On 19 August 2026, the government issued Decree 330/2026/ND-CP, effective immediately. It is the long-awaited sanctions framework for two connected compliance areas: cybersecurity and personal data protection. Decree 330 does not rewrite existing duties, which remain largely as they were under the underlying laws. What it does is attach specific fines, additional sanctions and remedial measures to defined violations, answering a question many businesses could not previously assess clearly: what actually happens if they fail to meet those duties.
The core message is that compliance now needs to show up in systems, contracts, vendors and daily operations, not only in policies and assessment dossiers. This article sets out the legal architecture behind Decree 330, why it marks a turning point, where violations tend to arise in practice, the penalty structure itself, which businesses are affected and what a practical response looks like.
The legal architecture behind Decree 330
Decree 330 sits on top of duties that already existed. It supplies the enforcement layer; the underlying obligations sit elsewhere.
| Existing obligation | Primary legal source |
|---|---|
| Cybersecurity duties | Law No. 116/2025/QH15 on Cybersecurity |
| Personal data protection obligations | Law No. 91/2025/QH15 on Personal Data Protection (PDPL) |
| Implementing rules for the PDPL | Decree No. 356/2025/ND-CP (Decree 356) |
| Penalties and remedial measures | Decree No. 330/2026/ND-CP (Decree 330) |
Vietnam’s dedicated personal data framework began with Decree 13/2023/ND-CP. That decree has since been superseded by the PDPL and Decree 356, both effective from 1 January 2026, which introduced a more comprehensive regime covering data processing, consent, data subject rights, impact assessments, cross-border transfers, security measures and internal accountability. Those obligations were already in force before Decree 330. What changed is the enforcement exposure behind them.
The scope is broad. Decree 330 applies to:
- Vietnamese and foreign individuals and organisations that commit covered violations within Vietnam’s territory and maritime zones
- Conduct on Vietnamese-flagged aircraft and vessels, subject to any applicable international treaty
- Household businesses and households, which are subject to individual fine levels
The limitation period is generally one year. For a continuing violation, the point at which it ends needs to be determined under Decree 330 rather than assumed to run from the initial act.
Why Decree 330 is a turning point
Before Decree 330, many businesses treated personal data compliance as important but not urgent, largely because the obligations existed without a dedicated penalty framework behind them. In practice, compliance often meant preparing policies, privacy notices, consent forms and assessment dossiers rather than building controls that worked across systems, contracts, vendors and daily operations.
Decree 330 changes what happens once those documents exist, because implementation gaps are now easier to test.
| Before Decree 330 | After Decree 330 |
|---|---|
| Obligations existed, with no dedicated penalty framework for PDP violations | Violations are linked to specific administrative fines and remedial measures |
| Compliance was largely a documentation exercise focused on policies and notices | Businesses are expected to demonstrate actual implementation, including SOPs, responsibility matrices and data subject request handling |
| Implementation was considered important but not always an immediate priority | Implementation is an immediate enforcement and governance priority |
| Cross-border transfer risk was often treated as a procedural matter | Certain serious cross-border transfer violations can trigger revenue-based fines |
| Cybersecurity and data protection were often managed separately | The two are increasingly treated as interconnected elements of the same regulatory risk |
The consequences can extend well beyond the monetary fine. Depending on the violation, a business may face suspension of relevant processing or transfer activities, deletion of personal data, disgorgement of unlawful gains, public correction, changes to internal practices or an obligation to evidence remediation to the competent authority. Several of these can create more operational disruption than the fine itself.
Where personal data violations tend to arise
Violations are not limited to obvious failures such as the absence of a privacy policy or a required impact assessment. In practice, non-compliance often comes from routine operational activity, system design choices, incomplete documentation or delays in day-to-day data handling.
Common examples include:
- Consent-related issues, such as using one bundled consent for multiple processing purposes, failing to obtain separate consent where required or being unable to produce sufficient evidence or logs showing when and how consent was obtained.
- Data subject request failures, including delays in responding to access, correction, deletion or withdrawal, restriction or objection requests within the applicable statutory timeframe, which varies by the right being exercised and the parties involved.
