Using illegal personal data collection technology fined up to 800 million VND

Legal Consulting Department of Lao Dong Newspaper answers:

Clause 3, Article 48, Section 6, Chapter II of Decree No. 330/2026/ND-CP stipulating penalties for administrative violations in the field of network security and personal data protection (effective August 19, 2026) stipulates violations of regulations on personal data collection as follows:

3. In case of applying technological and technical measures to collect personal data contrary to the provisions of law, the fine level is determined as follows:

a) A fine of between 100 million VND and 200 million VND shall be imposed for the act of collecting basic personal data of less than 500 data subjects or collecting sensitive personal data of less than 100 data subjects;

b) A fine of between 200 million VND and 300 million VND shall be imposed for the act of collecting basic personal data of 500 to less than 1,000 data subjects or collecting sensitive personal data of 100 to less than 200 data subjects;

c) A fine of between 300 million VND and 500 million VND shall be imposed for the act of collecting basic personal data of 1,000 to less than 5,000 data subjects or collecting sensitive personal data of 200 to 1,000 data subjects;

d) A fine of between 500 million VND and 800 million VND shall be imposed for the act of collecting basic personal data of 5,000 or more data subjects or collecting sensitive personal data of 1,000 or more data subjects.

4. A fine of between 50 million VND and 80 million VND shall be imposed for the acts specified in Clause 1 of this Article if the object of the violation is sensitive personal data.

5. Additional form of sanction: Confiscation of exhibits and means of administrative violations used to commit violations specified in Clauses 1, 2, 3 of this Article.

6. Remedial measures:

a) Forcing the cancellation or deletion to the point where it is impossible to restore all personal data collected and processed in violation of regulations for violations in this Article;

b) Forced to return revenue obtained from business activities using illegally collected personal data for violations in Clause 2 of this Article.

Clause 1, Article 7 of Decree No. 330/2026/ND-CP stipulates: Section 6, Chapter II of this Decree stipulates the fine level applied to administrative violations in the field of personal data protection committed by organizations. In case an individual has the same violation, the fine level applied to an individual is equal to one-twice the fine level applied to organizations.

Thus, from August 19, 2026, the highest penalty for the act of using technological and technical measures to illegally collect personal data can be up to 800 million VND.

At the same time, violating individuals or organizations will be confiscated of exhibits and means of administrative violations used to commit violations and forced to destroy and erase them to the extent that they cannot recover all personal data collected and processed against regulations for violations.