Scenario: An e-commerce company discovers unauthorised access to its customer database – 10,000 customers’ data (names, phones, addresses, purchase history) stolen and advertised on a hacker forum. Legal asks: under the Personal Data Protection Law, whom must the company notify, by when, and what if it stays silent?
1. Notification duties: to whom and when
Under the Personal Data Protection Law 91/2025/QH15 (effective 1 January 2026) and guidance (Decree 356/2025/ND-CP), on a personal-data protection violation, data controllers/processors must notify the competent authority and data subjects (affected customers) per prescribed procedures. Notice content: data types leaked, number of subjects affected, measures taken/ongoing, customer recommendations (change passwords, beware scams). For 10,000 customers, mass channels are needed (email, SMS, website/app push) – individual calls are infeasible.
2. Staying silent: sanctions
Failing to notify when duty-bound is an aggravating factor and may draw administrative penalties under Decree 330/2026/ND-CP (19 August 2026, on personal-data protection violations). Beyond fines: (a) civil liability – customers suing for damages (scammed via leaked data); (b) reputational damage – a 10,000-customer breach in the press devastates trust; (c) criminal liability (for intentional leaking or facilitation). Covering up is almost always the worst option – later discovery makes every sanction heavier.
3. Impact assessment and remediation: parallel to notification
(a) Assess: identify the leak source (which vulnerability, who accessed), data scope (any sensitive data: ID numbers, bank accounts?), customer risk. (b) Technical remediation: patch, rotate all credentials, audit logs, commission an independent security assessment. (c) Customer support: hotline, account-protection guidance, free credit-monitoring services (if available). (d) Internal review: revisit the data-processing impact assessment and safeguards under Law 91/2025 – also the compliance evidence when dealing with regulators.
Frequently asked questions
Whom must I notify for a 10,000-customer breach?
Under Law 91/2025/QH15 and Decree 356/2025: the competent authority and the data subjects (affected customers) per prescribed procedures. Content: data types, numbers affected, measures taken/ongoing, customer recommendations.
What if I do not notify?
Administrative penalties under Decree 330/2026; civil liability (customer damages suits); grave reputational harm; possible criminal liability for intentional leaking. Covering up is always the worst option.
How do I notify 10,000 customers?
Mass channels: email, SMS, website/app push notifications, plus a public notice on the company website. Be clear: what leaked, what the company did, what customers should do (change passwords, beware impersonation scams).
This article is pending review by the QA Council before publication.
This article has been quality-reviewed by the FLAW AI Legal Council