- Inconsistencies between documentation and actual practices, for example where the privacy notice states one processing purpose but the business later uses the data for an additional purpose that was not properly disclosed.
- Retention and deletion failures, such as retaining personal data after the relevant processing purpose has ended without another lawful retention requirement, or failing to implement deletion obligations consistently across systems and backups.
- Cross-border transfer deficiencies, including incomplete transfer assessments, failure to update required documentation when a new overseas recipient or cloud provider is introduced or gaps in contractual arrangements governing overseas data transfers.
- Vendor and processor management issues where processors, sub-processors or group companies process data beyond the agreed scope or without appropriate contractual safeguards.
These examples show that violations under Decree 330 are rarely just failures of legal documentation. They tend to come from a combination of policy gaps, procedural weaknesses, system configuration, human error and changes in actual processing activity that documentation never caught up with.
The penalty structure
The fine levels below are presented on an organisational basis. For the same personal data violation, an individual’s fine is generally half the organisational fine (the reverse applies in the cybersecurity sections of Decree 330, where the stated levels apply to individuals and organisations face twice those amounts).
The regime combines fixed fines with proceeds-based and revenue-based penalties for specified serious conduct. Two distinctions matter here: VND 3 billion is a statutory ceiling for the residual category of other violations, and revenue-based fines apply only where the statutory serious cross-border transfer triggers and thresholds are met.
| Most serious conduct | Maximum exposure |
|---|---|
| Serious cross-border data transfer violations (Article 56) | Up to 5% of prior financial year revenue in the Vietnam market, with a fixed fallback regime where specified |
| Unlawful trading of personal data (Article 53) | 2 to 10 times the proceeds, with fixed fines in specified cases |
| Other violations (statutory ceiling) | Up to VND 3 billion (a maximum, not a default fine) |
Beneath those headline figures sits a detailed schedule of specific violations, including consent defects, processing beyond the permitted basis, failure to notify data subjects, misuse of biometric data, unlawful marketing communications and obstruction of lawful activities.
| Example violation | Indicative organisational fine |
|---|---|
| Treating silence or non-response as consent | Up to VND 70 million |
| Consent defects: incomplete notice, non-specific consent, unretained consent records or failure to notify processing of sensitive data | VND 30 to 50 million |
| Processing personal data without consent or another valid legal basis | VND 30 to 50 million |
| Using biometric data beyond its original purpose without a proper legal basis | VND 50 to 150 million |
| Marketing emails, texts or calls without prior consent | Up to VND 40 million |
| Obstructing lawful activities or unlawfully using another person’s personal data | VND 40 to 60 million |
The penalty regime can broadly be seen in three levels:
- Fixed fines for ordinary breaches: purpose limitation, data minimisation, consent procedures or required DPIA/DTIA documentation. Example: a business collects consent through an “I agree” checkbox but cannot produce logs showing who consented, when, for what purpose and on what terms. Even where consent was genuinely given, the failure to evidence it can draw a fine of VND 30 to 50 million.
- Fines that scale with impact: based on the number of affected data subjects, the type of data, the level of harm and the seriousness of the conduct. Example: a business shares the contact details of 800 customers with a third party for commercial purposes with no identifiable unlawful proceeds; the applicable fine may run VND 70 to 100 million.
- Economic fines linked to unlawful proceeds or revenue: reserved for the most serious conduct, such as illegal data trading or major cross-border breaches. Example: a business transfers customer data abroad without the required cross-border impact assessment, and the resulting leak affects 1.2 million Vietnamese data subjects. Where the Article 56(3)(c) conditions are met, the fine can run 3% to 5% of the organisation’s prior-year revenue in the Vietnam market. On VND 1,000 billion of revenue, that is VND 30 to 50 billion. Where Article 56(4) applies instead, because there is no such revenue or the percentage falls below the statutory threshold, a fixed fallback band applies based on the number of affected data subjects.
