Key issues for enterprises to note and review under the 2026 personal data protection regulations
Personal data relating to customers, employees and business partners is present in almost every aspect of an enterprise’s operations, from recruitment and sales to customer service and online marketing. Since the Law on Personal Data Protection took effect on 1 January 2026, together with its implementing regulations and dedicated administrative sanction framework, personal data protection has become a mandatory legal obligation for all enterprises, with maximum fines of up to 5% of annual revenue. This article examines the key regulatory requirements and practical considerations that enterprises should take into account when reviewing their compliance status.
Illustrative image
1. Legal Framework and Scope of Application
As of 1 January 2026, personal data protection activities in Vietnam are governed by the Law on Personal Data Protection No. 91/2025/QH15 (the “PDP Law“) and Decree No. 356/2025/ND-CP dated 31 December 2025 detailing the implementation of the PDP Law (the “Decree 356“). Decree No. 13/2023/ND-CP ceased to be effective on the same date. The dedicated administrative sanctions framework was subsequently introduced under Decree No. 330/2026/ND-CP (the “Decree 330“), which took effect on 19 August 2026.
Under Clause 2, Article 1 of the PDP Law, its scope of application is prescribed as follows:
“2. This Law applies to:
a) Vietnamese agencies, organisations and individuals;
b) Foreign agencies, organisations and individuals in Vietnam;
c) Foreign agencies, organisations and individuals directly participating in or related to personal data processing activities involving Vietnamese citizens and persons of Vietnamese origin whose nationality has not been determined and who are residing in Vietnam and have been issued with an identity certificate.”
Accordingly, Vietnamese enterprises and foreign-invested enterprises operating in Vietnam that process personal data in the course of their business activities fall within the scope of the PDP Law. Foreign enterprises without a presence in Vietnam may also be subject to the Law if they directly participate in or are related to the processing of personal data of the individuals specified in Clause 2, Article 1.
Regarding transitional provisions, Article 39 of the PDP Law allows enterprises to continue relying on consent and impact assessment dossiers prepared under Decree No. 13/2023/ND-CP. Specifically, Clause 1, Article 39 provides:
“1. Personal data processing activities currently being carried out for which the data subject has given consent or entered into an agreement in accordance with Decree No. 13/2023/ND-CP dated 17 April 2023 of the Government before the effective date of this Law may continue without requiring renewed consent or a new agreement.”
However, any subsequent updates to such dossiers after 1 January 2026 must comply with the new Law. Enterprises should therefore review all existing documentation to ensure continued compliance with the new regulatory framework.
2. Determining the Enterprise’s Role in Each Data Flow
The first step in a compliance review is to determine the role played by the enterprise, as its legal obligations depend on the capacity in which it processes personal data. Clauses 7, 8, 9 and 10, Article 2 of the PDP Law define the relevant roles as follows:
“7. A Personal Data Controller means an agency, organisation or individual that determines the purposes and means of personal data processing.
8. A Personal Data Processor means an agency, organisation or individual that processes personal data at the request of a Personal Data Controller or a Personal Data Controller and Processor under a contract.
9. A Personal Data Controller and Processor means an agency, organisation or individual that determines the purposes and means of, and directly carries out, personal data processing.
10. A Third Party means an organisation or individual other than the data subject, Personal Data Controller, Personal Data Controller and Processor, or Personal Data Processor that participates in personal data processing in accordance with the law.”
In practice, enterprises commonly act as Personal Data Controllers and Processors in relation to customer and employee data flows where they independently determine the purposes and means of processing and directly carry out the relevant processing activities. Nevertheless, an enterprise’s role must be determined separately for each processing activity, data flow and contractual relationship, rather than automatically assigning a single role to all of its business operations.
Article 37 of the PDP Law allocates responsibilities according to the relevant role. A Personal Data Controller must:
“a) Clearly specify the responsibilities, rights and obligations of the parties in agreements and contracts relating to personal data processing in accordance with this Law and other relevant laws;
b) Determine the purposes and means of personal data processing in documents and agreements with data subjects, ensuring compliance with the principles and requirements prescribed by this Law;
c) Implement appropriate organisational and technical measures to protect personal data in accordance with the law, and review and update such measures when necessary;
d) Notify violations of personal data protection regulations in accordance with Article 23 of this Law;
dd) Select an appropriate Personal Data Processor to process personal data;
e) Ensure the exercise of data subjects’ rights as prescribed in Article 4 of this Law;
g) Be liable to data subjects for any damage arising from personal data processing activities;
h) Prevent unauthorised collection of personal data from its systems, equipment and services;
i) Cooperate with the Ministry of Public Security and competent state authorities in personal data protection and provide information for the investigation and handling of violations of personal data protection laws;
k) Fulfil other responsibilities as prescribed by this Law and other relevant laws.”
