Vietnam is about to get its first dedicated penalty regime for data violations. Decree 363/2026/ND-CP takes effect November 11, 2026, with fines of up to 100 million Vietnamese dong (VND) for individuals, twice that for organizations, plus license suspensions, confiscation and deletion orders. The compliance clock is now running.
Document facts
Issuing body: Government of Vietnam
Document number: Decree 363/2026/ND-CP, regarding administrative sanctions in the data field
Signed: September 19, 2026
Effective: November 11, 2026
Status: Not yet in force
Unofficial English summary for reference only. Not a legal translation and not legal advice. The Vietnamese text linked at the end of this page is authoritative.
What the document does
Decree 363/2026 is the enforcement layer of the Law on Digital Data (Law 60/2024/QH15). Proposed by the Ministry of Public Security, it is the first dedicated instrument for administrative fines in the data field: 4 chapters and 36 articles covering the entire data lifecycle, plus data exchanges, intermediaries and controlled testing. Its stated objective is to ensure unlawful collection, processing and trading face real sanctions.
Crucially, the regime is not yet in force: it takes effect November 11, 2026, about two weeks out, so these fines are a rule coming into force, not current law. Violations committed before that date are not punished under this decree.
What changes in practice
Article 1 sets the scope: violations, penalty forms and levels, enforcement, remedial measures, sanctioned subjects, and specific fine levels by violation category in the data field. Article 1(2) draws an explicit boundary: the decree does not cover violations under the separate decree concerning administrative sanctions in cybersecurity and personal-data protection.
Article 2 applies the decree broadly: Vietnamese and foreign agencies, organizations and individuals in Vietnam, plus foreign subjects directly participating in or connected with data activities in Vietnam. Sanctioned organizations include state agencies acting outside their assigned state-management tasks and other established organizations; business and family households will be subject to fines at the individual rate.
Article 6 will cap fines at 100 million VND for individuals, with fines for organizations set at twice that rate, up to 200 million VND, except where the decree sets a direct organizational rate. Article 3 gives a one-year limitation period: a violation discovered within a year may still be subject to punishment, and deliberate evasion or obstruction restarts the clock.
Fine levels will rise with data sensitivity. Collection and creation (Article 8): violations will incur fines ranging from 20 to 40 million VND for collecting data without consent or proper procedural and authenticity checks; from 40 to 60 million VND for fabricated data, out-of-scope collection or sensitive-information leaks. Prohibited acts (Article 7): violations will incur fines ranging from 40 to 60 million VND for falsifying state databases, and from 60 to 80 million VND for obstructing lawful processing or attacking information systems. Storage (Article 10): from 30 to 70 million VND for unauthorized cross-border movement of core or important data. Governance (Article 11): violations will incur fines ranging from 20 to 40 million VND, plus a 3-to-12-month suspension of data use, for out-of-scope data use or falsified data history. Connection and sharing (Article 13): violations will incur fines ranging from 60 to 80 million VND for obstructing mandatory sharing or using insecure channels, and from 80 to 100 million VND for unauthorized sharing of core, important or national data.
Beyond fines, the decree will introduce time-limited license revocation (data-exchange, intermediary and analytics, and controlled-testing certificates); confiscation of tools, software and data directly used in the violation; time-limited suspension of data activities, databases, exchanges and controlled testing; suspension from Data Development Fund programs; and expulsion of foreign violators. Article 4(3) will list 19 remedial measures, from restoring databases to deleting unlawfully collected data and disgorging unlawful gains. Article 5 ensures proportionality: confiscation and deletion must target only what the violation directly used or produced, with official minutes drawn up first.
Under Article 4(4), where the violator directly operates a database serving state management, public services or essential public duties, any suspension will be required not to interrupt unrelated state-management, public-service and essential functions.
What changed from the previous rules
This is the first dedicated instrument for administrative fines written for the data field: 4 chapters, 36 articles structured around the data lifecycle, with an explicit carve-out in Article 1(2) for violations under the separate fines regime for cybersecurity and personal-data protection. That complementary instrument is Decree 330/2026/ND-CP, issued and effective August 19, 2026. The two decrees are complementary, not competing: cybersecurity and personal-data violations will be addressed under Decree 330, while data collection, storage, sharing, exchanges and intermediaries will fall under Decree 363.
The Article 4(4) safeguard is the other headline: authorities may suspend a violating database operator, but unrelated government and public-service functions will be required to continue.
Who is affected
E-commerce platforms, social networks, telecom operators, fintech firms, data intermediaries, data-exchange operators, analytics and aggregation services and participants in controlled testing all fall within the decree’s scope, as do foreign firms directly engaged in data activities in Vietnam. Agencies operating public databases will be subject to a dual rule: staff will be sanctioned only for acts outside assigned state-management tasks, while the agency itself will remain covered for violations outside that shield. Provincial agencies taking on new operational duties under other recent instruments, such as the carbon-registry decentralization under Decree 396/2026, will be considered data operators under this regime wherever they run databases.
Notes for investors and operators
On implementation: proposed by the Ministry of Public Security, but as of October 29, 2026 no implementation guidance had been published. The National Assembly is debating the Data Security Law this session; if enacted, it may reshape the data framework this decree enforces. Platforms working to the December 31, 2026 VNeID linkage deadline under Decree 320/2026 face a second, faster compliance track: the data-fines regime comes into effect first, on November 11.
What businesses should do next: Audit consent records, collection processes and scope statements before November 11, 2026. Adopt data-classification, access-control and security processes now: the decree will be able to order remediation on top of fines. Data-exchange and intermediary or analytics providers should confirm licensing status: licenses may be suspended or surrendered. Database operators should know the Article 4(4) safeguard. Preserve records: the one-year limitation period means a violation discovered within a year may still result in punishment.
Sources and the official text
No Official Gazette (Cong Bao) link for Decree 363/2026/ND-CP was found; the full-text link below is therefore the legal-database reproduction, not the gazette.
LuatVietnam legal database, Decree 363/2026/ND-CP full text (Vietnamese): Decree 363/2026/ND-CP full text (Vietnamese)
VTV, new policies taking effect in November 2026 including Decree 363/2026 (legal press, Vietnamese): New policies taking effect in November 2026
Kenh14, data-fine details citing the Government Portal (legal press, Vietnamese): Data-fine details citing the Government Portal
Daibieunhandan, Q and A on Article 11 data-governance violations (legislative press, Vietnamese): Q and A on Article 11 data-governance violations
EY Legal Flash, Decree 330/2026/ND-CP sanctions for cybersecurity and personal-data protection (law-firm alert, English): Decree 330/2026/ND-CP sanctions for cybersecurity and personal-data protection
Quang Ngai provincial government portal, Decree 330/2026/ND-CP summary (government portal, Vietnamese): Decree 330/2026/ND-CP summary
About this explainer: VoltViet prepared this summary in English from the official Vietnamese text so that investors and operators can follow what the document does. It is a reading aid, not a translation of record and not legal advice. Where any wording here differs from the Vietnamese text, the Vietnamese text governs. For decisions with legal or financial consequences, rely on the official text linked above and take advice from a qualified Vietnamese lawyer.
Related reading
More explainers from the Policy & Law desk, and reporting from the Tech & AI desk. See also our explainer on the companion compliance track: Decree 320/2026 Makes VNeID Linkage Mandatory for Platform Accounts.
