Decree 330 Sets Cross-Border Data Fines Up to 5% of Revenue

Unofficial English summary for reference only. Not a legal translation and not legal advice. The Vietnamese text linked at the end of this page is authoritative.

What the document does

Decree 330/2026/ND-CP is a decree outlining penalties across four chapters and 82 articles. It defines the administrative violations, the forms and levels of penalties, the remedial measures, and the penalty-imposing authorities for cybersecurity and personal data protection under the Cybersecurity Law, Law 116/2025/QH15, and the Personal Data Protection Law, Law 91/2025/QH15. Its stated objective is to give those laws teeth: the data duties themselves come from the laws and their implementing rules, including Decree 356/2025/ND-CP, and this decree only sets the penalties for their violation. It creates no new data-protection obligation of its own.

The decree’s scope is deliberately wide. It applies to Vietnamese and foreign individuals and organizations, including foreign organizations providing telecommunications, internet, online-content, information-technology, cybersecurity and cross-border services, and foreign entities directly processing the personal data of Vietnamese citizens (Article 2). Fines for business households are assessed at the individual rate. A violation covered by both this decree and another penalties decree is governed by this decree if it involves cybersecurity or data protection (Article 1(3)).

One convention governs all figures in Chapter II; misunderstanding it will affect every number presented in this explainer. Sections 1 to 5 of Chapter II, covering cybersecurity violations in Articles 9 to 38, state fines for individuals; an organization committing the same act pays double. Section 6, covering personal data protection in Articles 39 to 71, states fines for organizations; an individual committing the same act pays half (Article 7(1)). This article follows the text’s own convention throughout: cybersecurity figures below are individual figures, and data-protection figures are organization figures, unless stated otherwise.

The maximum penalties are set out in Article 7. In the cybersecurity field, the maximum fine is VND 200 million for an organization and VND 100 million for an individual (Article 7(3)). In the data-protection field, three ceilings apply to organizations: buying and selling personal data carries a maximum of 10 times the unlawful gains; cross-border transfer violations carry a maximum of 5 percent of the organization’s preceding-year revenue; and all other data-protection breaches carry a maximum of VND 3 billion (Article 7(4)). Where there is no preceding-year revenue, or the revenue-based figure falls below the VND 3 billion ceiling, the VND 3 billion ceiling applies instead. Individuals pay half of each ceiling. The prescription period for all violations under the decree is one year (Article 3).

Principal penalties are a warning or a fine (Article 4(1)). Supplementary penalties can affect operations, not just finances: deprivation of licenses or practice certificates for 1 to 24 months, including social-network service licenses and data-processing service licenses; suspension of activities for 1 to 24 months; confiscation of the tools and equipment used to commit the violation; and expulsion of foreign violators (Article 4(2)). Remedial measures include restoration of information systems, retrieval of data and accounts, deletion, public correction or apology, and disgorgement of unlawful gains (Article 5). For data-protection violations, unlawful gains are calculated on the full transaction value without cost deduction for buying and selling. For other violations, they are based on all actual revenue from the business that used the unlawfully obtained data (Article 6). The decree also covers electronic enforcement, including electronic evidence, digital records of proceedings, and electronic penalty decisions (Article 8).

Chapter III (Articles 72 to 79) assigns penalty-imposing competence to the People’s Police, People’s Committee chairpersons and inspectors, with further competence for the border, customs and market-surveillance forces in their own fields.

What changes in practice

The primary change is the revenue-based fine. Article 56 sets fines for cross-border transfers made without a transfer impact assessment, those that conceal or misreport data flows leading to personal data leaks, or those that continue after a stop order. The fine is a percentage of the organization’s prior fiscal year revenue in the Vietnam market: 1 to 2 percent where the leak affects 10,000 to under 100,000 Vietnamese data subjects, 2 to 3 percent where it affects 100,000 to under 1,000,000, and 3 to 5 percent where it affects 1,000,000 or more, or where a transfer continued after a stop order causes harm to national defense or security (Article 56(3)). Where the organization has no Vietnam-market revenue in the prior fiscal year, or the revenue-based figure falls below VND 3 billion, fixed brackets apply instead: VND 200 to 500 million, VND 500 million to 1 billion, and VND 1 to 3 billion for the same three tiers (Article 56(4)). A transfer made in breach can also be suspended for 6 to 12 months (Article 56(5)). This is the first revenue-percentage administrative fine in Vietnam’s data-protection field, and it represents the single largest exposure in the decree.

