Vietnam’s New Data Rules Take Effect, With Fines of Up to VND 200 Million for Organizations

Vietnam’s Decree No. 363/2026/NĐ-CP took effect on November 11, 2026. It sets out administrative violations and penalties for activities involving the collection, creation, storage, management, exploitation, use and protection of data. The maximum fine for an individual who violates the rules is VND 100 million; organizations face twice the fine applicable to individuals, up to VND 200 million.

Article 17 of the decree provides for a warning if open data is not disclosed as required, or if disclosed data cannot be accessed or used in accordance with technical standards. Disclosing data that does not match the original data, or data that the law prohibits from being disclosed, carries a fine of VND 20 million to VND 40 million.

Using data disclosure to spread false information or distort data, deliberately disclosing false data to obstruct others’ activities, or failing to assess the impact on national defense and security, the macroeconomy, social stability and public health, among other areas, before disclosure carries a fine of VND 40 million to VND 80 million. Related violations may also result in a suspension of data disclosure activities for one to six months. Depending on the circumstances, violators must remove or withdraw unlawfully disclosed content, supplement or correct data, and surrender any unlawful gains.

The decree applies to Vietnamese and foreign agencies, organizations and individuals in Vietnam, as well as foreign entities directly participating in or involved in data activities in Vietnam. Businesses and economic organizations are subject to penalties; household businesses, households and residential communities face the same fine levels as individuals. The decree addresses administrative violations in the data sector and does not replace penalty provisions for cybersecurity and personal data protection.

Source: VietVance