Vietnam: Decree No. 24/2025/ND-CP specifying fines for non-compliance with data protection regulations entered into force

On 21 February 2025, Decree No. 24/2025/ND-CP specifying fines for non-compliance with data protection regulations entered into force. Businesses that fail to obtain consumer consent, define responsibilities when outsourcing data processing, or establish and disclose data protection policies may face fines of VND 20-30 million. More serious violations, such as failing to address consumer complaints, failing to report security breaches, or unauthorised data sharing, carry fines of VND 30-40 million. These fines are doubled for violations involving sensitive personal data and quadrupled for large digital platforms.