personal data protection violations will be fined up to 3 billion VND

The Lao Dong Newspaper Legal Consulting Office replied:

Article 8 of the Law on Personal Data Protection (effective from January 1, 2026) stipulates the handling of violations of the law on personal data protection as follows:

1. Organizations and individuals who violate the provisions of this Law and other provisions of law related to personal data protection may be subject to administrative sanctions or criminal prosecution, depending on the nature, severity and consequences of the violation; if they cause damage, they must be compensated according to the provisions of law.

2. The handling of administrative violations in the field of personal data protection shall be implemented in accordance with the provisions of Clauses 3, 4, 5, 6 and 7 of this Article and the law on handling administrative violations.

3. The maximum fine for administrative sanctions for the act of buying and selling personal data is 10 times the revenue from the violation; in case there is no revenue from the violation or the fine calculated according to the revenue from the violation is lower than the maximum fine prescribed in Clause 5 of this Article, the fine prescribed in Clause 5 of this Article shall apply.

4. The maximum penalty for administrative sanctions for organizations that violate the regulation on translating cross-border personal data is 5% of the organization's revenue of the previous year; in case there is no revenue of the previous year or the penalty calculated according to revenue is lower than the maximum penalty as prescribed in Clause 5 of this Article, the penalty level as prescribed in Clause 5 of this Article shall apply.

5. The maximum fine for administrative sanctions for other violations in the field of personal data protection is 3 billion VND.

6. The maximum fine prescribed in Clauses 3, 4 and 5 of this Article shall be applied to an organization; the individual committing the same violation shall be subject to a maximum fine of one-half of the two fines for an organization.

7. The Government stipulates the method of calculating revenue from the implementation of violations of the law on personal data protection.

Thus, from January 1, 2026, the maximum fine for administrative sanctions for violations in the field of personal data protection is 3 billion VND.

See the original here