Beyond fines, Decree 330 allows for additional sanctions: suspension of licences or operations, deletion of unlawfully processed or transferred data, suspension of cross-border transfers, surrender of unlawful gains and remediation of data breaches. Where personal data is embedded in contracting, payments, customer management, HR systems or daily communications, these measures can affect business continuity more directly than the fine itself.
Cloud hosting, overseas group platforms, regional HR systems, offshore vendors and remote access by foreign affiliates can all form part of a cross-border data flow and are worth reviewing through this lens now. Ordinary DTIA compliance failures generally draw fixed fines; the revenue-based penalties apply only to serious violations under Article 56(3).
Which businesses are affected
The short answer is that almost every business operating in Vietnam falls within scope, and very few are likely to sit outside it. Decree 330 reaches well beyond technology companies, e-commerce platforms, financial institutions and consumer-facing businesses. Ordinary operating companies process personal data through HR, finance, IT, procurement and other everyday functions, including:
- Employee records, payroll information and HR files
- Recruitment documents and candidate databases
- Supplier, customer and business contact information
- CCTV, visitor logs and access records
- Internal IT systems, shared drives and cloud storage
- Accounting, HR, CRM and ERP platforms
- Group reporting systems
- Payroll providers, IT support vendors and outsourced service providers
The practical question is whether the company collects, stores, uses, discloses, transfers or otherwise processes personal data in Vietnam. For most businesses, the answer is yes, regardless of sector, business model or customer profile.
Offshore involvement does not remove this exposure. Decree 330 follows the actual data flows and access arrangements, including offshore access, rather than only the company’s registered address. Foreign entities, overseas affiliates, regional offices, cloud vendors and cross-border service providers can become relevant wherever personal data collected or stored in Vietnam reaches them, whether through servers abroad, an overseas platform or continued processing elsewhere. Remote access is best assessed against the statutory categories based on actual system architecture, rather than treated as an automatic cross-border transfer in every case.
A cross-border transfer can arise in more than one way. Beyond formal transmission abroad, it can also occur when personal data is:
- Stored on overseas cloud servers
- Accessed by a parent company or regional office outside Vietnam
- Processed through global HR, payroll, CRM or ERP systems
- Shared with offshore vendors or IT support teams
- Made available through group-wide platforms
The practical takeaway is to review actual data flows rather than only contractual arrangements. A flow that was never labelled a “transfer” can still create compliance exposure.
From documents to operating controls
The most important shift under Decree 330 is evidential. A privacy policy, consent form or impact assessment file is not enough if the business cannot show how personal data is actually managed in practice. This is where many companies find the real gap: the documents exist, but HR, IT, finance, marketing, procurement and business teams do not apply them consistently.
| Area | Be ready to evidence | Common gap |
|---|---|---|
| Data mapping | Inventory, processing records and data-flow maps | No clear record of flows, systems and access rights |
| Classification | Which data is sensitive and its enhanced safeguards | Basic and sensitive data not separated |
| Legal basis and consent | Purpose mapping, lawful ground, consent logs and withdrawal | Generic or bundled consent with no basis mapping |
| Data subject rights | Workflow, owners, timelines and response templates | No process for access, deletion or objection |
| Cross-border | Transfer assessment (DTIA where applicable), contracts and records | Cloud or group access not identified as a transfer |
| Vendors | Controller/processor roles and data processing agreements | Contracts do not allocate responsibility clearly |
| Retention | Retention schedule and deletion or anonymisation | Data kept indefinitely without justification |
| Incident response | Escalation, notification and remediation procedure | No tested breach-response plan |
| Cybersecurity | Access control, logging, encryption and periodic review | Controls applied inconsistently |
Personal data compliance does not sit in isolation
The same business activity can fall within several regulatory regimes at once, depending on whose data is involved and the commercial context.
| Regulatory area | Why it overlaps | Typical examples |
|---|---|---|
| Consumer protection | Customer information can be both personal data and consumer-protected information | Consent mechanisms, standard-form contracts, transparency |
| Advertising and marketing | Marketing relies on customer profiles and behavioural data | Targeted advertising, profiling, marketing consent |
| E-commerce and digital platforms | Online businesses collect identity, contact and transaction data | Customer accounts, transaction records, platform disclosures |
| Children’s data | Processing involving children attracts enhanced protection | Age verification, parental consent, child-friendly notices |
| Employee data | Employers process large volumes of data across the employment lifecycle | Recruitment, payroll, health data, biometrics, monitoring |
A single practice can create several issues at once: a marketing campaign can raise consent, advertising, consumer protection and e-commerce obligations together, while employee monitoring can raise both data protection and employment law concerns. Reviewing personal data compliance as a standalone legal workstream misses that overlap.