A Personal Data Processor may only receive personal data after entering into a contract with the Personal Data Controller, must process such data strictly within the scope of the contract, and is liable to the Personal Data Controller for any resulting damage. A Personal Data Controller and Processor must fulfil both sets of obligations.
Compliance considerations: Enterprises should prepare a data map for each data flow, clearly identifying their own roles and those of relevant partners. They should review and determine the roles of all service providers that have access to personal data, including accounting firms, IT providers, cloud service providers, CRM providers, call centres and advertising agencies. Where a service provider acts as a Personal Data Processor, the relevant contract or contractual appendix must clearly specify the scope and purposes of processing, as well as the parties’ respective responsibilities and personal data protection obligations. Where data is transferred to a Third Party or an independent Controller, enterprises must identify the applicable legal basis and relevant transfer conditions.
3. Classification of Basic and Sensitive Personal Data
Enterprises must classify the personal data they hold, as sensitive personal data entails additional notification obligations, stricter security measures, the loss of certain exemptions available to small enterprises, and potentially higher administrative penalties.
Under Clause 1, Article 2 of the PDP Law:
“1. Personal data means digital data or information in another form that identifies or helps identify a specific individual, including basic personal data and sensitive personal data. Personal data that has been de-identified is no longer considered personal data.”
Under Article 3 of Decree 356, basic personal data includes full name, date of birth, gender, place of birth and addresses, nationality, personal images, telephone number, personal identification number, passport number, driving licence number, vehicle registration number, marital status, family relationships and digital account information.
Under Clause 1, Article 4 of Decree 356, the list of sensitive personal data includes:
“a) Data revealing racial or ethnic origin;
b) Political opinions, religious beliefs and faith;
c) Information concerning private life, personal secrets and family secrets;
d) Health status;
đ) Biometric data and genetic characteristics;
e) Data revealing an individual’s sexual life or sexual orientation;
g) Criminal and administrative violation records collected and stored by law enforcement authorities;
h) An individual’s location determined through location-based services;
i) Usernames and passwords for accessing an individual’s electronic identification account; images of identity cards, citizen identity cards and people’s identity cards;
k) Bank account usernames and passwords; bank card information; bank account transaction history; financial and credit information; and information on customers’ financial, securities and insurance activities and transaction histories held by credit institutions, foreign bank branches, payment intermediary service providers, securities organisations, insurance organisations and other permitted entities;
l) Data tracking behaviour and activities involving the use of telecommunications services, social networks, online communication services and other services in cyberspace;
m) Other personal data that is required by law to be kept confidential or subject to strict security measures.”
Many enterprises may not realise that they are processing sensitive personal data. Common examples include storing copies of customers’ or employees’ identity cards, using fingerprint or facial recognition attendance systems, maintaining employee health examination records, tracking delivery personnel through GPS, and collecting behavioural data through websites and applications.
Under Clause 2, Article 4 of Decree 356, when processing sensitive personal data, “agencies and organisations must establish access restriction and authorisation policies, processing procedures and security measures.”
Compliance considerations: Enterprises should prepare an inventory of personal data by department, including Human Resources, Sales, Marketing, IT and Security, identify sensitive personal data, and eliminate unnecessary data collection and retention (for example, retaining a copy of an identity card when only the personal identification number is required).
4. Data Subject Consent and Cases Where Consent Is Not Required
Consent is the primary legal basis for personal data processing, and enterprises bear the burden of proving that valid consent has been obtained.
Under Clause 1, Article 11 of the PDP Law, “Personal data may only be collected with the data subject’s consent prior to collection, unless otherwise provided by law.“
Clauses 2, 3 and 4, Article 9 of the PDP Law prescribe the validity requirements for consent as follows:
“2. A data subject’s consent is valid only when it is given voluntarily and with full knowledge of the following information:
a) The types of personal data to be processed and the purposes of processing;
b) The Personal Data Controller or Personal Data Controller and Processor;
c) The rights and obligations of the data subject.
3. A data subject’s consent must be expressed in a clear and specific manner and must be capable of being printed or reproduced in writing, including in electronic form or another verifiable format.
4. A data subject’s consent must comply with the following principles:
a) Consent must be given separately for each purpose;
b) Consent must not be subject to a mandatory condition requiring agreement to other purposes unrelated to the agreed terms;
c) Consent remains valid until the data subject changes such consent or otherwise as prescribed by law;
d) Silence or failure to respond shall not be deemed consent.”
