Legal responsibilities of the Board of Directors and Legal representatives in the event of a personal data breach
When a personal data breach occurs, legal liability may extend beyond the business itself to individuals holding managerial and executive positions. What responsibilities do the Board of Management, the Board of Directors and the Legal Representative bear in such circumstances? Join CBI in exploring the potential administrative and civil liabilities, as well as criminal risks, that may arise for these individuals under applicable laws and regulations.
Illustrative image
1. Personal Data Breaches: From Technical Incidents to Corporate Governance Responsibilities
In the course of business operations, personal data relating to customers, employees and business partners is regularly processed through various internal systems and procedures. Accordingly, incidents involving the leakage or loss of personal data are not merely technical issues but may also give rise to legal and financial consequences, as well as reputational damage to businesses.
Under the Law on Personal Data Protection No. 91/2025/QH15 (hereinafter referred to as the “Law on Personal Data Protection”), particularly Article 37, a Personal Data Controller is responsible for implementing appropriate organisational and technical measures to protect personal data, and reviewing and updating such measures where necessary. It is also required to report violations in accordance with Article 23 and cooperate with competent state authorities in handling violations. These obligations are further elaborated under Decree No. 356/2025/ND-CP.
In addition, Decree No. 330/2026/ND-CP prescribes administrative penalties and remedial measures for violations in the fields of cybersecurity and personal data protection.
Against this backdrop, the Board of Management, Board of Directors and Legal Representative must pay attention not only to incident remediation but also to their responsibilities for corporate governance, supervision and the implementation of compliance obligations. Assigning these responsibilities to the IT department or designated personnel does not mean that the business can transfer all of its legal responsibilities to such departments.
In particular, Articles 13 and 165 of the Law on Enterprises 2020 establish certain obligations for Legal Representatives and enterprise managers in the exercise of their assigned rights and duties. These provisions also provide a basis for assessing the responsibilities of individuals where the management, administration or supervision of personal data protection activities is not properly carried out.
2. Legal Responsibilities of the Board of Management and the Legal Representative
It is necessary to distinguish between the legal liability of a business and the personal liability of its managers. The fact that a business is subject to administrative penalties or incurs compensation obligations does not automatically mean that its Legal Representative, Director or members of the Board of Directors must personally assume the business’s liabilities.
Under Articles 13 and 165 of the Law on Enterprises 2020, the responsibilities of enterprise managers must be assessed based on their positions, scope of authority, assigned duties and actual conduct. Depending on the circumstances, such individuals may face the following liabilities where the entity they represent or manage commits a violation:
a) Administrative Liability and Financial Risks
Under Decree No. 330/2026/ND-CP, organisations and individuals that violate personal data protection regulations may be subject to monetary fines, additional penalties and remedial measures corresponding to each specific violation.
Notably, the Decree prescribes sanctions for certain violations directly associated with the risk of personal data leakage or loss, including:
– Violations of regulations on personal data transfers: Pursuant to Clause 2, Article 52 of Decree No. 330/2026/ND-CP, an organisation may be subject to a fine ranging from VND 30,000,000 to VND 50,000,000 for transferring personal data for a fee to provide services or serve the legitimate interests of the data subject without clearly identifying the roles of the parties involved; failing to restrict the categories of personal data transferred to those necessary for the transfer purposes; or failing to specify the data retention period and delete or destroy the data upon completion of the transfer purposes.
– Violations of regulations on cross-border personal data transfers: Pursuant to Clause 3, Article 56 of Decree No. 330/2026/ND-CP, an organisation that conducts cross-border personal data transfers in violation of applicable regulations, resulting in the leakage or loss of personal data, may be subject to a fine calculated as 1% to 5% of its total revenue in the preceding financial year in the Vietnamese market, depending on the number of affected data subjects. Specifically, the applicable fine rates are:
+ 1%–2% for violations affecting between 10,000 and fewer than 100,000 data subjects;
+ 2%–3% for violations affecting between 100,000 and fewer than 1,000,000 data subjects; and
+ 3%–5% for violations affecting 1,000,000 or more data subjects.
Where the organisation generates no revenue in Vietnam, or where the revenue-based fine is lower than the prescribed minimum, Clause 4, Article 56 provides for alternative fines ranging from VND 200,000,000 to VND 3,000,000,000, depending on the circumstances.
– Violations of obligations to notify and handle personal data breach incidents: Pursuant to Clauses 1, 2, 3 and 4, Article 54 of Decree No. 330/2026/ND-CP, organisations may be subject to the following penalties:
+ From VND 10,000,000 to VND 20,000,000 for failing to provide timely notification, failing to prepare an incident record, or concealing or providing inaccurate information about an incident;
+ From VND 20,000,000 to VND 40,000,000 for failing to notify the specialised authority of violations of personal data protection regulations;
+ From VND 40,000,000 to VND 60,000,000 for providing notification after the statutory 72-hour deadline in cases where such deadline applies;
+ From VND 60,000,000 to VND 80,000,000 for failing to prevent or remedy the consequences of an incident or cooperate with the specialised authority.
