This content is stipulated in Decree No. 330/2026/ND-CP of the Government on sanctioning administrative violations in the field of network security and personal data protection. In which, noteworthy are regulations on handling acts related to personal data protection.
Regarding personal data protection, the Decree stipulates administrative penalties for violations of regulations on: Principles of personal data protection and prohibited acts; taking advantage of personal data protection activities to commit illegal acts; processing personal data affecting security and order; the obligation to protect personal data of the personal data owner; the right to view, edit or request editing of personal data; processing personal data in cases without the consent of the personal data owner; collecting personal data; providing personal data; publicizing personal data; illegally buying and selling personal data...
Regarding violations of regulations on the principle of protecting personal data and prohibited acts, the Decree stipulates:
1. A fine of between VND 20,000,000 and VND 40,000,000 shall be imposed for the following acts:
a) Processing personal data that is not within the scope or not consistent with the purpose of processing personal data that has been identified, requesting consent, agreement or exceeding the necessary level to achieve that purpose;
b) Not ensuring the accuracy of personal data or not making corrections, updates, and supplements in a timely manner when errors are detected or when necessary;
c) Storage of personal data exceeding the necessary time period consistent with the purpose of personal data processing, unless otherwise provided by law;
d) Not proactively preventing, detecting, and coordinating promptly with competent authorities in handling all violations of the law on personal data protection.
2. A fine of between 40,000,000,000 VND and 60,000,000,000 VND shall be imposed for the following acts:
a) Having acts of opposing or obstructing the protection of personal data of agencies, organizations, and individuals;
b) Using personal data of others to commit acts contrary to the provisions of law.
3. Additional forms of sanction: Confiscation of exhibits and means of administrative violations for acts specified in points a, c, clause 1, point b, clause 2 of this Article;
4. Remedial measures:
a) Forcing the cancellation or deletion to the point where personal data that has been processed in the wrong scope, for the wrong purpose or stored beyond the time limit cannot be recovered for violations in points a, c, clause 1 of this Article;
b) Forced to return illegal revenue obtained from committing violations in points a, c, clause 1, point b, clause 2 of this Article;
c) Forced to publicly apologize to the subject of personal data on the mass media for the violation of point b, clause 2 of this Article;
d) Forced to edit, update, and supplement personal data to be accurate at the request of the personal data subject or when errors are detected for violations in point b, clause 1 of this Article.
This Decree takes effect from August 19, 2026.