Under Article 6 of Decree 356, the method of obtaining consent must be verifiable in terms of who gave consent, when it was given and the specific content to which consent was given. Acceptable methods include written documents, recorded telephone calls, SMS commands, emails, websites or applications with appropriate technical configurations.
Three practical requirements that enterprises frequently fail to comply with are specified in Clauses 2, 3 and 4:
“2. Personal Data Controllers and Personal Data Controllers and Processors must retain records of data subjects’ consent. In the event of a dispute, the burden of proving consent rests with the Personal Data Controller or Personal Data Controller and Processor.
3. Personal Data Controllers and Personal Data Controllers and Processors must not establish default consent mechanisms or create unclear instructions that mislead data subjects regarding the distinction between consent and refusal to consent. Any pre-existing default settings must ensure compliance with personal data protection principles and respect the rights of data subjects.
4. When obtaining consent to process sensitive personal data, the data subject must be notified that the data to be processed constitutes sensitive personal data.”
Accordingly, personal data may only be collected and processed with the data subject’s consent, unless otherwise provided by law.
Under Clause 1, Article 19 of the PDP Law, consent is not required in the following cases:
“a) To protect the life, health, honour, dignity, rights and legitimate interests of the data subject or another person in urgent circumstances; or to protect one’s own legitimate rights or interests, those of another person, or the interests of the State or an organisation where necessary to prevent acts infringing upon such interests. The Personal Data Controller, Personal Data Processor, Personal Data Controller and Processor, or Third Party bears the burden of proving that this exemption applies;
b) To address an emergency; a threat to national security that has not yet reached the level requiring a declaration of a state of emergency; or to prevent and combat riots, terrorism, crimes and legal violations;
c) To serve the activities of state agencies and state management activities as prescribed by law;
d) To perform agreements between data subjects and relevant agencies, organisations or individuals in accordance with the law;
dd) Other cases as prescribed by law.”
In practice, enterprises commonly process personal data without consent where such processing is necessary to perform agreements between data subjects and relevant organisations or individuals in accordance with the law. Examples include using customer information for delivery purposes or processing employee information for salary payments and social insurance contributions under employment contracts.
When processing personal data without consent, enterprises must establish a monitoring mechanism in accordance with Clause 2, Article 19 of the PDP Law.
Compliance considerations: Enterprises should identify the legal basis for processing each category of personal data and each processing purpose; separate consent requests for different purposes in forms, websites and contracts; and retain verifiable evidence of consent.
5. Data Subjects’ Rights and Response Deadlines
Enterprises must establish procedures for receiving and handling data subject requests, with particularly short response deadlines. An initial response must be provided within 02 working days.
Under Clause 1, Article 4 of the PDP Law, data subjects have the following rights:
“a) The right to be informed about personal data processing activities;
b) The right to consent or refuse consent, and to request the withdrawal of consent to personal data processing;
c) The right to access, correct or request the correction of personal data;
d) The right to request the provision, deletion or restriction of personal data processing, and to object to personal data processing;
dd) The right to lodge complaints, denunciations and lawsuits, and request compensation for damage in accordance with the law;
e) The right to request competent authorities or agencies, organisations and individuals involved in personal data processing to implement measures and solutions to protect their personal data in accordance with the law.”
Under Clause 1, Article 5 of Decree 356, a Personal Data Controller “must establish clear procedures, processes and forms for exercising data subjects’ rights, in accordance with its personal data processing activities and the responsibilities of relevant departments“.
The specific deadlines under Article 5 are as follows:
| Type of request | Initial response | Completion deadline | Where the Processor or Third Party must be involved | Maximum extension (once) |
|---|---|---|---|---|
| Withdrawal of consent, restriction of processing or objection to processing | 02 working days | 15 days | 20 days | 15 days |
| Access, correction or provision of data | 02 working days | 10 days | 15 days | 10 days |
| Data deletion | 02 working days | 20 days | 30 days | 20 days |
| Implementation of data protection measures | 02 working days | 15 days | — | 15 days |
Where an extension is necessary, the enterprise must notify the data subject of the reasons and bears the responsibility for demonstrating that the extension is necessary and reasonable.
These rights are not absolute. Under Clause 2, Article 14 of the PDP Law, an enterprise “shall not comply with a data subject’s request to delete or destroy personal data in cases specified in Article 19 of this Law or where such deletion or destruction would violate Clause 3, Article 4 of this Law.”
For example, accounting records and tax documents that must be retained under specialised legislation cannot be deleted solely at the data subject’s request. In all cases of refusal, the enterprise must notify the data subject of the legitimate reasons for such refusal.
