Scenario: a marketing firm is offered “marketplace customer data”: 500,000 profiles with names, phone numbers, addresses and purchase histories — for VND 200 million. The seller is a former employee of a marketplace who smuggled the data out. What sanctions face buyer and seller?
Trading personal data: prohibited and heavily fined
The Personal Data Protection Law 91/2025/QH15 and Decree 356/2025/ND-CP (effective 1 January 2026, replacing Decree 13/2023/ND-CP) impose a strict framework for personal data. Unlawful trading of personal data is prohibited; violators face administrative fines of up to 5% of prior-year revenue (Article 8, Decree 356/2025/ND-CP) — enough to wipe out many businesses’ profits. In the scenario, the data-smuggling employee breaches confidentiality duties and may face criminal prosecution where criminal elements are met (e.g., information-safety offences under the 2015 Penal Code); the marketing firm buying “black-market” data violates rules on collecting and using personal data without legal basis.
Lawful data sharing: consent is the boundary
Not all sharing is banned — the boundary is legal basis. Businesses may share or transfer personal data to partners where: data subjects have consented (consent must be specific and clear for each sharing purpose); or another legal basis exists (e.g., performing a contract with the data subject, complying with legal duties). Cross-border sharing (to parent companies, foreign partners) faces extra conditions: cross-border transfer impact assessments, with transfers subject to suspension orders (Article 20, Decree 356/2025/ND-CP). In practice, marketplaces sharing customer data with carriers and payment gateways is routine — lawful where within contract performance and disclosed in privacy policies.
Platform liability when data is smuggled out
Platforms are not automatically innocent when employees smuggle customer data. Data controllers and processors must apply proportionate safeguards: access controls, access logging, encryption, staff training. Where a platform lets an employee extract 500,000 profiles without controls, that is a data-protection failure — risking administrative fines, plus duties to notify data subjects and authorities of the incident. Affected individuals may claim damages under the 2015 Civil Code upon proving loss from the leak.
Frequently asked questions
Is buying “data” for telesales a violation?
Yes, where data was collected or traded without data-subject consent. Black-market-data telesales breaches both data-protection law and anti-spam-call rules.
An ex-employee takes customer data to a new company?
It breaches confidentiality duties — even post-employment, where the information is a trade secret or personal data under contractual or NDA duties. The new company using it also violates for lacking lawful collection basis.
Can anonymised data be sold?
Properly anonymised data (no re-identification possible) is no longer personal data and may be used and shared. But half-hearted anonymisation (removing names while keeping phone numbers and detailed addresses) remains personal data — trading it still violates.
This article has been quality-reviewed by the FLAW AI Legal Council.
