Vietnam’s new data protection fines: what marketers must fix now

Vietnam’s data protection fines are now enforceable. Decree 330/2026/ND-CP, issued and effective on 19 August 2026, sets out the administrative penalties for breaking the Personal Data Protection Law (Law No. 91/2025/QH15), which took effect on 1 January 2026. For the first eight months of this year the law had rules but no detailed fine schedule. That gap is now closed.

If you collect emails, run pixels, keep a CRM or use overseas marketing tools on Vietnamese customers, this applies to you, including if your company is based outside Vietnam. The good news: most of what gets marketers fined is fixable in a week.

What Decree 330 actually changed

The Personal Data Protection Law already set the ceilings. According to Tilleke & Gibbins' analysis of the law, fines reach up to 5% of the previous year's revenue for unlawful cross-border transfers, up to ten times the proceeds for buying or selling personal data, and up to VND 3 billion for other violations. Decree 330 turns those ceilings into specific penalties for specific failures, enforced by the Ministry of Public Security.

One Asia Lawyers' summary of the decree lists the items marketers should read twice. Treating silence or inaction as consent can cost up to VND 70 million. Behavioural tracking without consent, cookie failures and missing opt-out mechanisms sit in the VND 50 to 70 million band. Reporting a breach later than 72 hours can cost VND 40 to 60 million. Those figures are for organisations; individuals are fined at half the rate.

APFL Partners also points out that the decree came into force the day it was issued, so there was no run-up period to prepare. Tilleke's note on the sanctions decree adds one small mercy: where an older rule is more lenient for a past violation, the lighter liability can apply.

Vietnam data protection fines: where marketers are exposed

Most small businesses will never file a transfer impact assessment, but almost all of them run marketing that touches personal data. Three areas carry the most risk in day-to-day marketing work.

• Consent and tracking. Pixels, retargeting audiences and analytics that load before a visitor says yes are the easiest violation for a regulator to spot, because anyone can see them in a browser.
• Overseas tools. Your email platform, CRM and ad accounts almost certainly store data outside Vietnam. That is a cross-border transfer, and it is the category with revenue-based fines.
• No paper trail. APFL's main advice is that documentation decides how risk plays out. If you cannot show when someone consented, you are in a weak position even if you did everything else right.

The small business grace period, and its limits

Vietnam Briefing and Tilleke both confirm that small enterprises and startups can postpone some heavier obligations, namely the impact assessments and the data protection officer requirement, for up to five years from 1 January 2026. Household businesses and micro-enterprises are exempt from some obligations altogether.

The grace period does not cover everything. It does not apply if you process sensitive personal data, provide data processing services, or handle data on a large number of people; Vietnam Briefing puts that threshold at 100,000 data subjects. It also never covered the basics: valid consent, a clear privacy notice, honouring opt-outs and reporting breaches still apply to everyone.

What to do this week

1. Open your site in a private browser window and check whether any pixel or analytics tag fires before you click accept. If it does, fix your consent banner first.
2. List every tool that holds customer data and note where it is hosted. That list is the start of your transfer assessment, even if you qualify to delay filing it.
3. Rewrite your privacy notice in plain language: what you collect, why, who gets it, how long you keep it, and how to ask for deletion.
4. Pick one person to own data requests and breach reports, and write down the 72-hour breach steps on a single page.

Related guides in this series

• Cookies, email and SMS in Vietnam: the consent rules for 2026
• Vietnam's 2026 advertising rules: an influencer and online ad checklist
• SEO + GEO action plan for small business owners

This article is general information for marketers, not legal advice. For decisions with real legal exposure, check with a Vietnam-qualified lawyer.

Published: September 2026 | Author: Minh Pham