Compliance considerations: Enterprises should issue procedures for handling data subject requests together with relevant forms, publish contact channels for receiving requests (such as email addresses or online forms), appoint a responsible focal point, monitor statutory deadlines through a request register, and specify corresponding implementation deadlines in contracts with Personal Data Processors.
6. Personal Data Processing Impact Assessment Dossiers and Cross-Border Personal Data Transfers
These two types of dossiers are mandatory procedural requirements that must be submitted to the specialised authority under the Ministry of Public Security within 60 days from the date of first processing or transfer of personal data.
6.1. Personal Data Processing Impact Assessment Dossier
Clauses 1 and 2, Article 21 of the PDP Law provide:
“1. Personal Data Controllers and Personal Data Processors must prepare and retain a personal data processing impact assessment dossier and submit one original copy to the specialised personal data protection authority within 60 days from the date of first processing personal data, except for cases specified in Clause 6 of this Article.
2. A personal data processing impact assessment shall be conducted once for the entire period of operation of the Personal Data Controller or Personal Data Controller and Processor and shall be updated in accordance with Article 22 of this Law.”
This is a mandatory obligation for enterprises acting as Personal Data Controllers or Personal Data Controllers and Processors, except where an exemption under Section 6.4 applies. Enterprises acting as Personal Data Processors must also prepare and retain the relevant dossier in accordance with their agreements with the Personal Data Controller.
6.2. Cross-Border Personal Data Transfer Impact Assessment Dossier
Under Clause 1, Article 20 of the PDP Law, cross-border personal data transfers include:
“a) Transferring personal data stored in Vietnam to a storage system located outside the territory of the Socialist Republic of Vietnam;
b) Agencies, organisations or individuals in Vietnam transferring personal data to organisations or individuals overseas;
c) Agencies, organisations or individuals in Vietnam or overseas using platforms located outside the territory of the Socialist Republic of Vietnam to process personal data collected in Vietnam.”
Accordingly, the use of platforms located outside Vietnam to process personal data collected in Vietnam is also considered a cross-border personal data transfer. Therefore, enterprises using email services, CRM systems, accounting software or AI tools hosted on overseas servers, or transferring employee data to an overseas parent company, may be required to prepare a cross-border personal data transfer impact assessment dossier.
Exemptions from the requirement to prepare such dossiers are prescribed in Clause 6, Article 20 of the PDP Law and Clause 3, Article 17 of Decree 356, including:
- Agencies and organisations storing their own employees’ data on cloud computing services;
- Data subjects independently transferring their own personal data;
- Journalism and media activities; data made publicly available in accordance with the law; and emergency situations;
- Cross-border transfers of personal data for personnel management purposes in accordance with internal labour regulations, company policies and collective labour agreements;
- Provision of data for the purposes of entering into contracts or carrying out transportation, logistics, remittance, payment, hotel, visa application or scholarship application procedures.
The exemption concerning cross-border personnel management is subject to the inclusion of relevant provisions in internal labour regulations, company policies and collective labour agreements. Foreign-invested enterprises wishing to rely on this exemption should expressly record the transfer of employee data to their parent companies in these documents.
Except for the above exemptions, the preparation and submission of the relevant dossier within 60 days is mandatory for all enterprises conducting cross-border personal data transfers, including small enterprises.
6.3. Updating the Dossiers
Under Article 20 of Decree 356, both types of impact assessment dossiers must be updated every six months when new processing purposes arise or participating parties change.
Updates must also be made within 10 days of the occurrence of any of the following events: corporate restructuring, dissolution or bankruptcy; changes to the organisation providing personal data protection services; or the addition or modification of business lines involving personal data processing.
6.4. Exemptions for Small, Start-up and Micro Enterprises
Clauses 2 and 3, Article 38 of the PDP Law provide:
“2. Small enterprises and start-up enterprises may choose whether or not to comply with Articles 21 and 22 and Clause 2, Article 33 of this Law for a period of five years from the effective date of this Law, except for small enterprises and start-up enterprises engaged in personal data processing services, directly processing sensitive personal data, or processing personal data of a large number of data subjects.
3. Business households and micro enterprises are not required to comply with Articles 21 and 22 and Clause 2, Article 33 of this Law, except for business households and micro enterprises engaged in personal data processing services, directly processing sensitive personal data, or processing personal data of a large number of data subjects.”
Under Article 41 of Decree 356, “a large number” is quantified as 100,000 or more data subjects, calculated based on the cumulative number of individuals whose personal data has been processed.
Three points should be noted.
First, these exemptions only apply to personal data processing impact assessment dossiers and the appointment of personal data protection personnel. They do not apply to cross-border personal data transfer impact assessment dossiers.