The second key change concerns the penalties for trading in personal data. Article 53 imposes fines for unlawful buying and selling, ranging from 2 to 10 times the unlawful gains. Where there are no gains, fixed brackets apply by the number of data subjects: VND 70 to 100 million for basic data of under 1,000 subjects or sensitive data of under 200; rising to VND 500 million to 1 billion for basic data of 10,000 subjects or more or sensitive data of 2,000 or more; and VND 1 to 3 billion where the trade harms national defense, security, foreign affairs, the macroeconomy, or the life, health, honor, or property of the data subjects. The data must be permanently deleted, the gains disgorged, and every affected data subject notified.

Penalties for everyday platform conduct are now specified in detail. Article 65 fines social networks, online communication services, and digital-content platforms VND 50 to 70 million for failing to provide users with clear notice of the data collected, a cookie opt-out, a do-not-track option, a transparent privacy policy, or a mechanism to access, correct and delete their data. The higher bracket, VND 70 to 150 million, covers forcing users to provide images of their identity documents for ordinary account verification where other specific laws do not require identification, covert eavesdropping or call recording, automatic extraction of contacts or media files, and collection beyond the agreed scope. A platform can also be suspended in Vietnam for 1 to 3 months for the lower bracket and 3 to 6 months for the upper bracket.

Consent is treated as a process with specific requirements and penalties, rather than a mere formality. Article 43 fines VND 30 to 50 million for processing without consent, pre-ticked consent, unclear consent, no consent log, or no notice for sensitive data. Deliberately continuing to process data after a stop or restriction request, or treating silence as consent, carries VND 50 to 70 million. Failure to meet deadlines related to data-subject rights carries specific fines: VND 10 to 20 million for having no process for handling requests or failing to respond within 2 working days; VND 20 to 30 million for processors missing their deadlines; and VND 30 to 40 million for controllers missing the 10, 15 or 20-day execution deadlines (Article 44). Obstructing withdrawal of consent, or failing to stop processing after withdrawal, carries VND 20 to 30 million (Article 45).

Operators should note two key procedural deadlines related to filing duties. A data-processing impact assessment must be filed with the Department of Cybersecurity and Hi-Tech Crime Prevention within 60 days of first processing, and a transfer impact assessment within 60 days of first cross-border transfer, with updates every six months or upon any change (Articles 55(1)(b) and 56(1)(b)). Failure to file, or to update, carries VND 20 to 30 million for the processing assessment and VND 30 to 50 million for the transfer assessment; a falsified processing assessment, or refusal to correct one, carries VND 50 to 100 million (Articles 55 and 56(1)). A serious breach must be notified to the specialized data-protection authority within 72 hours. Failure to notify at all carries VND 20 to 40 million, while notification later than 72 hours carries VND 40 to 60 million (Article 54).

The decree also explicitly defines penalties for newer technologies. Article 67 fines artificial-intelligence and metaverse systems VND 20 to 50 million for skipping the annual compliance assessment, VND 50 to 70 million for failing to explain how an algorithm works, provide an opt-out from automated processing and a risk classification, and VND 70 to 100 million for running automated decisions that affect security or legitimate rights without human review. Article 68 fines blockchain systems VND 70 to 150 million for storing personal data in plaintext on-chain without de-identification or hashing. Under Article 66, big-data systems face VND 20 to 30 million for having no retention and deletion policy, VND 30 to 50 million for running without multi-factor authentication, access controls or encryption, and VND 50 to 100 million for automated decisions with no human review. Public audio and video recording is subject to penalties under Article 71: VND 10 to 20 million for operating without signage warning people they are being recorded, and VND 30 to 50 million for commercial use of public CCTV data, behavioral analysis or automated facial-recognition profiling without lawful consent.

