Vietnam drafts cybersecurity and personal data protection sanctions

Vietnam's Ministry of Public Security has issued a draft decree on administrative sanctions regarding cybersecurity and personal data protection. This draft serves as an enforcement mechanism for the Personal Data Protection Law (PDPL) 2025, which took effect on January 1, 2026.

The proposed regulations aim to strengthen digital sovereignty and create a legal framework to deter violations in the digital space. Key provisions include significant penalties for the unauthorized sale of personal data, with fines reaching up to 10 times the illegal revenue obtained. Other data violations could result in fines of up to 3 billion VND. Additionally, organizations responsible for spreading viruses or malware, or those lacking adequate security contingency plans, may face fines of up to 100 million VND.

Legal experts note that the decree is essential for handling violations that do not yet reach the threshold of criminal liability. The implementation of these penalties is intended to compel businesses to increase investment in security systems and minimize vulnerabilities to data theft.