From 19 August 2026, Decree 330/2026 sets a new fining framework for personal-data violations: VND 20 million to VND 3 billion, up to 5% of revenue for unlawful cross-border transfers. This enforces the Personal Data Protection Law 91/2025 — not Decree 13/2023.
The current frame: Law 91/2025 + Decree 330/2026
The Personal Data Protection Law 91/2025/QH15 (effective 1 January 2026) replaced the old Decree 13/2023 regime; Decree 356/2025/ND-CP guides implementation. On sanctions, Decree 330/2026/ND-CP (effective 19 August 2026) governs administrative penalties for cybersecurity and personal-data violations — 4 chapters, 82 articles.
The principle: organisations pay double the individual rate for the same act (individuals = half). Beyond fines: licence/practice-certificate suspension of 1–24 months plus remedial measures (mandatory takedown, recall and destruction of data).
Specific fines under Decree 330/2026
- VND 20–40 million (organisations): processing beyond registered scope/purpose; failing data accuracy; overlong retention; failing to prevent/coordinate on violations.
- VND 30–50 million (organisations): processing without the data subject’s consent; disclosing personal data without consent or harming subject rights.
- VND 40–60 million (organisations): obstructing data-protection activities; misusing others’ data for unlawful acts.
- VND 50–70 million (organisations): treating silence/non-response as consent — consent “dark patterns” fined separately.
- Buying/selling personal data: up to 10x the illicit proceeds.
- Unlawful cross-border transfer: up to 5% of the preceding year’s revenue.
- Maximum: VND 3 billion (organisations) / 1.5 billion (individuals).
Compared with the GDPR: where Vietnam stands
The GDPR (EU): up to EUR 20 million or 4% of global turnover (whichever is higher) — the world’s heaviest data fines. Vietnam’s VND 3 billion (~EUR 110,000) maximum and 5% of revenue (cross-border transfers only) remain far lower.
But do not be complacent: 5% of revenue is enormous for large groups; and the tightening trend is clear — the 2026 framework fines multiples more than the Decree 13/2023 era (mostly warnings plus generic-decree fines). Multinationals should apply the highest standard (usually GDPR) group-wide instead of “one standard per country”.
Beyond administrative fines: criminal and civil liability
Data violations do not stop at administrative fines:
- Criminal: large-scale buying, appropriating or disseminating personal data, or causing serious consequences, can trigger criminal prosecution (privacy-invasion and unlawful information-handling offences).
- Civil: data subjects may sue for damages — reputational, moral and material harm from leaks.
- Reputation: published sanction decisions plus mandatory takedowns — brand damage usually exceeds the fine.
What businesses must do to stay unfined
- Consent audit: every collection flow needs clear consent — remove “silence means consent” mechanics and pre-ticked boxes now.
- Impact assessments: data-processing and cross-border-transfer impact assessments before rollout.
- Internal assignment: designate a data-protection unit/officer, issue internal rules, train staff.
- Incident response: a detect–contain–notify–remediate leak playbook; drill it periodically.
- Contracts: data-protection clauses with outsourced processors.
When inspected or complained against
When authorities inspect or a data subject complains: cooperate fully — obstruction is separately fined at VND 40–60 million. Keep ready: impact assessments, consent evidence, processing logs, incident-response procedures. Cooperation + complete files ground mitigation arguments. And never destroy documents during inspection — an aggravating circumstance.
Frequently asked questions
What is the maximum data-violation fine?
VND 3 billion for organisations (1.5 billion for individuals) under Decree 330/2026; unlawful cross-border transfers up to 5% of preceding-year revenue; data trading up to 10x proceeds.
What is the fine for processing without consent?
VND 30–50 million for organisations; half for individuals. Treating silence as consent: VND 50–70 million (organisations).
Is Decree 13/2023 still in force?
No — the Personal Data Protection Law 91/2025 (effective 1/1/2026) replaced it; Decree 356/2025 guides implementation and Decree 330/2026 (effective 19/8/2026) sets penalties.
How do Vietnamese fines compare with the GDPR?
The GDPR fines up to EUR 20 million or 4% of global turnover — far above Vietnam’s VND 3 billion maximum; but 5% of revenue for cross-border transfers is still large for big groups.
Contact FLAT Law Firm
FLAT Law Firm advises on personal-data compliance: consent audits, impact assessments and incident-response playbooks under Law 91/2025 and Decree 330/2026. Contact us for a compliance check.
