You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

August 25, 2026

Vietnam Issues Cybersecurity and Personal Data Protection Sanctions Decree

Subscribe to Updates

Vietnam has enacted a new decree establishing administrative penalties for violations in the fields of cybersecurity and personal data protection. Decree No. 330/2026/NĐ-CP (Decree 330), issued and effective from August 19, 2026, provides a detailed sanctions framework for noncompliance with the Law on Personal Data Protection (including its implementing regulations under Decree 356/2025/ND-CP) and the Law on Cybersecurity, together with their guiding decrees.

The issuance of Decree 330 signals that the practical grace period previously perceived by many businesses may be drawing to a close, with active regulatory enforcement in these areas expected to commence in earnest.

Scope and Key Provisions

Decree 330 has extraterritorial effect and applies to both onshore and offshore companies. For offshore companies, it applies to those that (1) provide telecommunications, internet, online-content, information-technology, cybersecurity, or cross-border services and (2) are involved in or related to the processing of personal data of Vietnamese citizens and certain other people of Vietnamese origin.

Decree 330’s key provisions cover the following areas:

  • Administrative penalties for violations relating to the protection of national security and public order in cyberspace, including the dissemination of unlawful, false, or unverified information.
  • Sanctions for cyberattacks, unauthorized access, introduction of harmful code or programs, and failure to cooperate with specialized cybersecurity forces.
  • Sanctions for personal data protection violations, such as consent, cross-border data transfers, impact assessments, breach notification, and data-subject rights, among others—with maximum fines of up to 5% of an organization’s preceding-year revenue for cross-border transfer violations, or up to VND 3 billion for other data-protection breaches.

Personal Data Protection Penalties

The key sanctions for personal data protection violations are as follows:

  • Consent violations: Fines of up to VND 70 million (approx. USD 2,642), plus potential additional sanctions and remedial measures including irreversible deletion of personal data collected without consent and confiscation of illegal profits.
  • Data breach notification violations: Fines of up to VND 80 million (approx. USD 3,019), with potential remedial measures including mandatory breach notification and implementation of prevention and remedial measures as directed by the regulator.
  • Data processing impact assessment (DPIA) violations: Fines of up to VND 100 million (approx. USD 3,774), with potential remedial measures including mandatory DPIA submission and suspension of personal data processing until the filing obligation is successfully completed.
  • Cross-border transfer impact assessment (TIA) violations: Fines of up to 5% of preceding-year revenues or up to VND 3 billion (approx. USD 113,208), with potential additional sanctions and remedial measures including mandatory TIA submission and suspension of cross-border personal data transfers until the filing obligation is successfully completed.
  • Data protection officer and department appointment violations: Fines of up to VND 30 million (approx. USD 1,132), with potential remedial measures including mandatory appointment of a qualified person and mandatory issuance of policies and documents relating to personal data protection responsibilities.

Transitional Provisions

Decree 330 includes a transitional clause including a provision that where a cybersecurity or personal data protection violation was committed before Decree 330 took effect but is only discovered, or remains under review or resolution, after that date, the sanctions regime in force at the time of the violation will generally apply. However, where Decree 330 imposes no liability or lighter liability for the same conduct, companies may invoke the more favorable provisions.

Outlook and Recommendations

Decree 330 taking effect immediately upon its issuance is a signal that the regulator intends to commence active enforcement. For context, the Vietnam Competition Commission has recently been very active in enforcing consumer protection regulations against major companies, including privacy-related provisions such as requirements to obtain proper consent for the collection and use of personal data. With Decree 330 now in effect, the Ministry of Public Security (the authority responsible for data protection and cybersecurity) has full power to impose penalties for noncompliance with the Law on Personal Data Protection and the Law on Cybersecurity, notably including requirements relating to data protection impact assessments, cross-border data transfer impact assessments, data localization, data protection officers (DPOs) and forms and mechanisms for obtaining consent.

This is particularly significant given that businesses have had over three years to prepare—from the issuance of Decree No. 13/2023/NĐ-CP on personal data protection, which took effect on July 1, 2023, through to the enactment of the Law on Personal Data Protection effective January 1, 2026. Companies should reassess their compliance status and ensure they are prepared to demonstrate compliance when requested by the relevant authorities.

