Vietnam implements new cybersecurity and data protection regulations

The Vietnamese government has enacted Decree No. 330/2026/NĐ-CP, establishing administrative penalties for violations in cybersecurity and personal data protection. Effective from August 19, 2026, the decree aims to create a preventive mechanism that requires organizations and businesses to proactively secure data and ensure safety in cyberspace.

Under the new regulations, penalties for mishandling sensitive personal data can reach up to 70 million VND. Specific violations regarding consent—such as processing data without permission, using misleading indicators, or failing to maintain consent logs—carry fines between 30 and 50 million VND. Fines increase to between 50 and 70 million VND if an entity continues to process data after a subject has requested it to stop, or if an entity treats a subject's silence as consent.

The decree also provides detailed regulations regarding information security, social media activities, digital accounts, and illegal cyberspace activities. Beyond fines and warnings, penalties will vary based on the nature and severity of the violations.