Organizations that publicly disclose personal data without the consent of the data subject can be fined up to VND50 million (about US$1,900), while individuals committing the same violation face fines of up to VND25 million (US$950).

For years, a common sight on social media platforms such as Facebook and TikTok has been people casually posting “call-outs” to publicly expose or shame others online.

In many cases, these posts have included the personal information of the people being targeted, such as their photos, full names and images of their national ID cards.

However, such behavior can now result in substantial penalties following the August 19 entry into force of Decree No. 330/2026/ND-CP, which sets out administrative penalties for violations in the fields of cybersecurity and personal data protection.

Article 50, which covers violations involving the public disclosure of personal data, stipulates fines of VND30-50 million (US$1,140-1,900) for either of the following acts: publicly disclosing personal data in a way that infringes upon the lawful rights and interests of the data subject; or publicly disclosing personal data without the data subject’s consent, except where permitted by law.

Under the decree, the maximum VND50 million fine applies to organizations and businesses. Individuals committing the same violation are subject to half the corresponding fine, meaning they can face penalties of up to VND25 million (US$950).

In addition to financial penalties, offending organizations or individuals will be required to remove or withdraw the personal data they have publicly disclosed.

Organizations and businesses can also face fines of VND20-30 million (US$760-1,140) for publicly disclosing personal data without a specific purpose or outside circumstances permitted by law; disclosing data beyond the scope or categories necessary for the stated purpose; publishing personal data that does not accurately reflect the original source; failing to properly control and monitor disclosure to ensure compliance with its intended purpose, scope and legal requirements; or failing to take measures to prevent unauthorized access, use, disclosure, copying, alteration, deletion, destruction or other unlawful processing of publicly disclosed data.

In other words, casually posting another person’s personal information on social media without their permission is prohibited and can result in serious penalties for users who violate these rules.

Le My