Decree 363/2026 Sets Data Fines Up to VND 200 Million

Unofficial English summary for reference only. Not a legal translation and not legal advice. The Vietnamese text linked at the end of this page is authoritative.

What the document does

Decree 363/2026/ND-CP is a penalties decree in four chapters and 36 articles. It defines the administrative violations and the forms and levels of penalties for the data field under the Data Law. It also sets the remedial measures and the penalty-imposing authorities. Its stated objective is to give the Data Law teeth: before this decree there was no standalone penalties regime for data violations, and breaches were handled under general administrative-penalties rules.

Before examining specific figures, three key points about the decree’s scope are important. First, the decree does not cover violations already governed by the decree on administrative penalties in cybersecurity and personal data protection. That decree is Decree 330/2026/ND-CP, which took effect on August 19, 2026. The two decrees are companions. Decree 330 covers cybersecurity and personal-data breaches, while Decree 363 covers the rest of the data field, including collection, classification, storage, governance, access, sharing, analysis, data services, data platforms and controlled testing. Second, it applies to Vietnamese and foreign agencies, organizations and individuals in Vietnam, and to foreign parties directly involved in data activities in Vietnam; state agencies are covered when the act falls outside their assigned governmental duties. Third, the prescription period for a data violation is one year (Article 3).

On timing, the decree is clear. Article 34 sets the effective date at November 11, 2026, and nothing in the decree is operative before that date. The Ministry of Public Security is charged with guiding and organizing implementation under Article 36, and no implementing guidance had been published at the time of writing. No fine in this explainer is being imposed today.

What changes in practice

Article 6 sets the ceilings: a maximum fine of VND 100 million for an individual, and twice that, VND 200 million, for an organization. Fines in Chapter II are stated for individuals. Five provisions are stated for organizations instead: point b clause 1 of Article 8, Article 9, Article 10, clause 2 of Article 13 and clause 4 of Article 16.

Prohibited acts in the data field (Article 7) carry fines of VND 40 to 60 million. The fine rises to VND 60 to 80 million for obstructing lawful data processing or attacking, seizing or destroying databases. Unlawful collection and creation of data (Article 8) carries VND 20 to 40 million. It rises to VND 40 to 60 million for deliberate falsification, fake data, over-collection, or cases involving core data, nationally important data or leaked sensitive information. Data classification failures (Article 9) carry VND 30 to 50 million for organizations. Storage failures (Article 10) carry VND 10 to 30 million, rising to VND 30 to 70 million for core or important data, unauthorized transfer, or offshore storage of core or important data. Governance failures (Article 11) carry VND 20 to 40 million. Access and retrieval (Article 12) can result in penalties ranging from a warning up to VND 40 to 60 million for deliberate out-of-scope access, unauthorized access to core or important data, or the use of automated scraping tools. Connection and sharing (Article 13) carries VND 20 to 40 million. It rises to VND 60 to 80 million for agencies blocking mandatory sharing, and to VND 80 to 100 million for unauthorized sharing of core, important or national data, or API-based unlawful extraction.

The remaining violation groups, Articles 14 to 26, follow the same pattern of rising brackets. Article 14 covers data analysis and synthesis. Article 15 covers confirmation and validation of data, with fines up to VND 60 to 80 million for forging validation results or using tools to defeat a validation mechanism. Article 16 covers supplying data to state agencies. Fines reach VND 80 to 100 million for organizations that fail to keep received data safe or to delete it when its retention period ends. Article 17 covers open data, from a warning for late publication up to VND 40 to 80 million for using publication to spread false information. Article 18 covers encryption and decryption, up to VND 60 to 100 million for trading unlawful decryption tools or obstructing decryption efforts by state authorities. Article 19 covers cross-border transfer, up to VND 80 to 100 million for moving core or important data abroad in ways that affect national defense, security or public order. Article 20 covers data audits and database rankings, Article 21 covers other data-processing activities, and Article 22 covers risk identification, data protection and supervision, all with maximum penalties of VND 100 million. Article 23 covers data exchanges, where trading prohibited data, including core data, carries VND 80 to 100 million. Articles 24 to 26 cover data intermediaries, the National Data Development Fund and controlled testing. Using a sandbox to hide a data-security breach or process core data outside the approved scope carries VND 60 to 80 million.

Fines are only part of the exposure. The supplementary penalties can stop a business. They include fixed-term deprivation of licenses, including data-platform and controlled-testing certificates, and confiscation of tools, software and data used in the violation. They also include fixed-term suspension of data activities, database or platform operation, controlled testing, or participation in Fund programs, and expulsion of foreigners. Suspension periods run from one to six months for most data-processing and sharing violations, six to nine months for database or platform operation where core-data leaks or falsification are involved, and up to eighteen months for data-exchange operation.

Remedial measures include: restoring data and databases, correcting falsified data histories, deleting unlawfully collected, copied or transferred data, notifying affected data subjects of incidents, removing offending applications and software, issuing the missing procedures, classifying data, and disgorging unlawful gains.