Second, an enterprise that merely retains copies of employees’ identity cards or health data may already be considered to be directly processing sensitive personal data and may therefore lose the relevant exemption.
Third, all other obligations, including obtaining consent, responding to data subject requests and notifying personal data protection violations, remain fully applicable.
Compliance considerations: Enterprises should identify the date on which they first processed or transferred personal data to calculate the 60-day submission deadline; review all systems and software hosted on overseas servers; assess whether they qualify for any exemption; and, if dossiers were previously submitted under Decree 13/2023/ND-CP, transition to the new updating mechanism in accordance with the current regulations.
7. Personal Data Protection Personnel, Protection Measures and Breach Notifications
7.1. Appointment of Personal Data Protection Personnel or Departments
Under Clause 2, Article 33 of the PDP Law, “Agencies and organisations are responsible for appointing qualified personal data protection personnel or departments, or engaging organisations or individuals providing personal data protection services.“
Clauses 1 and 2, Article 13 of Decree 356 provide:
“1. The appointment of personal data protection personnel or the establishment of a personal data protection department must be made through an official written document issued by the relevant agency or organisation, specifying the assignment, functions, duties, authority and other requirements relating to personal data protection within that agency or organisation.
*2. Personal data protection personnel appointed by an agency or organisation must satisfy the following competency requirements:
a) Hold a college diploma or higher qualification;
b) Have at least two years of work experience (calculated from the date of graduation) in one of the following fields: legal affairs, information technology, cybersecurity, data security, risk management, compliance control, human resources management or personnel organisation;
c) Have received training and professional development in legal knowledge and specialised skills relating to personal data protection.“
Enterprises must also enter into confidentiality and responsibility agreements with such personnel and provide relevant training.
Under Article 14 of Decree 356, the responsibilities of the personal data protection department include developing policies, procedures and forms; implementing data subjects’ rights; conducting periodic compliance assessments; preparing impact assessment dossiers; receiving and reporting violations; conducting internal training; and implementing technical measures and incident response plans.
7.2. Organisational and Technical Protection Measures
Under Article 3 of the PDP Law, enterprises must comply with the principles of processing personal data within the appropriate scope and for specific purposes, ensuring data accuracy, retaining data only for periods appropriate to the relevant purposes, and implementing coordinated institutional, technical and personnel measures.
The following specific requirements should be noted:
- Data sharing between departments must be subject to controlled procedures and measures to prevent employees from unlawfully disclosing personal data to Third Parties;
- Data transfers to business partners must be governed by agreements specifying the purposes, categories of data, processing duration, deletion requirements, legal basis and responsibilities of the parties;
- Sensitive personal data transferred to other parties must be encrypted or anonymised, and the physical security of devices must be ensured;
- Data deletion and destruction must be carried out using secure methods that prevent unauthorised recovery.
It should be noted that, under Clause 1, Article 12 of the PDP Law, “personal data remains personal data even after encryption“. Only de-identified data falls outside the scope of the Law.
7.3. Notification of Personal Data Protection Violations Within 72 Hours
Clause 1, Article 23 of the PDP Law provides:
“1. A Personal Data Controller, Personal Data Controller and Processor, or Third Party that discovers a violation of personal data protection regulations which may cause harm to national defence, national security, social order and safety, or infringe upon the life, health, honour, dignity or property of a data subject must notify the specialised personal data protection authority no later than 72 hours from the time the violation is discovered. Where a Personal Data Processor discovers a violation, it must promptly notify the Personal Data Controller or Personal Data Controller and Processor.”
The Personal Data Controller must also prepare a written record confirming the violation and cooperate in handling the incident.
Under Article 28 of Decree 356, notifications must be made using Form No. 08 and must describe the nature of the violation, the types and volume of affected data, the contact point, potential consequences and remedial measures.
Violations involving location or biometric data entail stricter obligations. Under Article 29 of Decree 356, enterprises must also notify affected data subjects within 72 hours and retain incident records for at least five years from the date the incident has been fully remedied.
In the financial and banking sectors, the obligation to notify both the specialised authority and affected data subjects within 72 hours also applies where sensitive personal data is disclosed or lost.
Compliance considerations: Enterprises should issue formal appointment decisions for personal data protection personnel or enter into service agreements with qualified providers; verify the relevant personnel’s qualifications, experience and training certificates; develop incident response plans incorporating the 72-hour notification deadline, incident record templates and notification forms; and include contractual obligations requiring Personal Data Processors to promptly report any discovered incident.
8. Administrative Penalties
Violations may result in administrative penalties, criminal prosecution and civil liability for damages.
