New rules dealing with violations of personal data protection regulations
15 September, 2026
Following the introduction of Vietnam’s personal data protection framework (please refer to our previous NewsBrief on the Law on Personal Data Protection and Decree 356), the Government has issued Decree No. 330/2026/NĐ-CP on administrative sanctions in the fields of cybersecurity and personal data protection. The Decree took immediate effect on 19 August 2026.
Notably, for the first time, violations relating to personal data protection are regulated under a dedicated sector-specific sanctions regime. Decree 330 establishes a comprehensive legal basis for imposing administrative penalties on organisations and individuals that fail to comply with personal data protection requirements.
