Vietnam: Ministry of Public Security opened consultation on draft decree providing for administrative sanctions in the fields of cybersecurity and personal data protection

On 16 March 2026, the Ministry of Public Security opened a consultation on the draft decree providing for administrative sanctions in the fields of cybersecurity and personal data protection, until 26 March 2026. The draft decree establishes administrative violations, sanctions, and remedial measures applicable to Vietnamese and foreign organisations. The Law on Government Organisation 2025, the Law on Organisation of Local Government of 16 June 2025, and the Law on Handling of Administrative Violations of 20 June 2012 as amended and supplemented in 2025 provide the procedural and institutional framework for the decree, including the statute of limitations, forms of sanction, remedial measures, and sanctioning authority. Under the Law on Cybersecurity of 10 December 2025, primary sanctions take the form of monetary fines, with a maximum of VND 100 million for individuals and VND 200 million for organisations. Articles 7 to 11 and Articles 32, 33, and 35 sanction providing, sharing, or failing to remove unlawful information in cyberspace within 24 hours of a request from the specialised cybersecurity protection force under the Ministry of Public Security. Article 36 sanctions failure to store data domestically or establish a branch or representative office in Vietnam as required under Decree No. 53/2022/NĐ-CP detailing certain articles of the Law on Cybersecurity. Articles 32 and 37 sanction failure to verify digital account holders, including the use of artificial intelligence (AI), deepfake technology, or other high-tech means to spoof biometric data. Under the Law on Personal Data Protection of 26 June 2025, fines reach VND 1.5 billion for individuals and VND 3 billion for organisations for violations including unlawful personal data processing, failure to uphold data subject rights, and failure to prepare a personal data processing impact assessment dossier. Revenue-based fines of up to five percent of total revenue for the immediately preceding financial year in Vietnam apply to violations involving the cross-border transfer or leakage of personal data of 5 million or more Vietnamese citizens. Article 65(1)(d) sanctions collecting, processing, or using data to develop, train, test, or operate artificial intelligence systems in contravention of the law on data and personal data protection. Under the Law on Telecommunications of 24 November 2023 and the Law on Information Technology of 29 June 2006, Articles 38, 39, 48, and 53 sanction unlicensed operation of cybersecurity services, social networks, and electronic game services. Under the Law on Artificial Intelligence 2025, Article 14(1)(p) sanctions the use of AI to copy the style or content of original works to create derivative products without the agreement of the original author. Chapter III allocates sanctioning authority to the Department of Cybersecurity and High-Tech Crime Prevention, provincial-level Public Security Departments, People's Committees at all levels, the Border Defence Force, the Vietnam Coast Guard, and Government Cipher Committee Inspectorates. Supplementary sanctions include licence suspension, operational suspension, confiscation of exhibits and means, and expulsion of foreign individuals.