Under Clauses 3, 4, 5 and 6, Article 8 of the PDP Law, the maximum administrative fines are prescribed as follows:
“3. The maximum fine for administrative violations involving the purchase or sale of personal data is ten times the proceeds obtained from the violation. Where no proceeds are obtained, or where the fine calculated based on such proceeds is lower than the maximum fine prescribed in Clause 5 of this Article, the maximum fine prescribed in Clause 5 shall apply.
4. The maximum fine imposed on an organisation for violations of regulations on cross-border personal data transfers is 5% of its revenue in the immediately preceding financial year. Where the organisation has no revenue in the immediately preceding financial year, or where the fine calculated based on revenue is lower than the maximum fine prescribed in Clause 5 of this Article, the maximum fine prescribed in Clause 5 shall apply.
5. The maximum fine for other violations in the field of personal data protection is VND 3 billion.
6. The maximum fines prescribed in Clauses 3, 4 and 5 of this Article apply to organisations. Individuals committing the same violations shall be subject to a maximum fine equal to one-half of the fine applicable to organisations.”
Decree No. 330/2026/ND-CP dated 19 August 2026 on administrative penalties in the fields of cybersecurity and personal data protection, which took effect on the same date, provides detailed penalties for individual violations under Section 6, Chapter II.
The following are some of the administrative penalties applicable to organisations for violations that enterprises should pay particular attention to:
8.1. Violations of Consent Requirements
| Violation | Fine applicable to organisations | Legal basis under Decree 330/2026 |
|---|---|---|
| Processing personal data after collection without obtaining the data subject’s consent | VND 30–50 million | Clause 1, Article 43 |
| Imposing mandatory conditions or refusing to provide services where the data subject does not consent to processing for additional purposes unrelated to the agreed terms | VND 30–50 million | Clause 1, Article 43 |
| Establishing default consent mechanisms or creating unclear instructions that mislead data subjects regarding consent and refusal to consent | VND 30–50 million | Clause 1, Article 43 |
| Obtaining consent through methods that are not clear, specific or verifiable in terms of the identity of the data subject, the time of consent and the content approved | VND 30–50 million | Clause 1, Article 43 |
| Failing to provide transparent information on the types of personal data processed, processing purposes, data subjects’ rights and obligations, or the identity of the Personal Data Controller or Personal Data Controller and Processor, resulting in consent not being given voluntarily and with full knowledge | VND 30–50 million | Clause 1, Article 43 |
| Failing to ensure that consent is obtained separately for each personal data processing purpose | VND 30–50 million | Clause 1, Article 43 |
| Failing to record or retain consent logs, or being unable to prove that consent was obtained upon request by the data subject or a competent state authority conducting an inspection or examination | VND 30–50 million | Clause 1, Article 43 |
| Failing to notify data subjects that their sensitive personal data is being processed | VND 30–50 million | Clause 1, Article 43 |
| Intentionally continuing to process personal data after the data subject has requested that processing be stopped or restricted, or after receiving a written request from a competent state authority | VND 50–70 million | Clause 2, Article 43 |
| Collecting or processing personal data where the data subject remains silent or fails to respond to a consent request, and treating such silence as consent | VND 50–70 million | Clause 2, Article 43 |
8.2. Violations of Procedures for Exercising Data Subjects’ Rights
| Violation | Fine applicable to organisations | Legal basis under Decree 330/2026 |
|---|---|---|
| Failing to establish clear procedures, processes and forms for exercising data subjects’ rights | VND 10–20 million | Clause 1, Article 44 |
| Failing to clearly allocate responsibilities among relevant departments within the organisation for implementing data subjects’ rights | VND 10–20 million | Clause 1, Article 44 |
| Failing to provide information or ensure that data subjects are informed of the procedures for exercising their rights under the PDP Law | VND 10–20 million | Clause 1, Article 44 |
| Failing to respond to a data subject or failing to provide sufficient information on the relevant procedures within 02 working days of receiving a valid request for access, correction, provision, deletion, withdrawal of consent, restriction or objection to processing, or implementation of data protection measures | VND 10–20 million | Clause 1, Article 44 |
| Failing to notify data subjects of legitimate reasons where a request cannot be fulfilled or requires an extension | VND 10–20 million | Clause 1, Article 44 |
| Failing to fulfil requests for withdrawal of consent, restriction of processing or objection to processing within 15 days; or within 20 days where the Personal Data Processor or Third Party must be involved; or within the applicable extended period of up to 15 additional days | VND 30–40 million | Clause 3, Article 44 |
| Failing to fulfil requests for access, correction or provision of personal data within 10 days; or within 15 days where the Personal Data Processor or Third Party must be involved; or within the applicable extended period of up to 10 additional days | VND 30–40 million | Clause 3, Article 44 |
