Vietnam: Issued Ministry of Justice’s draft Cybersecurity Administrative Sanctions Decree

On 2 May 2024, the Ministry of Justice issued the draft Decree on Cybersecurity Administrative Sanctions. The decree introduces new administrative penalties for violations of cybersecurity regulations, including breaches of personal data. The objective of the decree is to deter improper data handling, unauthorised access, and other cybersecurity breaches by imposing financial penalties, suspension, or revocation of licences. The draft decree stipulates that fines of between VND 10’000’000 and 20’000’000 are imposed for offences such as the intentional dissemination of harmful computer programs, obstruction or disruption of telecommunications or network services, and unauthorised access to or damage to data or systems. The penalties for the creation or distribution of programs, services, or devices with the intention of attacking networks or stealing data, as well as for the unauthorised sale or promotion of telecommunications or internet services, have been increased to between VND 25’000’000 and VND 50’000’000. The penalties for the use of the internet for fraudulent activities, including financial scams and the unauthorised collection or dissemination of sensitive personal data, have been increased to between VND 50’000’000 and VND 70’000’000. Penalties of up to VND 100’000’000 are imposed for the establishment of systems such as peer-to-peer lending platforms, cryptocurrencies, or foreign exchange without the requisite authorisation. Additionally, fines of up to VND 70’000’000 are applicable for impersonating law enforcement for the purpose of theft. The number of affected citizens determines the fines, with the maximum being 5% of the violator's previous fiscal year's revenue for incidents that impact over 5 million Vietnamese citizens.