Vietnam’s Decree 330: New Enforcement Risks and Compliance Priorities for Businesses

Vietnam’s government issued Decree No. 330/2026/ND-CP on 19 August 2026, with immediate effect. The decree establishes administrative penalties for cybersecurity and personal data protection violations, giving authorities specific tools to enforce obligations across business operations.

For foreign investors, enforcement can affect the data that supports customer services, workforce administration, and regional operations. Businesses need to demonstrate that their controls work in practice and understand how compliance failures could interrupt essential services.

Also see: Vietnam’s Cybersecurity and Data Protection Rules: A Compliance Roadmap for Businesses

What Decree 330 changes

The Personal Data Protection Law No. 91/2025/QH15 and Decree 356/2025/ND-CP already establish substantive duties. Decree 330 specifies penalties and remedies for breaches. Businesses should check when each underlying obligation took effect.

The penalty structure combines fixed fines, penalties linked to proceeds from unlawful data trading, and penalties linked to revenue for specified overseas transfer violations. Organisations can face up to ten times the proceeds from unlawful data trading. The statutory ceiling for other personal data protection violations reaches VND 3 billion, although individual offences carry their own ranges.

Article 56 allows fines up to 5 percent of the organisation’s revenue in the Vietnamese market during the preceding financial year. That maximum concerns specified serious transfer violations, including qualifying incidents involving at least one million Vietnamese citizens. It does not apply automatically to every missing assessment. The article also provides alternative fixed penalties in defined circumstances.

The distinction between individual and organisational fines also matters. The personal data protection section states organisational amounts, while the cybersecurity sections generally state individual amounts and double them for organisations. Companies should check the relevant provision before using a published penalty figure in their risk calculations or reporting to headquarters.

Authorities can also order deletion of unlawfully handled data or cessation of processing and transfers.

Article 81 generally applies the sanctioning rules in force when earlier conduct occurred. Decree 330 applies where it removes liability or provides lighter liability. Companies should distinguish completed conduct from continuing failures. An old start date alone does not establish that a breach ended before the decree took effect.

Which businesses and activities face exposure?

Article 2 covers Vietnamese and foreign organisations. Its scope includes relevant foreign service providers and overseas organisations involved in processing personal data of Vietnamese citizens and certain other protected individuals. An overseas incorporation or absence of a Vietnamese office does not automatically exclude an organisation.

Exposure can arise through recruitment, payroll, customer management, digital marketing, and outsourced IT. These obligations can therefore affect manufacturers and retailers as well as technology businesses.

Regional HR platforms, overseas cloud storage, and information sharing with headquarters can involve several group entities. Their responsibilities depend on who determines processing purposes, handles the data, and receives it. A global privacy policy does not establish whether each entity has met its applicable Vietnamese obligations.

Service providers face an additional question: whether their activities trigger specific business conditions. Companies offering personal data processing services should assess applicable certification and staffing requirements separately from their obligations as ordinary employers or customers.

Priority areas for scrutiny and compliance review

The following areas warrant review because the decree specifies related violations. They do not represent confirmed inspection priorities.

Consent mechanisms warrant close review. Government guidance on Decree 330 highlights default consent, unclear choices, and failures to preserve consent records. Where consent supplies the legal basis, businesses need a clear record of the person’s decision and its scope. Marketing teams should examine whether customers can choose separately between service communications and unrelated promotional uses.

Data lifecycle risks extend from collection to deletion. Collecting unnecessary information, changing its purpose without a lawful basis, or retaining it beyond applicable limits can create exposure. HR teams should limit applicant information to recruitment needs and distinguish mandatory employment records from information that no longer serves a legitimate purpose.

Articles 55 and 56 address processing and overseas transfer impact assessments. Businesses should check that dossiers exist, accurately describe processing activities, and reflect changes that require updates. A procurement decision to replace a cloud provider may change recipients or storage arrangements and require the business to revisit its assessment.