Accordingly, depending on the nature and scale of the violation, a business may face not only administrative fines amounting to billions of Vietnamese dong or calculated as a percentage of its revenue, but also remedial measures as prescribed by law. In this regard, the Legal Representative is the individual who directly represents the business in providing explanations to and implementing administrative penalty decisions issued against the business.
b) Civil Liability and Compensation for Damages
Pursuant to Point g, Clause 1, Article 37 of the Law on Personal Data Protection 2025, a Personal Data Controller is responsible to data subjects for damages arising from personal data processing activities. A Personal Data Processor must also discharge its corresponding responsibilities in accordance with its role and obligations prescribed under Article 37 of this Law.
In addition, Articles 584 and 585 of the Civil Code 2015 prescribe the grounds for and principles governing compensation for non-contractual damages. Accordingly, an organisation or individual whose conduct infringes upon the lawful rights and interests of another party, causes damage and satisfies the statutory conditions for compensation must compensate the affected party in accordance with applicable laws.
Where damage arises from the conduct of an individual belonging to a juridical person in the course of performing duties assigned by that juridical person, Article 597 of the Civil Code 2015 provides for the juridical person’s liability to compensate for the damage, while reserving its right to request the individual at fault to reimburse an amount in accordance with the law.
With respect to enterprise managers, Article 165 of the Law on Enterprises 2020 requires members of the Board of Directors, Directors, General Directors and other enterprise managers to perform their assigned rights and duties honestly, diligently and to the best of their ability in order to protect the lawful interests of the company. Where a manager breaches these obligations and causes damage to the company, such manager may incur personal liability in accordance with applicable laws.
Therefore, where a manager deliberately disregards risk warnings, fails to fulfil supervisory obligations within their scope of responsibility, or otherwise breaches management duties, thereby causing damage to the business, their personal liability may be assessed pursuant to Article 165 of the Law on Enterprises 2020 and other relevant legal provisions.
c) Risks of Suspension of Operations and Disruption to Business Activities
Pursuant to Clause 2, Article 4 of Decree No. 330/2026/ND-CP, depending on the nature and severity of a violation, organisations and individuals may also be subject to additional penalties, including temporary revocation of licences or practising certificates for a period of between 01 and 24 months, or suspension of operations for a period of between 01 and 24 months. However, such additional penalties may only be imposed in respect of specific violations expressly prescribed under the Decree.
With respect to cross-border personal data transfers, Article 56 of Decree No. 330/2026/ND-CP also provides for corresponding enforcement measures, including temporary suspension of cross-border personal data transfer activities in circumstances prescribed by law.
Furthermore, for certain personal data processing activities conducted in violation of applicable regulations, Decree No. 330/2026/ND-CP also provides for measures requiring the cessation of personal data processing activities until the violations have been remedied and the relevant conditions under the law have been satisfied.
Such measures may significantly affect business activities that rely heavily on data, including online platform operations, marketing, customer care and human resource management. Accordingly, the risk of suspension is not merely an administrative enforcement matter but may also disrupt business operations and cause economic losses.
3. Urgent Obligations of the Executive Management in the Event of a Personal Data Breach
Upon detecting an incident indicating a potential violation of personal data protection regulations, the Board of Management and the individuals responsible for managing the business should promptly direct the relevant departments to implement incident response measures, mitigate potential damages and fulfil statutory notification obligations.
The following obligations warrant particular attention:
a) Providing Notifications Within Statutory Time Limits and Safeguarding the Lawful Rights and Interests of Data Subjects
Pursuant to Clause 1, Article 23 of the Law on Personal Data Protection 2025, where a violation of personal data protection regulations is detected and is likely to cause harm to national defence, national security, social order or safety, or infringe upon the life, health, honour, dignity or property of data subjects, the Personal Data Controller, Personal Data Controller and Processor, or a third party must notify the specialised personal data protection authority no later than 72 hours from the time the violation is detected.
In particular, in respect of incidents involving personal location data or biometric data, Clause 1, Article 29 of Decree No. 356/2025/ND-CP requires the Personal Data Controller or Personal Data Controller and Processor to:
+ Notify affected data subjects within no more than 72 hours from the time the violation is detected;
+ Report the incident to the competent state authority in accordance with Article 28 of this Decree;
+ Record, retain and update violation records for inspection, examination and enforcement purposes. Such records must be retained for at least five years from the date on which the incident has been remedied.