Related Professionals

Industries

Technology

Location

RELATED INSIGHTS​ 

September 11, 2025
Thailand’s Securities and Exchange Commission (SEC) has amended its digital asset regulations to permit the offering, trading, and provision of services related to tokenized environmental commodities by licensed digital asset exchanges, brokers, and dealers. This regulatory development is aimed at facilitating Thailand’s green economy and net-zero goals while diversifying the products available in the regulated digital assets market. The environmental commodities currently being traded on certain market platforms and via over-the-counter channels include: Carbon credits: Tradable certificates representing a reduction of CO₂ emitted into the atmosphere. Renewable energy certificates (RECs): Tradable proof of electricity generated from renewable energy sources. Carbon allowances: Tradable permits to emit a capped amount of greenhouse gases. The tokenization of these instruments is essentially the process of converting them into digital tokens, making it possible to list them on blockchain exchanges for trading purposes. Background Tokenized carbon credits, RECs, and carbon allowances fall under the category of utility tokens for consumption purposes or tokens representing entitlement certificates—that is, group 1 utility tokens, which are not considered financial products. The offering, trading, and provision of secondary-market services of this type of token are exempted from licensing requirements for regulated digital asset businesses under the Emergency Decree on Digital Asset Businesses B.E. 2561 (2018). Under the previous regulatory framework, licensed digital asset business operators were not allowed to provide services involving such unregulated tokens, as it was deemed to be engaging in “other businesses,” which digital asset operators generally cannot engage in without prior SEC approval. Regulatory Amendment Under the amended digital asset regulations, licensed digital asset exchanges, brokers, and dealers may now apply for SEC approval to offer services related to these tokenized assets as “other businesses,” including listing them for trading on digital asset exchanges. Apart from requiring operators to comply with the general conditions
Read More
September 4, 2025
With advancements in health technology, telemedicine has taken on a wider online presence in Thailand. Under the Medical Facility Act, licensed clinics and hospitals may now diagnose, prescribe, and issue electronic prescriptions during a video call, provided they maintain patient confidentiality and proper recordkeeping. As a complementary concept, a telepharmacy allows a pharmacist to verify prescriptions, counsel patients, and dispense medication from a remote site. Hospitals, clinic chains, and some retail pharmacy groups have adopted “drive-thru” or “locker” pick-up points where drugs are bagged only after a real-time video consultation with a registered pharmacist. The clear benefits of telehealth include shorter waiting times and broader access to specialists, which is in the public interest. Drug Distribution and Advertising in Thailand The online pharmacy ecosystem creates a legal bridge in that once a teleconsulting doctor issues an e-prescription, a licensed pharmacy can lawfully dispense and deliver the medicine prescribed to the patient’s door. Nonetheless, the critical compliance component remains the advertising of medicinal drugs. It is still not allowed to advertise prescription/pharmacy-dispensed drugs to the public in Thailand. Although Thailand’s Drug Act of 1967 was written more than half a century ago, it still governs the trading of every medicinal drug that makes its way to consumers in Thailand—whether bought at a pharmacy or delivered with a few taps on a smartphone. First and foremost, the pharmacy must hold a license to sell medicinal drugs as a retailer. It is also mandatory that arrangements be made for a pharmacist to be on duty during opening hours. Drugs are classified into three main categories: prescription drugs, pharmacy-dispensed drugs, and over-the-counter (OTC) drugs. The listing of OTC drugs with their prices via an online platform is allowed, as only OTC drugs may be advertised directly to the public. However, naming or showing
Read More
September 2, 2025
Thailand’s National Space Policy Committee (NSPC) has proposed new regulations that would permit foreign satellite operators to provide services within the country. The draft announcement responds to rapid advancements in digital and space technologies that have led to new global satellite operators expanding their services worldwide, including into Thailand. These include low-Earth-orbit (LEO) satellite constellations offering high-speed internet, nonterrestrial network (NTN) technologies that integrate terrestrial and satellite communications, and direct-to-device (D2D) technologies that transmit signals directly from satellites to mobile devices without relying on terrestrial networks. The draft aims to replace the existing announcement, which was issued in 2021, to better align with current national policies on foreign satellite usage. The draft announcement was published for public consultation on August 20, 2025, with the comment period concluding on September 3, 2025. Applying for Authorization Two types of operators may apply for authorization: Thai operators who intend to use foreign satellites owned by World Trade Organization (WTO) member countries to provide satellite communication services to third parties; and Foreign operators of satellites owned by WTO member countries who intend to operate a business providing satellite communication services within Thailand. Applications for approval must be submitted to the National Broadcasting and Telecommunications Commission (NBTC) according to the NBTC’s established procedures. In considering whether to permit foreign satellites to provide services within Thailand, the relevant authority will take into account technical justifications, economic benefits, social benefits, and national security considerations. Determining Satellite Ownership The determination of which country qualifies as the owner of a satellite is based primarily on the country that holds the satellite network filing rights registered with the International Telecommunication Union (ITU). The satellite network filing includes details regarding frequency usage, orbital positions, and technical specifications of the satellite operations. It serves as a regulatory tool used by the
Read More