Vietnam Sets Consent Fines Up to VND 70 Million, With Larger Penalties for Data Violations

Silence cannot count as permission to use personal data

Vietnam's Decree No. 330/2026/ND-CP, effective from August 19, 2026, sets fines of VND 50 million to VND 70 million for treating a person's silence as consent to collect or process personal data. The same bracket applies to deliberately continuing processing after the person requests a stop or restriction, or after a competent authority orders it in writing.

The consent rules are part of a much wider sanctions framework. Certain violations involving transfers of personal data abroad can attract penalties of up to 5% of revenue from the preceding year. Other personal data violations can carry fines reaching VND 3 billion, while unlawful data trading can trigger penalties calculated as multiples of the transaction value.

The Government's published decree details, dated August 26, describe a framework containing four chapters and 82 articles. It covers cybersecurity, social media, information systems and personal data protection, with warnings and fines as the main penalties.

For people using apps, shopping online or receiving advertising messages, the practical issue is control: businesses must have a lawful basis for using their information, explain relevant purposes and respect requests to stop. For businesses, the exposure extends beyond a fine to possible suspension, deletion of unlawfully processed data and repayment of unlawful gains.

What makes consent valid?

Article 43(1) sets fines of VND 30 million to VND 50 million for a range of consent failures. These include processing personal data without consent where the law requires it, setting agreement as the default and presenting unclear instructions that confuse the choice between accepting and refusing.

A business must obtain consent in a clear, specific and verifiable way. It needs to be able to show who agreed, when they agreed and what they accepted. Users must also be able to choose separately for each processing purpose.

A shopping service, for example, may need information to fulfil an order. The decree addresses making access to that service conditional on accepting unrelated uses of personal data. A person should have a separate choice about those additional purposes rather than having to accept them to receive the agreed service.

Article 43 also covers incomplete explanations about the types of data being processed, the purposes, the person's rights and obligations, and the organisation controlling the processing. Missing consent records can attract penalties too. A business therefore needs both a valid permission process and evidence that the process worked.

Sensitive personal data receives additional protection. Failing to notify someone that their sensitive data is being processed falls within the VND 30 million to VND 50 million bracket. Businesses need to identify what information they hold and apply the relevant safeguards.

Why VND 70 million is only part of the picture

The highest consent fine is VND 20 million above the top of the lower consent bracket, rising from VND 50 million to VND 70 million. The higher bracket targets two specific practices: assuming agreement from silence and deliberately ignoring a request to stop or restrict processing.

Across the wider framework, cybersecurity fine ceilings are VND 200 million for organisations and VND 100 million for individuals. Personal data protection has a different structure, including fixed monetary brackets, penalties linked to unlawful trading and penalties linked to revenue.

EY's October legal alert describes fines of two to ten times the transaction value for illegal personal data trading. It says that value is calculated from evidence such as contracts, invoices, payment records, messages and bank statements, without subtracting costs.

Certain serious violations involving transfers abroad attract fines of 1% to 5% of revenue. EY identifies transfers causing the loss or leakage of data belonging to at least 10,000 Vietnamese citizens within this category, and lists the maximum 5% tier for cases affecting at least one million. Its table describes the maximum as a share of revenue earned in Vietnam during the preceding year, with a VND 3 billion ceiling where there was no revenue in that year.

Foreign businesses also fall within the rules

Decree 330 applies to Vietnamese and foreign individuals and organisations. Its reach includes qualifying foreign enterprises providing telecommunications, internet, online content, information technology, cybersecurity or services across borders, as well as foreign organisations involved in processing covered Vietnamese personal data.

The protected groups include Vietnamese citizens and people of Vietnamese origin residing in Vietnam who have identity certificates but whose nationality has not yet been determined. Overseas location therefore remains an issue that businesses must assess alongside the services they provide and the people whose information they handle.

Tilleke & Gibbins, in its sanctions decree analysis, identifies the Ministry of Public Security as the authority responsible for personal data protection and cybersecurity. It describes the decree as backing obligations under the personal data protection and cybersecurity laws with a detailed administrative sanctions framework.

For a company operating outside Vietnam, the practical work includes checking whether its services and processing activities fall within that scope. Advertising systems, customer databases and transfers to overseas service providers may all require examination under the relevant provisions.

Advertising lists need a lawful foundation

Article 37 addresses unsolicited advertising emails and messages and other violations of online advertising rules. Article 48 may also become relevant when the information used for advertising was collected unlawfully. The advertising activity and the collection of the underlying data therefore create separate compliance issues.

A business buying a list of telephone numbers needs to check where the data came from, the legal basis for using it and the purpose for which it was collected. It must also provide a way for people to refuse advertising or the relevant sharing of their information.

Article 43 brings the consent rules into that process. A recipient who does not answer a permission request has not agreed. A business that deliberately continues processing after a stop or restriction request faces the higher VND 50 million to VND 70 million bracket.

EY also identifies a specific sanction involving default consent to disclose personal data to an affiliate advertising network. Such networks connect businesses with partners that promote products or direct potential customers to them. Sharing information through those arrangements requires attention to the person's choice, rather than an agreement selected in advance.

For consumers, these provisions connect the first collection of a telephone number with its later use. For companies, checking a marketing message is only one part of the task: the origin of the contact list, the permissions attached to it and the handling of refusals all matter.