Article 35 governs transition. Violations that ended before November 11, 2026 but are detected afterwards are dealt with under the rules in force when the violation was committed; violations that began before that date but are still ongoing are handled under Decree 363. Penalty decisions already issued or fully enforced before November 11, 2026 follow the old rules even if the sanctioned party complains afterwards.

Why this decree is new

Nothing was replaced. Decree 363 is a first-generation penalties framework for the data field. It gives effect to the Data Law, so there is no predecessor text to compare against and no continuity check to perform. Readers should treat it as new law, not as a revision: the twenty violation groups, the fine brackets, the supplementary suspensions and the remedial measures did not exist in this form before November 11, 2026. The one boundary that did exist is the carve-out in Article 1(2): cybersecurity and personal-data violations stay under Decree 330, and Decree 363 covers everything else in the data field.

Who is affected

In practice the decree affects any organization handling data in Vietnam. Data-platform operators, data intermediaries, analytics and synthesis providers, holders of core or nationally important data, and state agencies acting outside their assigned governmental duties are all within its scope. Enterprises and public bodies that collect, store, classify, share or analyze data are covered, including foreign-invested firms. Operators of national and specialized databases, data centers and controlled-testing participants face suspension of their licenses and participation in Fund programs. Data, AI and digital-technology companies generally should read it as the enforcement mechanism for the Data Law, to Decree 386/2026/ND-CP on data innovation, which takes effect on December 1, 2026, and to the National Data Center regime. It does not directly affect personal-data controllers: those fall under Decree 330.

Notes for investors and operators

For investors, the decree converts the Data Law from a statement of duties into a priced risk. The fines are moderate by international standards, with a VND 200 million ceiling for organizations, but the supplementary suspensions can halt a data platform, a data exchange or a controlled-testing program for months, and the remedial orders can force deletion of unlawfully held data. The compliance work the decree rewards is mostly procedural: written procedures, classification, access logs and periodic reviews. Several violations are pure omissions, and several of the most expensive brackets turn on whether the data involved is core data or nationally important data.

Enforcement authority rests with the authorities named in Articles 27 to 30: People’s Committee chairpersons at commune and provincial level, police officers and department heads, including heads of departments under the National Data Center, and inspectors. Coordination between agencies regarding data penalties is governed by Article 33.

What businesses should do next: before November 11, 2026, check whether the organization’s data activities fall under Decree 363 or under Decree 330 on personal data and cybersecurity, because the two regimes have different fine scales and different enforcers, and the boundary is Article 1(2). Put the missing procedures in place now. The absence of required procedures is itself finable: no collection or creation procedure (Article 8), no data classification or maintenance and review of classification results (Article 9), no technical storage procedure (Article 10), and no access log or periodic review of access rights (Article 12). For core data and nationally important data, verify storage location and transfer approvals: unauthorized offshore storage or transfer of core or important data sits in the VND 30 to 70 million bracket with deletion as a remedy (Article 10(2)). Note the one-year prescription period (Article 3) and the transition rule (Article 35): conduct that started before November 11, 2026 and continues past that date will be judged under Decree 363. Watch for the Ministry of Public Security’s implementation guidance under Article 36, which had not been published at the time of writing.

Sources and the official text

Thu Vien Phap Luat (legal database), full Vietnamese text of Decree 363/2026/ND-CP, read in full, preamble through Article 36 plus signature block; metadata confirms the document number, issuing body, signer, signing date of September 19, 2026 and effective date of November 11, 2026. The Official Gazette date and number are listed as pending on this page. https://thuvienphapluat.vn/van-ban/Cong-nghe-thong-tin/Nghi-dinh-363-2026-ND-CP-xu-phat-vi-pham-hanh-chinh-trong-linh-vuc-du-lieu-726399.aspx

Thu Vien Phap Luat, November 2026 decrees roundup, listing Decree 363/2026/ND-CP as effective November 11, 2026. https://thuvienphapluat.vn/hoi-dap-phap-luat/tong-hop-nghi-dinh-co-hieu-luc-tu-thang-112026-chi-tiet-the-nao-138107026.html

Decree 330/2026/ND-CP on administrative penalties in cybersecurity and personal data protection, the companion regime carved out by Article 1(2) of Decree 363 (secondary source, for the scope boundary): Allen & Gledhill client alert, October 27, 2026. https://www.allenandgledhill.com/vn/perspectives/articles/18840/vn/perspectives/articles/34711/vnkh-vietnam-introduces-new-penalties-for-cybersecurity-and-personal-data-protection-violations

About this explainer: VoltViet prepared this summary in English from the official Vietnamese text so that investors and operators can follow what the document does. It is a reading aid, not a translation of record and not legal advice. Where any wording here differs from the Vietnamese text, the Vietnamese text governs. For decisions with legal or financial consequences, rely on the official text linked above and take advice from a qualified Vietnamese lawyer.

Related reading

More explainers from the Policy & Law desk, and reporting from the Tech & AI desk.