 10–20m; no prevention/remediation VND 60–80m); Art. 7.1, 7.4 (organizational fines double individual; caps of VND 3bn / 10x gains / 5% revenue).
- Cybersecurity Law 116/2025/QH15 (effective 01/7/2026): replacing the 2018 Cybersecurity Law and the 2015 Law on Network Information Security; Decree 333/2026/ND-CP guiding.
- Penal Code: Art. 288 (illegal provision/use of network information — stated as may-be-considered).
Has your company just discovered a customer data breach, or do you want to review your personal data protection obligations before an incident occurs? Reach us via the Contact page of FLAT Law Firm for advice on the 72-hour response process and building a compliance system under the Personal Data Protection Law.
The legal content of this article was reviewed by FLAT’s AI Legal Council and submitted to the owner for approval; it is not an opinion of a licensed lawyer and does not replace legal advice for specific cases.
For reference only, not legal advice.