On 19 August 2026, the Government issued Decree No. 330/2026/ND-CP on administrative penalties for violations in the fields of cybersecurity and personal data protection (“Decree 330”). Effective immediately upon issuance, Decree 330 comprises 82 articles, of which 33 articles specifically provide for violations in the field of personal data protection.

Following multiple draft versions, Decree 330 officially brings the legal framework on personal data protection into the enforcement phase by completing the sanctioning mechanism for non-compliance with the Law on Personal Data Protection No. 91/2025/QH15 and Decree No. 356/2025/ND-CP.

This legal alert analyses notable provisions of Decree 330 on personal data protection and identifies the key legal risks and compliance priorities for enterprises.

1. A multi-tiered sanctions framework

One notable feature of Decree 330 is its combination of three mechanisms for determining the applicable fines: (i) fixed fine ranges applicable to specific violations; (ii) fines calculated based on the proceeds derived from the violation; and (iii) fines calculated based on revenue.

Specifically, for organisations: (i) the unlawful purchase or sale of personal data may be subject to a fine of up to 10 times the proceeds derived from the violation; (ii) certain serious violations relating to cross-border personal data transfers may be subject to a fine of up to 5% of the revenue of the immediately preceding year; and (iii) other violations in the field of personal data protection are subject to a maximum fine of VND 3 billion. Individuals committing the same violations are subject to fines equal to one-half of the fines applicable to organisations.

Where the fine is determined based on the proceeds obtained from the violation, such proceeds are calculated based on the aggregate transaction value or the total actual revenue generated from business activities involving the use of the personal data subject concerned, without deducting any costs incurred. Accordingly, the financial exposure may be significantly greater than the actual net profit earned by the enterprise.

In addition to monetary fines, Decree 330 also provides for additional sanctions and remedial measures that may directly affect business operations, including mandatory destruction or deletion of data in a manner that renders the data irrecoverable; suspension of personal data processing activities or cross-border personal data transfers; or suspension of service provision. For data-dependent enterprises, these measures may cause more significant operational disruptions than the monetary fines themselves.

2. Key categories of violations and sanctions for enterprises to note

2.1. Consent

Under Decree 330, enterprises may be subject to fines ranging from VND 30 million to VND 50 million for establishing a default consent mechanism; providing unclear or misleading instructions between consent and non-consent; using a consent mechanism that does not allow the data subject to consent separately to each processing purpose; or failing to notify the personal data subject that their sensitive personal data is being processed. Treating silence or non-response as consent, or deliberately continuing to process personal data after a request to stop or restrict processing, may be subject to a fine ranging from VND 50 million to VND 70 million. In addition, these violations may result in the confiscation of means used for the violation and the mandatory destruction or deletion of all data collected or processed on the basis of invalid consent.

In light of the above, compliance with consent requirements does not merely concern an enterprise’s collection and retention of evidence of consent, but also the manner in which its consent collection mechanisms are designed and operated. Enterprises should review their consent forms and consent collection methods, particularly personal data processing consent forms, cookie banners, and data collection interfaces, to ensure that the choices of data subjects are clear, affirmative, verifiable, and separately obtained for each processing purpose.

2.2. Data subjects rights and response time limits

Failure to establish procedures, forms, or allocation of responsibilities; failure to respond to a valid request within 2 working days; or failure to process a request within the statutory time limit may attract a fine between VND 10 million and VND 40 million. Enterprises may also be required to fully implement the request and provide evidence to the competent authority.

For enterprises, these provisions demonstrate that ensuring the rights of personal data subjects must be translated into specific operational procedures, including mechanisms for receiving and handling requests, allocating responsibilities among parties involved in personal data processing, and ensuring the ability to fulfill requests throughout the personal data processing chain, rather than merely recognising such rights in a personal data protection policy.

2.3. Collection, disclosure, transfer, and deletion or destruction of personal data

Collection of personal data beyond the permissible scope or purpose, or without consent, may result in a fine ranging from VND 30 million to VND 50 million; where sensitive personal data is involved, the fine may increase to VND 50 million – VND 80 million. The use of technological or technical means to unlawfully collect personal data may be subject to a fine ranging from VND 100 million to VND 800 million, depending on the type of personal data and the number of affected data subjects.

Disclosure of personal data without a lawful basis, beyond what is necessary, or without appropriate control measures may be subject to a fine of up to VND 50 million. Failure to delete or destroy personal data in cases where such deletion or destruction is mandatory; unauthorised restoration of deleted or destroyed personal data; or re-identification of de-identified data may be subject to a fine of up to VND 60 million.

With respect to personal data transfers, enterprises should clearly identify the roles of the parties involved, the types of data, the purposes of processing, the retention period, data protection responsibilities, and mechanisms for exercising the rights of data subjects. The transfer of sensitive personal data without applying physical security measures, encryption, anonymization, or other appropriate security measures may be subject to a fine of up to VND 80 million and mandatory destruction or deletion of the data where its security cannot be assured.

