Trading personal data faces tenfold fines under Vietnam’s new privacy law

The penalty framework was presented at a policy forum in Hanoi on Wednesday, where security and legal experts discussed the implementation of the Law on Personal Data Protection, which takes effect at the start of 2026.

Lieutenant Colonel Nguyen Dinh Do Thi, deputy head of the Planning Division at the Department of Cybersecurity and High-Tech Crime Prevention under the Ministry of Public Security, emphasized that the new law serves as a ‘foundational statute,’ unifying definitions and principles related to personal data protection.

It also further institutionalizes constitutional provisions on privacy, human rights, civil rights, and cybersecurity, helping ensure consistency across Vietnam’s legal system.

As per the new rules, administrative fines for buying or selling personal data can reach ten times the amount of money gained from the violation.

The law also sets a maximum administrative fine of VND3 billion (US$114,000) for serious violations of personal data protection regulations.

Thi said these measures are designed to ensure organizations and individuals take responsibility for safeguarding user data in the rapidly expanding digital economy.

Speaking at the event, Colonel Nguyen Hong Quan, deputy head of the Department of Cybersecurity and High-Tech Crime Prevention, said the right to personal data protection has evolved from being a component of privacy into an independent right recognized and protected by law.

Quan added that roughly 80 percent of the world’s population now lives in jurisdictions with personal data protection regulations, and Vietnam is aligning itself with this global trend.

“The issuance of Government Decree 13 [on personal data protection] and now the Law on Personal Data Protection, effective January 1, 2026, demonstrates the state’s strong commitment to building a safe digital environment and protecting human rights in cyberspace,” Quan said.

However, experts also pointed to challenges in enforcement and public awareness.

Nguyen Quang Dong, head of the Institute for Policy Studies and Media Development, said there remains a significant gap between legal protections and actual user behavior.

Many users accept terms of service quickly without reading or understanding how their personal data may be collected or used.

Dong added that some digital platforms design data collection mechanisms that favor service providers by default, making it easy for users to consent without meaningful choice.

This, he said, increases the risk of privacy violations in a society that is open to technology but often too casual about sharing personal information.

To ensure effective implementation of the law, Ngo Tuan Anh, deputy head of the National Cybersecurity Association’s data security division, proposed three key pillars.

These include raising awareness and capacity among personnel at all levels, standardizing data protection practices throughout the data lifecycle within organizations, and developing a comprehensive ecosystem of data protection technologies suited to Vietnam’s conditions.