In Vietnam, the participation of foreigners in economic and social activities is an inevitable reality. However, this also entails strict requirements for compliance with the law, particularly with respect to privacy rights and the protection of personal data. Against the backdrop of increasing abuse, leakage, and trading of personal data, the Personal Data Protection Law 2025 was promulgated. This law imposes binding responsibilities not only on domestic entities but also on foreign organizations and individuals in Vietnam, requiring strict compliance and prohibiting violations relating to personal data.
1. Acts Constituting Personal Data Violations
Under Article 7 of the Personal Data Protection Law 2025, the following acts are strictly prohibited:
- Processing personal data for the purpose of opposing the Socialist Republic of Vietnam, undermining national defense, national security, public order, social safety, or the lawful rights and interests of agencies, organizations, or individuals;
- Obstructing the protection of personal data;
- Abusing personal data protection activities to commit unlawful acts;
- Processing personal data in contravention of the law;
- Using the personal data of another person, or allowing another person to use one’s personal data, for unlawful purposes;
- Buying or selling personal data, unless otherwise provided by law;
- Appropriating, intentionally disclosing, or unlawfully destroying personal data.
2. Applicable Subjects
According to Clause 2, Article 1, liability for violations extends to:
- Foreign agencies, organizations, and individuals in Vietnam;
- Foreign agencies, organizations, and individuals directly participating in, or otherwise involved with, the processing of personal data of Vietnamese citizens and stateless persons of Vietnamese origin residing in Vietnam who have been issued an identity certificate.
3. Sanctions for Violations
Article 8 provides that any individual or organization committing acts in violation of regulations on personal data protection, or other relevant provisions of law, may, depending on the nature, extent, and consequences of the violation, be subject to administrative sanctions or criminal prosecution, and if damages are caused, must provide compensation in accordance with civil law.
3.1 Administrative Sanctions
| Violation | Maximum Penalty |
|---|---|
| Organizations engaged in the purchase or sale of personal data | Up to 10 times the illicit gain from the violation |
| Organizations violating cross-border transfer requirements | Up to 5% of the previous year’s revenue |
| Other violations, including those with no illicit gain or where penalties based on gain/revenue are lower | Up to VND 3 billion |
| Individuals committing violations | 50% of the fine applicable to organizations |
Additional measures may include suspension of data processing activities, mandatory remediation, and public apology.
3.2 Criminal Liability
Depending on the act, offenders may also face criminal prosecution under the Penal Code:
| Article & Offense | Conduct | Sanctions |
|---|---|---|
| Article 159 – Infringement of secrecy or safety of correspondence, telephone, telegraph | Unlawful appropriation, damage, or theft of data | – Imprisonment: 1–3 years – Fine: VND 20–50 million – Supplementary penalty: prohibition from holding certain positions for 1–5 years |
| Article 288 – Illegal provision or use of information on computer or telecommunications networks | Illegal trading or dissemination of personal data online | – Imprisonment: 6 months–7 years – Fine: VND 30 million–1 billion – Supplementary penalty: prohibition from certain professions or positions for 1–5 years |
| Article 289 – Illegal access to computer or telecommunications networks | Theft, alteration, destruction, or falsification of data for illicit gain | – Imprisonment: 1–12 years – Fine: VND 50 million–1 billion – Supplementary penalty: prohibition from certain professions or positions for 1–5 years |
| Article 290 – Use of computer or telecommunications networks to appropriate property | Using personal data for fraud or misappropriation of assets | – Fine: VND 20–100 million – Imprisonment: 6 months–20 years – Supplementary penalty: prohibition from managing enterprises, practicing professions, or confiscation of part or all of assets |
3.3 Civil Liability for Compensation
Pursuant to the Civil Code 2015, foreign individuals or organizations must compensate for damages caused. Compensation may cover both material damages (financial losses, remediation costs) and non-material damages (harm to honor, reputation, dignity, etc.).
The Personal Data Protection Law 2025 affirms Vietnam’s strong commitment to safeguarding the privacy rights of its citizens. Foreign individuals and organizations are equally bound by its provisions and may face administrative, criminal, or civil liability for violations. This development reflects a significant step forward in establishing a safe, fair, and transparent digital environment in Vietnam for all.
📞 CONTACT LEGAL CONSULTANT:
TLA Law is a leading law firm with a team of highly experienced lawyers specializing in criminal, civil, corporate, marriage and family law, and more. We are committed to providing comprehensive legal support and answering all your legal questions. If you have any further questions, please do not hesitate to contact us.
1. Lawyer Vu Thi Phuong Thanh, Ha Noi Bar Association
Email: vtpthanh@tlalaw.vn
2. Lawyer Tran My Le, Ha Noi Bar Association
Email: tmle@tlalaw.vn
TTQ