2.4. Notification of personal data breaches

Decree 330 distinguishes between the general notification obligation and the 72-hour notification obligation applicable to breaches that cause or may cause harm to national defense, national security, social order and safety, or infringe upon the life, health, honor, dignity, or property of data subjects. Failure to provide notification within 72 hours in such cases may be subject to a fine ranging from VND 40 million to VND 60 million; failure to take preventive or remedial measures or to cooperate with the specialised authority may be subject to a fine of up to VND 80 million.

As the 72-hour period is calculated from the time the breach is detected, enterprises should have mechanisms in place to classify incidents from the outset, clearly define decision-making authority, and ensure timely coordination among relevant departments and functions.

2.5. Impact assessment dossier

Failure to prepare, maintain, submit, or update the Personal Data Processing Impact Assessment Dossier (“DPIA”) within the prescribed time limits may attract a fine of between VND 20 million and VND 30 million. Falsifying data, providing inaccurate information, or refusing to complete the dossier as requested may attract a fine of up to VND 100 million. In addition, enterprises may be required to suspend their personal data processing activities until they have fulfilled the relevant obligations and obtained confirmation from the specialised authority.

With respect to the Cross-Border Personal Data Transfer Impact Assessment Dossier (“DTIA”), procedural violations may be subject to a fine ranging from VND 30 million to VND 50 million. More substantive violations – such as failing to put in place a written instrument allocating responsibility between the party transferring and the party receiving personal data across borders, failing to ensure a valid basis for consent or notification, failing to implement appropriate security measures, obstructing inspections, continuing the transfer after being requested to stop, or failing to cooperate in handling incidents occurring at the receiving party – may be subject to a fine ranging from VND 50 million to VND 100 million, before the revenue-based fines are considered for serious cases.

Compared with the draft published in March 2026, Decree 330 has significantly reduced the fines for violations relating to DPIA/DTIA, while also removing the provision that multiplied the applicable fine based on the number of affected data subjects. Nevertheless, the risk of being required to suspend personal data processing or cross-border personal data transfers until the relevant dossier is completed may still have a direct impact on an enterprise’s business operations.

2.6. Personal data protection personnel and service providers

Agencies and organisations are required not only to issue a document appointing personal data protection personnel or establishing a personal data protection department, but also to define their functions, duties, and powers; enter into confidentiality agreements; organise training; and ensure that the personal data protection personnel meet the prescribed educational and experience requirements. Violations may be subject to a warning or a fine of up to VND 30 million, together with mandatory replacement of personnel who fail to meet the applicable requirements.

Decree 330 also imposes sanctions on organisations and individuals providing personal data protection services or engaging in the business of personal data processing services where they fail to satisfy the applicable conditions, exceed the scope of their contracts, unlawfully access or use personal data, or continue to conduct business after their certificate has been revoked. The fine may be up to VND 100 million, accompanied by suspension of operations for 6 – 12 months and mandatory deletion of the personal data.

3. Sector- and technology-specific sanctions

Decree 330 establishes specific sanctions for vulnerable data subjects (including children, persons who have lost or have limited legal capacity, and persons with difficulties in perception or behavioural control), as well as for recruitment and employment, healthcare and insurance, advertising, finance and banking, social networks, big data, artificial intelligence, blockchain, cloud computing, location and biometric data, and audio and video recording in public places. Some notable provisions include:

• Recruitment and employment: collecting candidates’ personal data beyond the recruitment purpose; failing to delete or destroy the personal data of unsuccessful candidates; monitoring devices or using cameras without notifying employees; or using employees’ personal data collected through unlawful technological or technical means may attract a fine of up to VND 100 million.

• Advertising: failure to provide an opt-out mechanism; unlawful use of sensitive personal data or children’s personal data; or tracking behavior or personalising advertisements without consent may attract a fine of up to VND 70 million and suspension of the provision of advertising services for up to 6 months.

• Finance and banking: violations of obligations relating to incident notification, logging, and annual compliance assessments; or using personal data for credit scoring without consent may attract a fine of up to VND 100 million and suspension of the provision of relevant services for up to 6 months.

• Social networks: failure to provide a cookie opt-out mechanism; requiring users to provide identification documents for account verification where identification is not required under specialised laws; or secretly extracting contacts or files may attract a fine of up to VND 150 million and suspension of service provision for up to 6 months.

• Artificial intelligence, big data, and cloud computing: violations of requirements concerning periodic compliance assessments, transparency in automated processing, human oversight, risk classification, access controls, encryption, and binding requirements applicable to service providers and subcontractors may attract a fine of up to VND 100 million and suspension of the relevant system for up to 6 months.

• Vulnerable data subjects: failure to delete or destroy children’s personal data where such deletion or destruction is mandatory may attract a fine of up to VND 200 million and suspension of personal data processing for up to 6 months.

4. What should enterprises do

Decree 330 took effect immediately upon its issuance and does not provide a transitional period for enterprises to complete their compliance systems. Accordingly, enterprises should prioritise the following actions:

• Map sanction risks;

• Review mechanisms for obtaining consent from data subjects;

• Establish procedures for handling data subject requests;

• Complete the DPIA and DTIA dossiers;

• Conduct a 72-hour incident response simulation;

• Update contracts and monitor third parties;

• Review sector- and technology-specific requirements;

• Ensure the competence and authority of personal data protection personnel.