The Ministry of Public Security is seeking public feedback on a draft Law on Data Security that proposes maximum fines of up to 5% of total revenue in the preceding financial year for serious violations involving the protection of important and core data. For multinational corporations, the fine could be calculated based on global revenue, but would not exceed 5%.

The proposal is included in the draft Law on Data Security, which is open for public consultation until August 5 and is expected to be submitted to the National Assembly at its October session.

Earlier, on June 26, 2025, the National Assembly passed the Law on Personal Data Protection, which took effect on January 1, 2026. Organizations and individuals that violate the law or other relevant regulations on personal data protection may, depending on the nature, severity and consequences of the violation, face administrative penalties or criminal prosecution. Those causing damage must also pay compensation in accordance with the law.

The maximum administrative fine for the purchase or sale of personal data is 10 times the proceeds obtained from the violation. If no proceeds were generated from the violation, or if the fine calculated on the basis of those proceeds is lower than the maximum fine stipulated in Clause 5, Article 8, the fine prescribed under Clause 5, Article 8 of the law will apply.

For organizations violating regulations on cross-border transfers of personal data, the maximum administrative fine is 5% of the organization’s revenue in the immediately preceding year. If the organization had no revenue in the preceding year, or if the revenue-based fine is lower than the maximum stipulated under Clause 5, Article 8, the fine prescribed under Clause 5, Article 8 of the law will apply. The maximum administrative fine for other violations in the field of personal data protection is VND3 billion.

Thai Khang