| Failing to fulfil requests for personal data deletion within 20 days; or within 30 days where the Personal Data Processor or Third Party must be involved; or within the applicable extended period of up to 20 additional days | VND 30–40 million | Clause 3, Article 44 |
| Failing to implement requested personal data protection measures within 15 days, or within the applicable extended period of up to 15 additional days | VND 30–40 million | Clause 3, Article 44 |
8.3. Violations of Personal Data Protection Breach Notification Requirements
| Violation | Fine applicable to organisations | Legal basis under Decree 330/2026 |
|---|---|---|
| A Personal Data Processor discovers a violation but fails to promptly notify the Personal Data Controller | VND 10–20 million | Clause 1, Article 54 |
| A Personal Data Controller or Personal Data Controller and Processor fails to prepare a written record confirming the occurrence of a personal data protection violation | VND 10–20 million | Clause 1, Article 54 |
| A Personal Data Controller, Personal Data Controller and Processor, or Personal Data Processor intentionally conceals or provides false information regarding the nature, scale, types of personal data or number of affected data subjects when reporting a data breach to the specialised authority | VND 10–20 million | Clause 1, Article 54 |
| Failing to notify the specialised personal data protection authority in the following cases: (a) discovery of a personal data protection violation; (b) personal data being processed for improper purposes or contrary to the agreed terms; or (c) failure to ensure or properly exercise data subjects’ rights | VND 20–40 million | Clause 2, Article 54 |
| A Personal Data Controller, Personal Data Controller and Processor, or Third Party notifying the specialised authority more than 72 hours after discovering a violation that causes or may cause harm to national defence, national security, social order and safety, or infringes upon the life, health, honour, dignity or property of data subjects | VND 40–60 million | Clause 3, Article 54 |
| Failing to implement measures to prevent violations or remedy their consequences | VND 60–80 million | Clause 4, Article 54 |
| Failing to cooperate with the specialised authority in handling violations | VND 60–80 million | Clause 4, Article 54 |
8.4. Violations of Personal Data Processing Impact Assessment Requirements
| Violation | Fine applicable to organisations | Legal basis under Decree 330/2026 |
|---|---|---|
| Commencing personal data processing activities without preparing or maintaining a personal data processing impact assessment dossier | VND 20–30 million | Clause 1, Article 55 |
| Failing to submit one original copy of the dossier to the specialised authority within 60 days from the date of first processing personal data | VND 20–30 million | Clause 1, Article 55 |
| Intentionally failing to complete the impact assessment dossier in accordance with the specialised authority’s request where the dossier is incomplete or non-compliant | VND 20–30 million | Clause 1, Article 55 |
| Failing to update the dossier every six months or within 10 days where an update is required | VND 20–30 million | Clause 1, Article 55 |
| Intentionally falsifying figures, providing misleading information in the dossier, or refusing to amend or complete the dossier upon receipt of a written request for remediation | VND 50–100 million | Clause 2, Article 55 |
8.5. Violations of Cross-Border Personal Data Transfer Requirements
| Violation | Fine applicable to organisations | Legal basis under Decree 330/2026 |
|---|---|---|
| Failing to prepare a cross-border personal data transfer impact assessment dossier before or during the transfer of personal data | VND 30–50 million | Clause 1, Article 56 |
| Failing to submit one original copy of the dossier to the specialised authority within 60 days from the date of first transfer | VND 30–50 million | Clause 1, Article 56 |
| Failing to complete the cross-border personal data transfer impact assessment dossier within 30 days of receiving a request from the specialised personal data protection authority | VND 30–50 million | Clause 1, Article 56 |
| Failing to update the dossier periodically or upon changes as prescribed by law | VND 30–50 million | Clause 1, Article 56 |
| Failing to maintain the cross-border personal data transfer impact assessment dossier in a state ready for inspection by the specialised personal data protection authority | VND 30–50 million | Clause 1, Article 56 |
| Failing to notify information and contact details of the organisation or individual responsible for personal data protection on the recipient’s side after completing the cross-border transfer | VND 30–50 million | Clause 1, Article 56 |
| Failing to establish a control mechanism or require the overseas recipient to comply with procedures when onward-transferring personal data to another Third Party, resulting in Vietnamese citizens’ personal data being processed beyond the scope declared in the impact assessment dossier | VND 30–50 million | Clause 1, Article 56 |
| Failing to establish a contract or binding transfer document specifying the parties’ personal data protection responsibilities, or failing to clearly allocate responsibility for exercising data subjects’ rights after the transfer | VND 50–100 million | Clause 2, Article 56 |
