Violations of personal data protection, fined up to 3 billion VND

Legal Consulting Department of Lao Dong Newspaper answers:

Clause 4, Article 7 of Decree No. 330/2026/ND-CP stipulating penalties for administrative violations in the field of network security and personal data protection (effective from August 19, 2026) stipulates the maximum fine level in the field of personal data protection as follows:

a) The maximum penalty level in administrative violations for the act of buying and selling personal data is 10 times the revenue obtained from the violation; in case there is no revenue from the violation or the penalty level calculated according to the revenue obtained from the violation is lower than the maximum penalty level specified in point c of this clause, the penalty level according to the provisions of point c of this clause shall be applied;

b) The maximum penalty level in administrative sanctions for organizations that violate regulations on transborder transfer of personal data is 5% of the revenue of the previous year of that organization; in case there is no revenue of the previous year or the penalty level calculated based on revenue is lower than the maximum penalty level as prescribed in point c of this clause, the penalty level as prescribed in point c of this clause shall be applied;

c) The maximum fine in administrative violations for other violations in the field of personal data protection is 3 billion VND;

d) The maximum fine level specified in points a, b and c of this clause is applied to organizations; individuals committing the same violation, the maximum fine level is equal to one-half of the fine level for organizations.

Thus, from August 19, 2026, violations of personal data protection will be administratively sanctioned with a maximum fine of up to 3 billion VND.