Personnel requirements also deserve attention. Article 57 addresses formal appointments, responsibilities, confidentiality, training, and qualifications. Naming a regional privacy contact does not by itself establish compliance with the applicable Vietnamese requirements.

For example, the decree provides organisational fines of VND 20 million to VND 30 million for specified appointment failures. These include appointing personnel without the prescribed education or relevant experience. Businesses should verify eligibility when selecting the responsible person, especially where a small local team relies heavily on regional support.

Article 61 also addresses employee monitoring without adequate notice. Facilities teams should assess CCTV deployment together with HR and legal colleagues.

Cybersecurity exposure also concerns applicable system safeguards, incident handling, and cooperation with competent authorities. IT teams should assess the requirements for each system they operate.

How enforcement can disrupt multinational operations

Article 8 recognises electronic evidence and allows competent officials to request information supporting an investigation. System logs, digital records, and communications can therefore influence the assessment of a violation.

Inspections may require input from headquarters and external vendors. Inconsistent submissions can complicate the authority’s assessment and delay resolution.

A transfer restriction can affect several functions that share an overseas platform. Consider a Vietnamese subsidiary that sends employee information to a regional HR centre. If an authority orders the relevant transfer to stop, the subsidiary may lose its usual route for payroll administration and employee support. A lawful contingency arrangement could reduce disruption, but it must respect the order’s scope.

Business continuity planning should identify which services share the affected data flow. Separating essential functions from optional analytics can help management assess the scope of disruption and available alternatives. The company should also check customer commitments before promising uninterrupted service during remediation.

Immediate compliance priorities for businesses

Businesses should begin with a practical inventory of collection points, processing purposes, systems, recipients, and overseas destinations. Assign an operational owner to each activity. Include spreadsheets, messaging tools, and local databases that may sit outside central IT oversight.

Next, establish which obligations apply to each activity. Check filing deadlines, personnel requirements, and any relevant exemptions or transitional arrangements. Articles 55 and 56 address submission within 60 days from the first processing or transfer, respectively, where the assessment obligation applies. This period does not restart simply because management discovers an omission.

Use the inventory to compare actual practice with assessment dossiers, notices, consent records, retention schedules, and appointment documents. Record each gap, its legal significance, the responsible person, and a completion date. Give immediate attention to unlawful processing and failures that threaten essential operations.

Test procedures through sample requests for access, withdrawal, and deletion. Trace a request through internal teams and external processors to identify delays. Run an incident exercise that tests escalation and regulatory notification decisions under the applicable deadlines.

Review vendor and group agreements for processing roles, security obligations, onward transfers, incident notification, and deletion. Confirm that contractual commitments match technical capabilities. An agreement to delete information has limited practical value if the supplier cannot identify all relevant copies.

Finally, designate a regulatory contact and a substitute to coordinate submissions, track requests, and monitor remedial deadlines. Maintain an accessible repository of submission receipts, approval records, and evidence of corrective work. Internal remediation schedules do not extend legal deadlines.

Longer-term governance and investor considerations

Senior management should assign an accountable executive with authority to resolve competing priorities across legal, IT, HR, procurement, and business teams. Budgets should cover necessary system changes and specialist support, with clear escalation for overdue corrective work.

Embed privacy and cybersecurity checks into product development, vendor selection, and system changes. Approval processes should identify legal dependencies before commercial commitments make redesign expensive. Periodic testing should examine whether controls still work after changes in personnel or technology. Tailor training to the decisions each function makes.

During acquisition due diligence, investors should assess whether they can lawfully use customer and employee data for their intended purposes. Missing permissions or deficient transfer arrangements may increase integration costs or limit the buyer’s intended use of information. Transaction planning should allocate remediation responsibilities and address material issues before connecting systems.

Management reports should show how long compliance gaps have remained open and how serious they are. Repeated exceptions can reveal resource constraints or flawed processes. Boards can then direct investment towards the controls most relevant to future growth.

For foreign investors, effective data governance can make expansion more predictable by bringing compliance costs and operational constraints into investment decisions before the business commits capital.