The cybersecurity half of the decree is quieter but still broad. Unlawful information sharing carries VND 5 to 10 million or 10 to 20 million depending on content (Article 9); false or unverified information that causes public confusion carries VND 5 to 30 million (Article 11). Cyberattacks carry VND 20 to 30 million, rising to VND 30 to 50 million for producing or trading malware or providing attack services (Article 16). Failing to cooperate with the specialized cybersecurity force within 24 hours of a request during a dangerous cybersecurity situation carries VND 25 to 50 million (Article 18). Unauthorized access to another person’s network or digital device carries VND 50 to 70 million (Article 19). Penalties for spam are tiered: unsolicited advertising messages carry VND 10 to 20 million, rising to VND 90 to 100 million for failing to block numbers used for spam. A cap of three advertisements per 24 hours applies, with sending windows of 07:00 to 22:00 for SMS and email, and 08:00 to 17:00 for calls (Article 37). Operating a cybersecurity business without a license carries VND 75 to 100 million, and importing cybersecurity products without a license carries the same (Articles 35 and 36). All of these are individual figures; organizations pay double.

What changed from the previous rules

Decree 330 does not repeal or amend any earlier decree. No repeal clause exists anywhere in its text, and no earlier instrument is identified as replaced. The comparison here is therefore not between an old decree and a new one. It is between having no dedicated sanctions regime for the field and having one.

Before this decree, the Personal Data Protection Law, Law 91/2025/QH15, in force since January 1, 2026, set data duties without a penalties decree of its own. Cybersecurity and data violations were sanctioned under the scattered provisions of other penalties decrees, including Decree 15/2020/ND-CP on postal services, telecommunications, information technology and e-transactions, as amended by Decrees 14/2022/ND-CP and 211/2025/ND-CP. That is the regime this decree supersedes in substance for its field, even though it repeals nothing in form. Readers should not look for a single old article that this decree replaces; the change is the consolidation of the whole field under one instrument.

What is genuinely new is the scale and the specificity. To date, no earlier penalties regime in Vietnam has priced a violation as a percentage of revenue, set a VND 3 billion ceiling for data breaches, or fined data trading at 10 times the unlawful gains. The detailed consent, social-network, artificial-intelligence, blockchain and cloud articles appear to have no direct equivalent in the earlier scattered provisions. The 72-hour breach-notification clock and the 60-day impact-assessment filing duties are likewise new as codified obligations with associated penalties.

What remains consistent are the lower-tier penalties. The VND 5 to 30 million brackets for unlawful online content and the spam ladder up to VND 100 million continue the scale of the earlier telecommunications and information-technology penalties. The decree introduces significant changes to the highest penalties, rather than extensively rewriting the lower-tier provisions.

One transition rule is important for anyone interpreting the decree now. Conduct that took place before August 19, 2026 and is discovered or handled afterwards is judged under the penalties decrees in force when the violation was committed, unless this decree provides for no penalty or a lighter penalty, in which case this decree applies (Article 81(1)). Minutes already drawn up and decisions already issued follow the old rules. The new ceilings do not apply retrospectively to conduct that predates the decree.

Who is affected

Every organization processing Vietnamese personal data, onshore or offshore, is in scope. That expressly includes foreign providers of telecommunications, internet, online content, information technology, cybersecurity and cross-border services, and foreign entities directly processing the personal data of Vietnamese citizens (Article 2). A foreign cloud, software, social-network, e-commerce or advertising-technology provider with Vietnamese users is covered even with no office in Vietnam.

