Vietnam's Decree No. 330: What Businesses Need to Know

Decree 330 sets out specific violations, applicable penalties and remedial measures for non-compliance with cybersecurity and personal data protection requirements.

Depending on the nature and seriousness of the violation, the applicable sanctions may include:

• Warning or monetary fines as the main forms of penalties
• Additional sanctions, where applicable, such as: 
  • Revocation of licences or certificates
  • Suspension of activities 
  • Confiscation of violating exhibits or means
  • Deportation of foreign individuals committing violations
• Remedial measures which may include:
  • Restoring the original condition of an information system
  • Requiring the implementation of technical measures to ensure cybersecurity
  • Requiring the recovery or return of unlawfully obtained information or data
  • Requiring the surrender of unlawful gains
  • Other measures required to remedy the consequences of violations

Decree 330 covers a broad range of personal data protection requirements. The following areas may be relevant to businesses:

Personal Data Processing Impact Assessment (“PDIA”) and Personal Data Transfer Impact Assessment (“PDTIA”)

Non-compliance with requirements relating to the preparation, submission, maintenance and updating of the PDIA dossier may result in sanctions. More serious cases may attract fines of up to VND 100 million.

For cross-border transfers, failure to comply with applicable requirements may also result in sanctions and remedial measures, including requirements to prepare and submit the PDTIA dossier, cease the relevant transfer, or require the recipient to delete or destroy the transferred data in a non-recoverable manner.

Data Subjects' Consent

Businesses may face fines ranging from VND 30 million to VND 50 million for consent-related violations. In certain cases, businesses may face fines of up to VND 70 million.

Personal Data Protection Principles and Prohibited Acts

Decree 330 provides penalties for various violations relating to the processing of personal data. Breaches of personal data protection principles and prohibited acts may be subject to fines of up to VND 60 million, together with applicable additional sanctions and remedial measures.

Data Subjects' Rights

Certain failures in exercising data subjects' rights may attract fines of up to VND 40 million. Businesses may also be required to take measures to ensure that data subjects' rights are fully exercised and to provide supporting evidence to the competent authority.

Personal data protection personnel 

Depending on the nature of the non-compliance, fines may range from VND 10 million to VND 30 million, together with applicable remedial measures.

Sector-Specific Requirements

Specific requirements and corresponding sanctions also apply to personal data protection in the following sectors and processing activities:

• Recruitment and the management of labour
• Insurance and health-related information
• Advertising services
• Financial, banking and credit information activities
• Social media and online communication services
• Big data processing
• Artificial intelligence and metaverse systems
• Blockchain technology
• Cloud computing
• Personal location and biometric data
• Audio and video recording in public places

The introduction of specific administrative penalties shows that having policies and measures in place is not sufficient to ensure compliance with personal data protection requirements. The framework now places greater emphasis on ensuring that personal data protection requirements are effectively implemented and reflected in business practices.

This requires appropriate governance, clear responsibilities, effective procedures, employee awareness, technical and organisational measures, and adequate records.

In light of the enforcement framework introduced by Decree 330, businesses should consider reviewing their existing personal data protection framework to identify compliance gaps, address areas requiring further attention, and prevent and address potential violations in practice.

Key actions to consider include:

Assessment and Priority

A review of current personal data protection policies, procedures and contractual arrangements against applicable requirements can help assess the adequacy of the existing compliance and identify areas requiring further attention. Particular attention should be given to higher-risk processing activities, including the processing of sensitive personal data, large-scale processing, cross-border transfers and other activities that may present greater compliance risks.

Remediation

Identified areas requiring attention can then be addressed through appropriate updates to policies, privacy notices, contracts, consent mechanisms, impact assessments, internal procedures, and relevant technical and organisational measures, including appropriate access controls, data security measures and encryption where applicable. Relevant records and supporting documents should also be properly maintained to demonstrate compliance.

Implementation

Personal data protection requirements should be incorporated into day-to-day business processes rather than treated as a separate compliance exercise. This includes appropriate training and awareness-raising for employees, as well as consistent application of requirements across the organisation and its relevant third parties.

Monitoring and Updating

Regular reviews of compliance status can help ensure that policies, procedures, technical and organisational measures and other arrangements remain up to date to reflect changes in applicable laws and regulations, business activities or personal data processing practices.

Keeping pace with evolving personal data protection requirements can be challenging, particularly as the regulatory framework continues to develop and places greater demands on businesses to ensure compliance in practice.

Vistra supports businesses in Vietnam with personal data protection advisory and compliance services, helping them address specific compliance needs.

Our specialists can assist with:

• Submission of PDIA and/or PDTIA dossiers
• Preparation of Personal Data Protection Documentation
• Review of Pesonal Data Protection Agreement

By combining local expertise with regional capabilities, we support businesses in addressing their personal data protection requirements and responding to evolving regulatory developments.