ietnam Decree No. 330/2026/ND-CP establishes an administrative-sanctions framework for cybersecurity and personal data protection and became effective on August 19, 2026. The official Government publication dated August 24 confirms that the Decree contains 4 chapters and 82 articles. Primary sanctions include warnings and monetary fines, while additional measures may include suspension of certain licences, professional certificates or activities for periods of 1 to 24 months, confiscation and remedial measures.

The Government highlights personal-data consent violations carrying fines of VND 30-50 million for specified invalid or non-transparent consent practices, including failures to obtain or evidence valid consent in covered situations, and VND 50-70 million for continuing processing after a valid stop/restriction request or treating silence as consent.

Corrective measures can include irreversible deletion of personal data processed in violation of the rules. Organizations operating in Vietnam should urgently map the new penalty provisions to consent, data-subject rights, cybersecurity controls and enforcement-response procedures.

Impact

Impact assessment: High. The Decree is final and already effective, creating a detailed administrative-enforcement framework across cybersecurity and personal data protection. Key reasons: monetary fines, licence/activity suspension, confiscation and mandatory remedial measures can now be applied to defined violations, including consent and stop/restriction failures.

Who is affected?

Organizations and individuals subject to Vietnamese cybersecurity or personal-data duties, including controllers, processors, digital-service providers and regulated enterprises.

Conclusion:

compliance controls, evidence and incident/rights-response procedures should be reviewed immediately against Decree 330/2026/ND-CP.