Vietnam has enacted a new decree establishing administrative penalties for violations in the fields of cybersecurity and personal data protection. Decree No. 330/2026/NĐ-CP (Decree 330), issued and effective from August 19, 2026, provides a detailed sanctions framework for noncompliance with the Law on Personal Data Protection (including its implementing regulations under Decree 356/2025/ND-CP) and the Law on Cybersecurity, together with their guiding decrees.

The issuance of Decree 330 signals that the practical grace period previously perceived by many businesses may be drawing to a close, with active regulatory enforcement in these areas expected to commence in earnest.

Scope and Key Provisions

Decree 330 has extraterritorial effect and applies to both onshore and offshore companies. For offshore companies, it applies to those that (1) provide telecommunications, internet, online-content, information-technology, cybersecurity, or cross-border services and (2) are involved in or related to the processing of personal data of Vietnamese citizens and certain other people of Vietnamese origin.

Decree 330’s key provisions cover the following areas:

• Administrative penalties for violations relating to the protection of national security and public order in cyberspace, including the dissemination of unlawful, false, or unverified information.
• Sanctions for cyberattacks, unauthorized access, introduction of harmful code or programs, and failure to cooperate with specialized cybersecurity forces.
• Sanctions for personal data protection violations, such as consent, cross-border data transfers, impact assessments, breach notification, and data-subject rights, among others—with maximum fines of up to 5% of an organization’s preceding-year revenue for cross-border transfer violations, or up to VND 3 billion for other data-protection breaches.

Personal Data Protection Penalties

The key sanctions for personal data protection violations are as follows:

• Consent violations: Fines of up to VND 70 million (approx. USD 2,642), plus potential additional sanctions and remedial measures including irreversible deletion of personal data collected without consent and confiscation of illegal profits.
• Data breach notification violations: Fines of up to VND 80 million (approx. USD 3,019), with potential remedial measures including mandatory breach notification and implementation of prevention and remedial measures as directed by the regulator.
• Data processing impact assessment (DPIA) violations: Fines of up to VND 100 million (approx. USD 3,774), with potential remedial measures including mandatory DPIA submission and suspension of personal data processing until the filing obligation is successfully completed.
• Cross-border transfer impact assessment (TIA) violations: Fines of up to 5% of preceding-year revenues or up to VND 3 billion (approx. USD 113,208), with potential additional sanctions and remedial measures including mandatory TIA submission and suspension of cross-border personal data transfers until the filing obligation is successfully completed.
• Data protection officer and department appointment violations: Fines of up to VND 30 million (approx. USD 1,132), with potential remedial measures including mandatory appointment of a qualified person and mandatory issuance of policies and documents relating to personal data protection responsibilities.

Transitional Provisions

Decree 330 includes a transitional clause including a provision that where a cybersecurity or personal data protection violation was committed before Decree 330 took effect but is only discovered, or remains under review or resolution, after that date, the sanctions regime in force at the time of the violation will generally apply. However, where Decree 330 imposes no liability or lighter liability for the same conduct, companies may invoke the more favorable provisions.

Outlook and Recommendations

Decree 330 taking effect immediately upon its issuance is a signal that the regulator intends to commence active enforcement. For context, the Vietnam Competition Commission has recently been very active in enforcing consumer protection regulations against major companies, including privacy-related provisions such as requirements to obtain proper consent for the collection and use of personal data. With Decree 330 now in effect, the Ministry of Public Security (the authority responsible for data protection and cybersecurity) has full power to impose penalties for noncompliance with the Law on Personal Data Protection and the Law on Cybersecurity, notably including requirements relating to data protection impact assessments, cross-border data transfer impact assessments, data localization, data protection officers (DPOs) and forms and mechanisms for obtaining consent.

This is particularly significant given that businesses have had over three years to prepare—from the issuance of Decree No. 13/2023/NĐ-CP on personal data protection, which took effect on July 1, 2023, through to the enactment of the Law on Personal Data Protection effective January 1, 2026. Companies should reassess their compliance status and ensure they are prepared to demonstrate compliance when requested by the relevant authorities.