A further development worth watching: the Ministry of Public Security’s 2026 draft Criminal Code amendment proposes new personal data offences, including infringement of personal data, unlawful buying and selling of personal data and obstruction of personal data protection activities, with proposed imprisonment terms and liability that may extend to commercial legal entities. These provisions remain draft proposals, not enacted law, and their wording, thresholds and sanctions may change before adoption. The direction is nonetheless clear: Vietnam’s enforcement framework is developing beyond administrative fines, and serious misuse or interference with regulatory oversight could ultimately carry administrative, sectoral and potentially criminal consequences.
What businesses can do now
Decree 330 is a reasonable trigger to test whether a personal data compliance framework is operationally ready. A practical review tends to cover:
- Map processing activities: what personal data is collected, from whom, for what purpose, where it is stored, who can access it and whether it is transferred overseas
- Classify personal data: separate basic from sensitive personal data and apply safeguards based on sensitivity and risk
- Review legal basis and consent: confirm the basis for each processing purpose, and check that consent, where used, is specific, informed, unbundled and evidenced
- Update DPIA and DTIA files: confirm which assessments apply, particularly for cloud systems, overseas access and group platforms
- Build data subject request procedures: workflows, responsible people, response templates and statutory timelines
- Review vendor and intra-group arrangements: update data processing agreements and transfer terms with processors, cloud vendors and affiliates
- Adopt retention and deletion controls: define retention periods and implement deletion or anonymisation when they expire
- Strengthen incident response: escalation, investigation, notification and remediation procedures, tested before an incident occurs
- Name and empower responsible personnel: a clear mandate, documented responsibilities and sufficient access to coordinate implementation
- Raise awareness across the business: HR, IT, legal, compliance, finance, marketing, sales, procurement and management all need to recognise where personal data risk arises in their own work
Where this leaves businesses
Decree 330 marks a shift from paper compliance to enforcement-ready compliance. The core obligations under the PDPL and Decree 356 have not changed, but the consequences of a policy that does not match daily practice are now specific: administrative fines, additional sanctions such as suspension of processing or transfers and a developing possibility of personal criminal exposure for the most serious conduct. The businesses best placed to manage that are the ones that treat documentation as a starting point, and that can show how personal data moves through their systems, contracts and teams. A sensible priority is identifying the largest practical gaps first, typically data mapping, consent and legal basis management, cross-border transfers, vendor governance and incident response.
How Acclime can help with personal data compliance
Acclime supports businesses on a modular basis, starting with a focused personal data compliance health check to identify gaps and prioritise remediation. Support can extend to policies and SOPs, contracts and data transfer arrangements, DPIA and DTIA preparation, incident and data subject workflows and ongoing advisory support as processing activities change. By working with Acclime, a business can build a framework its teams actually use day to day and one it can evidence if a regulator asks. Talk to an expert to assess where your business stands against Decree 330.
Contacts
- Rizwan Khan – Managing Partner – r.khan@acclime.com
- Thao Nguyen – Senior Manager, Licensing and Corporate Secretarial – thao.nguyen@acclime.com
- Duyen Nguyen – Assistant Manager, Licensing and Corporate Secretarial – duyen.nguyen@acclime.com
- Hoang Vu – Assistant Manager, Licensing and Corporate Secretarial – hoang.vu@acclime.com
- Ngoc Thao Nguyen, Assistant Manager – Licensing and Corporate Secretarial: ngocthao.nguyen@acclime.com
