Arbitrarily providing employees' phone numbers, fined up to 30 million VND

Legal Consulting Department of Lao Dong Newspaper answers:

Clause 7, Article 3, Decree 356/2025/ND-CP, stipulates that the basic list of personal data includes: Phone number, personal identification number, passport number, driver's license number, license plate number.

Clause 2, Article 49 of Decree No. 330/2026/ND-CP stipulating penalties for administrative violations in the field of network security and personal data protection (effective from August 19, 2026) stipulates as follows: A fine of between 20 million VND and 30 million VND shall be imposed for the act of providing personal data to other agencies, organizations, and individuals without the consent of the personal data subject, unless otherwise provided by law.

Clause 1, Article 7, Section 6, Chapter II, Decree No. 330/2026/ND-CP stipulates the level of fines and sanctioning authority as follows: Section 6, Chapter II of this Decree stipulates the level of fines applied to administrative violations in the field of personal data protection committed by organizations. In case an individual has the same violation, the fine applied to the individual is equal to one-twice the fine applied to the organization.

Thus, from August 19, 2026, businesses that arbitrarily provide phone numbers of employees may be fined up to 30 million VND.