Accordingly, businesses should assess the nature, scope, categories of data involved and the extent of impact of each incident to accurately determine the party responsible for notification, the competent receiving authority and the applicable notification deadline. Businesses should not automatically apply the same notification deadline to all personal data breach incidents.
b) Organising Incident Response and Remediation
In addition to notification obligations, the Board of Management and the individuals responsible for managing the business should direct the IT, legal, cybersecurity and personal data protection teams to coordinate and undertake necessary actions to contain incidents and mitigate potential damages.
Such actions may include:
– Containing and preventing the incident: Isolating affected systems and implementing measures to prevent the incident from spreading;
– Investigating the incident: Identifying the cause, scope, categories of personal data involved and the number of affected data subjects;
– Preserving evidence: Retaining system logs, electronic evidence and relevant documents for verification and investigation purposes;
– Remediating and restoring systems: Implementing necessary technical and organisational measures to resolve the incident and mitigate resulting damages; and
– Documenting and retaining incident records: Preparing records of the incident and maintaining relevant documentation to facilitate explanations to competent authorities.
The above measures constitute corporate governance and incident response recommendations intended to assist businesses in fulfilling their personal data protection obligations. In particular, the recording, preparation and retention of information concerning violations must be carried out in accordance with Article 23 of the Law on Personal Data Protection and Articles 28 and 29 of Decree No. 356/2025/ND-CP.
4. Establishing a Governance Framework to Mitigate Legal Risks for the Board of Management
To mitigate legal risks and demonstrate that appropriate management and supervisory obligations have been fulfilled, the Board of Management should proactively establish a personal data protection compliance framework throughout the business.
Based on the responsibilities of a Personal Data Controller under Article 37 of the Law on Personal Data Protection, together with the obligations of enterprise managers under Articles 13 and 165 of the Law on Enterprises 2020, CBI Law Firm recommends that businesses consider implementing the following measures:
– Establishing internal regulations: Approving and promulgating personal data protection policies and procedures, clearly defining the responsibilities of each relevant department and individual.
– Allocating appropriate resources: Providing the necessary budget, personnel and technical infrastructure to ensure the security of personal data throughout its collection, storage, use and sharing.
– Establishing supervisory mechanisms: Developing periodic inspection and assessment procedures, together with risk reporting mechanisms to the Board of Management or Board of Directors.
– Designating responsible personnel: Appointing a personal data protection department or personnel that meet statutory requirements, while clearly defining their scope of work, authority and coordination responsibilities. Such appointment must comply with the requirements under Article 13 of Decree No. 356/2025/ND-CP.
– Providing training and raising awareness: Organising periodic training for employees, particularly those who directly access and process personal data.
– Establishing incident response procedures: Developing mechanisms for receiving, classifying, reporting and handling incidents, while clearly identifying responsible contact points and approval procedures for notifications to competent authorities.
– Reviewing service providers and business partners: Reviewing contracts, personal data processing agreements and data protection measures implemented by third parties involved in personal data processing activities.
The implementation and proper retention of records and documents demonstrating the business’s governance and supervisory activities will provide an important basis for explaining the compliance measures undertaken by the business. Such documentation will also support the assessment of each individual’s responsibilities when an incident occurs.
However, it should be noted that establishing an internal governance framework does not automatically exempt enterprise managers from legal liability. Each individual’s responsibility must still be assessed based on their assigned duties, scope of authority, actual conduct and the statutory conditions for liability.
5. CBI’s Personal Data Protection Compliance Advisory Services
Compliance with personal data protection laws is not solely the responsibility of the IT department; it is also an essential component of corporate governance and risk management.
With a team of dedicated lawyers and legal professionals, CBI provides legal advisory and support services to businesses, including:
– Reviewing existing personal data processing activities and assessing compliance risks;
– Developing and refining internal policies, regulations and procedures on personal data protection;
– Drafting and reviewing Personal Data Processing Agreements and other relevant contractual arrangements;
– Advising on the establishment of responsibility allocation mechanisms and the designation of personnel or departments responsible for personal data protection;
– Assisting with the preparation of Personal Data Processing Impact Assessment (DPIA) dossiers and Cross-Border Personal Data Transfer Impact Assessment (CTIA) dossiers;
– Advising on procedures for responding to, handling and remedying personal data breach incidents; and
– Supporting businesses in working with competent state authorities, providing explanations and carrying out relevant administrative procedures.
CBI aims to assist businesses in establishing a compliance framework tailored to their specific operational characteristics, thereby enabling them to proactively manage risks and strengthen corporate governance in personal data protection.
This article was prepared by Legal Specialist Nguyen Truc Vy and reviewed by Lawyer Vu Pham Thu Huong.
This article is intended for general legal information purposes only and does not constitute legal advice in respect of any specific matter. The legal provisions cited herein are effective as of the date of publication; however, they may have been amended, supplemented, replaced or become invalid by the time readers refer to them. Accordingly, we recommend that readers seek advice from a qualified lawyer before applying any of the information contained herein.