| Failing to obtain data subjects’ consent for cross-border transfer purposes, or failing to notify them that their personal data will be transferred overseas, the receiving organisation and the processing purposes | VND 50–100 million | Clause 2, Article 56 |
| Failing to apply appropriate security measures during cross-border transfers or failing to establish a plan to ensure personal data security after the transfer | VND 50–100 million | Clause 2, Article 56 |
| Failing to cooperate with or obstructing inspections of cross-border personal data transfers conducted by the specialised authority | VND 50–100 million | Clause 2, Article 56 |
| Continuing cross-border personal data transfers after receiving a decision from the specialised authority requiring the transfer to cease | VND 50–100 million | Clause 2, Article 56 |
| Failing to notify the specialised authority and failing to request the overseas recipient to cease processing and prevent damage upon discovering that the recipient has committed a personal data protection violation or experienced a personal data breach | VND 50–100 million | Clause 2, Article 56 |
| Conducting cross-border personal data transfers without preparing an impact assessment dossier, concealing or falsely declaring data flows, resulting in the disclosure or loss of personal data of 10,000 or more Vietnamese citizens | 1%–5% of the preceding financial year’s revenue in the Vietnamese market; where there is no revenue or the revenue-based fine is lower than VND 3 billion, a fine of VND 200 million to VND 3 billion applies | Clauses 3 and 4, Article 56 |
8.6. Violations of Requirements for Appointing Personal Data Protection Personnel or Departments
| Violation | Fine applicable to organisations | Legal basis under Decree 330/2026 |
|---|---|---|
| Failing to enter into a confidentiality and responsibility agreement with personal data protection personnel | Warning or VND 10–20 million | Clause 1, Article 57 |
| Failing to organise training and professional development in personal data protection knowledge and skills for personal data protection personnel | Warning or VND 10–20 million | Clause 1, Article 57 |
| The official appointment document or decision establishing a personal data protection department fails to specify its functions, duties, authority and other requirements relating to personal data protection as prescribed by law | Warning or VND 10–20 million | Clause 1, Article 57 |
| Appointing personal data protection personnel who do not hold a college diploma or higher qualification or lack at least two years of relevant work experience in legal affairs, information technology, cybersecurity, data security, risk management, compliance control or human resources management | VND 20–30 million | Clause 2, Article 57 |
| Appointing personal data protection personnel who have not received training or professional development in legal knowledge and specialised personal data protection skills | VND 20–30 million | Clause 2, Article 57 |
| Failing to issue an official written appointment document for personal data protection personnel or a decision establishing a personal data protection department | VND 20–30 million | Clause 2, Article 57 |
In addition to monetary fines, common remedial measures include compulsory destruction or deletion of unlawfully collected data in a manner that makes recovery impossible, and compulsory remittance of unlawfully obtained proceeds.
For enterprises whose business models rely heavily on data, an order requiring the deletion of their entire customer database may cause losses far exceeding the amount of the administrative fine itself.
9. Conclusion
The new legal framework establishes a comprehensive system of obligations for enterprises, covering every stage of personal data collection, processing, storage, transfer and cross-border transfer.
Most of these obligations apply to all enterprises, regardless of their size. Exemptions for small and start-up enterprises are limited to personal data processing impact assessment dossiers and the appointment of personal data protection personnel. Such exemptions do not apply where an enterprise processes sensitive personal data or personal data relating to 100,000 or more data subjects.
As Decree 330/2026/ND-CP has taken effect, competent authorities now have a comprehensive legal basis for conducting inspections and imposing administrative penalties. Enterprises should proactively conduct compliance reviews, focusing first on identifying the personal data they hold and their respective roles in each data flow; completing consent mechanisms and procedures for responding to data subject requests; appointing personal data protection personnel; preparing impact assessment dossiers within the statutory deadlines; and standardising contracts with employees and business partners.
Compliance with personal data protection regulations not only helps enterprises avoid administrative penalties, compulsory data deletion and compensation claims, but also strengthens the trust of customers, employees and business partners in an increasingly digital business environment.
This article was prepared by Legal Specialist Nguyen Truc Vy and reviewed by Lawyer Huynh Thi Y.
This article is intended for general informational purposes only and does not constitute legal advice in relation to any specific matter. The legal provisions cited herein are those in force as of the date of publication; however, they may have been amended, supplemented, superseded or repealed by the time readers refer to this article. Accordingly, readers are advised to consult a qualified lawyer before applying any of the information herein.