Children and surveillance data require closer checks

Platforms, education services, entertainment apps and online retailers handling children's information face requirements involving the purpose of processing, valid consent, the amount of data collected and protective measures. EY identifies penalties for failing to verify a child's age before processing personal data.

EY also flags a difference in wording between the personal data protection law and the decree. The law requires consent from both a child aged seven or above and the child's legal representative when processing is intended to disclose the child's private life or personal secrets. The decree's sanction provision concerning consent from both is worded more broadly, according to EY's analysis.

Businesses serving children therefore need to examine how their age checks and consent procedures fit the activity involved. EY lists an organisational maximum of VND 200 million for certain failures to delete or destroy children's data that has been processed beyond its purpose.

Public surveillance recordings create another specific risk. EY identifies sanctions for using personal data, images or voice recordings from public surveillance cameras for commercial purposes, behavioural analysis or automated facial recognition to build profiles without valid consent.

A camera installed for security can generate information that a business later wants to use for another purpose. Under the provisions described by EY, that later commercial or analytical use requires its own legal assessment and valid consent where specified. Retention periods also matter: certain agreements for transferring data must state a storage period appropriate to the transfer's purpose.

AI and social media bring responsibilities for users and operators

Using artificial intelligence to impersonate another person's image, voice or identity can attract sanctions when the conduct involves fraud, false information, infringement of lawful rights or unlawful collection and use of personal data. The applicable penalty depends on the conduct and its severity.

Businesses remain responsible for their decisions to collect information, feed it into an AI system and use the resulting output. Automated processing therefore needs to sit within the same checks on legal basis, purpose, consent and protection that apply to other processing activities.

Social media obligations extend to providers, managers, operators and users. People posting or sharing content are responsible for it, including where the material involves impersonation, fraud or infringement of another person's lawful rights and interests.

The cybersecurity provisions also address attacks, unauthorised access, harmful code and failures to cooperate with specialised cybersecurity forces. Where a case shows signs of a criminal offence, the Government's published explanation says the file is to be transferred under the relevant provisions of the Law on Handling of Administrative Violations.

Fines can be followed by deletion or suspension

Depending on the particular violation, supplementary penalties include loss of the right to use specified licences or certificates for one to 24 months, suspension of operations for the same period, confiscation of equipment or other items used in the violation, and deportation of foreign nationals.

Article 43 links particular consent violations to irreversible deletion of unlawfully collected or processed data. It also provides for confiscation in specified cases and repayment of unlawful gains for the violations in its higher fine bracket. A business may consequently lose access to the information as well as face a monetary penalty.

Repayment of unlawful gains is a remedial measure with its own calculation. EY explains that, in applicable cases outside illegal data trading, it can cover revenue generated by business activities using unlawfully collected, processed, used or transferred data, without deducting costs.

Tilleke & Gibbins lists other penalties affecting everyday compliance: up to VND 80 million for breach notification violations, VND 100 million for violations involving data processing impact assessments, and VND 30 million for failures concerning appointment of a data protection officer or department.

An impact assessment is a documented examination of how processing may affect people's data and how risks will be managed. Remedies can include mandatory submission of the assessment and suspension of processing until filing requirements are met. Similar measures can apply to required assessments for transfers abroad. EY also lists organisational penalties of up to VND 40 million for missing statutory deadlines for a person's data rights request.

When the rules apply and how cases can proceed

Decree 330 took effect on the day it was issued, without a transition period. Its arrival followed several years of development in Vietnam's personal data protection framework:

• July 1, 2023: Decree No. 13/2023/ND-CP on personal data protection took effect.
• January 1, 2026: The Law on Personal Data Protection took effect, with implementation requirements under Decree No. 356/2025/ND-CP.
• August 19, 2026: Decree No. 330/2026/ND-CP was issued and became effective.
• August 26, 2026: The Government published its explanation of the decree and consent penalties.

The limitation period for administrative sanctions is one year. For a completed violation, the starting point is tied to fulfilment of the obligation or confirmation by a competent authority that the violation ended. Authorities must also determine whether conduct has finished or is continuing.

Tilleke & Gibbins describes a transitional rule for violations committed before August 19 but discovered, or still under review, afterward. The sanctions regime in force when the violation occurred generally applies. More favourable provisions in Decree 330 can apply where they remove liability or impose a lighter penalty.

The framework recognises electronic evidence and permits electronic violation records and sanction decisions, including biometric authentication where digital signatures are unavailable. That makes the records behind compliance, such as consent logs, request histories and transaction records, especially relevant to how a case can be examined.

No timetable for specific inspections or enforcement cases is stated. The immediate practical change is that existing duties now have a dedicated sanctions framework covering documentation, staffing, security, consent and the actual use of personal information.

Key Points

• Decree 330 took effect on August 19, 2026, covering cybersecurity and personal data protection.
• Specified consent failures carry fines of VND 30 million to VND 50 million.
• Treating silence as consent or deliberately ignoring stop requests can attract VND 50 million to VND 70 million fines.
• Certain serious transfers abroad can attract revenue based penalties reaching 5%.
• Qualifying foreign organisations are covered, alongside Vietnamese businesses and individuals.
• Additional consequences can include suspension, irreversible data deletion and repayment of unlawful gains.