On the morning of June 26, at the 9th Session, with 433/435 National Assembly deputies participating in the vote, the National Assembly passed the Law on Personal Data Protection (DLCN). The law takes effect from January 1, 2026.
According to the passed law, organizations and individuals who violate regulations on DLCN protection can be subject to administrative sanctions or criminal prosecution depending on the nature, extent and consequences of their actions. In case of causing damage, the violator must also compensate according to the provisions of law.
The act of illegally buying and selling DLCN will be subject to a maximum penalty of 10 times the illegal revenue. If the collection amount cannot be determined, the violating organization can be fined up to 3 billion VND, and individuals can be fined up to 1.5 billion VND.
For the act of illegally transferring DLCN across borders, the fine is 5% of the organization's revenue last year. In case there is no revenue, the fine can also be up to 3 billion VND. The Government will issue guidelines on how to calculate the fee to apply this penalty level.
The National Assembly Standing Committee explained that violations in the field of DLCN can have serious consequences, so it is necessary to apply high fines to ensure deterrence, especially for multinational corporations or technology enterprises with revenue of thousands of billions of VND.
The law also stipulates the prohibition of buying and selling DLCN in any form.
Article 7 of the Law strictly prohibits the use of DLCN by others to commit illegal acts; allow others to use their own DLCN; appropriate, intentionally expose or lose DLCN; process data for purposes of resistance to the State, violating national defense, security, social order, or obstructing the protection of DLCN.
According to the National Assembly Standing Committee, the complete ban on DLCN trading is necessary to prevent the widespread sale of personal information on the network, or the exploitation of data by employees to defraud and appropriate property.
DLCN is associated with privacy and personal identity and cannot be considered a commodity for exchange and sale. International experience shows that most countries, such as the US, Thailand, Singapore or Malaysia, do not recognize DLCN as an asset but only recognize each person's control over their own data.
In Vietnam, the situation of DLCN being collected and advertised as goods has become common while the legal corridor is still lacking. In many cases, there is no mechanism to control the use consent, processing purpose, or fully protect users' rights.
The new law clearly affirms that DLCN is not an asset and buying and selling is a prohibited act.
According to the National Assembly Standing Committee, the revised draft law also clarifies the scope of application and responsibilities, obligations that need to be complied with by cross-border platform providers such as Google, Facebook, TikTok... without representative agencies in Vietnam and processes user data of Vietnamese citizens completely outside of Vietnam.
The requirement for cross-border platforms such as Google, Facebook, TikTok... to have representative agencies in Vietnam is implemented in accordance with the provisions of the Law on Cyber Security, the Law on Data.
