Illegal trading of personal data infringing on honor and dignity fined up to 3 billion VND

Legal Consulting Department of Lao Dong Newspaper answers:

Article 53, Section 6, Chapter II of Decree No. 330/2026/ND-CP stipulating penalties for administrative violations in the field of network security and personal data protection (effective August 19, 2026) stipulates violations of regulations on illegal purchase and sale of personal data as follows:

1. A fine of 02 times to a maximum of 10 times the revenue for one of the following acts of illegally buying and selling personal data:

a) Providing, sharing, or exchanging for the purpose of collecting property or other benefits that are not within the cases specified in Clause 1, Article 17 of the Law on Protection of Personal Data;

b) Transferring personal data at a fee or other material benefits without an agreement on the transfer of personal data;

c) Transferring personal data at a fee or other material benefits where the agreement on the transfer of personal data does not specify the purpose of the transfer of personal data or does not implement the purpose in the agreement on the transfer of personal data;

d) Transferring personal data at a fee or other material benefits without establishing a technical system or transparent mechanism for the owner of personal data to agree accurately and clearly with each transfer, on the basis of knowing the exact purpose of transfer, organizations and individuals receiving and processing personal data;

e) Transferring personal data at a fee or other material benefits that process personal data incorrectly for the purpose of transfer is agreed upon by the personal data subject, in accordance with the registered business line;

e) Transferring personal data at a fee or other material benefits without deidentification of personal data when trading on the data exchange.

2. In case the violations specified in Clause 1 of this Article do not have revenue and the maximum fine is 10 times the revenue obtained from the violation is less than 3 billion VND, the fine level is determined to the maximum level of the fine frame of 3 billion VND.

Point d, Clause 3, Article 53, Section 6, Chapter II of Decree No. 330/2026/ND-CP stipulates: In case there is no revenue from violations specified in Clause 1 of this Article, the fine level is determined as follows:

e) A fine of between 1 billion VND and a maximum of 3 billion VND shall be imposed for acts of illegal purchase and sale of personal data infringing upon national defense, security and order, foreign affairs, macroeconomics, life, health, honor, dignity, property of the subject of personal data, and the legitimate rights and interests of organizations and individuals.

Thus, from August 19, 2026, the illegal purchase and sale of personal data that infringes upon the honor and dignity of the personal data subject will be fined up to 3 billion VND.