Social networks, over-the-top applications and digital-content platforms face Article 65. Artificial-intelligence and metaverse operators face penalties under Article 67, blockchain platforms under Article 68, cloud providers under Article 69, and big-data operators under Article 66. Any organization transferring personal data across borders faces Article 56, and the revenue-based fine is its single largest exposure. Data brokers and anyone buying or selling personal data face Article 53. Cybersecurity product and service businesses face Articles 35 and 36, and data-protection service providers face Articles 58 and 59, including a VND 50 to 80 million fine for running a data-processing service business without the required certificate. Operators of public CCTV and audio-recording systems face Article 71, employers and recruiters are subject to Article 61 (which concerns recruitment data), and anyone processing children’s data is subject to Article 60.

Notes for investors and operators

The decree has been in force since August 19, 2026. First, it is crucial to understand that the decree took effect immediately: nothing in it awaits a future effective date, and the fines described here have applied for nearly three months. What has not yet appeared is the implementation guidance the Minister of Public Security is charged with issuing under Article 82. Operators should watch for it, but they should not wait for it: the decree is enforceable as written, and the authorities named in Chapter III can already impose its fines.

The second thing to get right is the fine convention. A figure quoted from the cybersecurity half of the decree is an individual figure, and an organization pays double. A figure quoted from the data-protection half is an organization figure, and an individual pays half. Any compliance memo or board paper that mixes the two halves without stating the convention will overstate some exposures and understate others by a factor of two.

The third is the revenue question. The 5 percent ceiling in Article 7(4) is measured on the organization’s preceding-year revenue, while the tiered 1 to 5 percent fines in Article 56(3) are measured on prior fiscal year revenue in the Vietnam market. An organization with no Vietnam-market revenue in the prior fiscal year falls back to the fixed VND 200 million to 3 billion brackets in Article 56(4). The revenue base is therefore a compliance fact to establish now, not a detail to work out after a breach.

What businesses should do next: file the data-processing impact assessment with the Department of Cybersecurity and Hi-Tech Crime Prevention within 60 days of first processing, and the transfer impact assessment within 60 days of first cross-border transfer, and update both every six months or upon any change (Articles 55 and 56). Check consent mechanics: ensure no pre-ticked consent, no treating silence as consent, purpose-specific consent, and that consent logs are kept and provable (Article 43). Answer data-subject requests within 2 working days and meet the 10, 15 and 20-day execution deadlines (Article 44). Notify the specialized data-protection authority within 72 hours of a serious breach (Article 54). Social networks and applications should provide cookie opt-outs and do-not-track options, publish a transparent privacy policy, and stop requiring images of identity documents for ordinary account verification (Article 65). Appoint data-protection personnel who meet the eligibility requirements in Article 57, and watch for the Ministry of Public Security’s implementation guidance under Article 82.

Sources and the official text

Thu Vien Phap Luat (legal database), full Vietnamese text of Decree 330/2026/ND-CP, reviewed in its entirety; confirms the document number, issuing body, signer, signing date of August 19, 2026 and effective date of August 19, 2026 under Article 80. No Official Gazette (Cong Bao) URL for this decree was verifiable at the time of writing; the Thu Vien Phap Luat text above is the full text relied on. https://thuvienphapluat.vn/bulletin/document.aspx?key1=0=RVME5EZzTV

Tilleke and Gibbins (law firm alert), Vietnam issues cybersecurity and personal data protection sanctions decree; the 5 percent of revenue and VND 3 billion figures cited in this explainer were verified against the decree text itself. https://www.tilleke.com/insights/vietnam-issues-cybersecurity-and-personal-data-protection-sanctions-decree/

EY Vietnam (legal alert), Decree 330 providing sanctions for personal data protection, October 2026. https://www.ey.com/content/dam/ey-unified-site/ey-com/vi-vn/technical/tax/documents/ey-vn-decree-330-providing-sanctions-for-personal-data-protection.pdf

About this explainer: VoltViet prepared this summary in English from the official Vietnamese text so that investors and operators can follow what the document does. It is a reading aid, not a translation of record and not legal advice. Where any wording here differs from the Vietnamese text, the Vietnamese text governs. For decisions with legal or financial consequences, rely on the official text linked above and take advice from a qualified Vietnamese lawyer.

Related reading

More explainers from the Policy & Law desk, and reporting from the Tech & AI desk.