Tiếng Việt
中文 (中国)
日本語
Vietnam is at the start of implementing stringent measures to regulate cybersecurity and data protection through its latest draft decree on sanctions for violations in these domains. Targeting a start date of June 1, 2024, the decree is set to introduce significant fines and penalties for non-compliance, marking a critical development in Vietnam’s legal framework governing cyberspace.
The Evolution of Vietnam’s Cybersecurity Legislation
In recent years, Vietnam has progressively built a comprehensive legal framework to manage activities in cyberspace, with a particular focus on personal data protection. Key milestones include:
- Law on Cybersecurity (2018): This foundational legislation set the stage for more detailed regulations.
- Decree No. 53/2022/ND-CP: Provided guidelines for the implementation of the Cybersecurity Law.
- Decree No. 13/2023/ND-CP: Marked the country’s first comprehensive legislation on personal data protection (PDPD).
Despite these advancements, enforcement mechanisms for non-compliance remained incomplete until the introduction of the latest draft decree.
Key Provisions of the Draft Sanction Decree
The latest draft decree, released by the Ministry of Justice for public feedback, aims to fill this enforcement gap. Here are the key aspects:
- Effective Date: Proposed for June 1, 2024, with no grace period, although the date may change based on further revisions.
- No New Obligations: The decree does not introduce new obligations but specifies the administrative sanctions for violations starting June 1, 2024, as outlined in Article 49. This readiness signals the intent to enforce existing laws, including the 2015 Law on Network Information Security, the 2018 Law on Cybersecurity, and the PDPD.
- Severe Penalties for Data Protection Violations:
- Maximum monetary fines remain at VND 1 billion (approx. US$39,285).
- Severe violations could incur penalties up to 5 percent of the violating enterprise’s turnover in the previous fiscal year in Vietnam.
Specific Violations and Corresponding Penalties
The draft decree outlines penalties for various breaches, particularly those involving personal data. Notable violations include:
- Repeated breaches in marketing and advertising.
- Illegal activities related to personal data: Including collection, transfer, purchase, and sale.
- Disclosure or misplacement of personal data affecting 5 million or more Vietnamese citizens.
Penalties scale with the number of affected citizens:
- Over five million citizens: Fines up to 5 percent of total revenue.
- One to five million citizens: Fines up to VND 500,000,000.
- 100,000 to one million citizens: Fines up to VND 200,000,000.
For organizations, these fines can double, potentially reaching up to 10 percent of total revenue. Cross-border violations affecting over 5 million Vietnamese citizens may attract fines ranging from 3 percent to 5 percent of the enterprise’s previous fiscal year turnover in Vietnam.
Additional Sanctions
The draft decree also includes additional penalties, such as:
- Revocation of licenses.
- Confiscation of means used for violations.
- Remedial measures: Including suspension from processing personal data, destruction or unrecoverable deletion of personal data, and return of illegal profits.
Transitional and Interpretative Provisions
Retroactive Sanctions: Article 50.1 clarifies that the decree is not retroactive. Violations occurring before its effective date but discovered later will be subject to the regulations in force at the time of the violation. If the draft decree imposes lighter sanctions or none, those provisions will prevail.
Room for Interpretation: Despite its advanced stage, the draft decree contains provisions conflicting with existing laws, such as discrepancies in response times to data subject requests and conditions for data storage.
Vietnam’s latest draft decree on sanctions for cybersecurity violations represents a significant step toward robust enforcement of its cybersecurity and data protection laws. Businesses should prepare for the stringent fines and penalties expected to come into effect on June 1, 2024. As the legal landscape continues to evolve, staying informed and compliant will be crucial for operating within Vietnam’s regulatory framework.
***ASL Law is a leading full-service and independent Vietnamese law firm comprising experienced and talented lawyers. ASL Law is ranked as Vietnam’s top tier Law Firm by Legal500, Asia Law, WTR, and Asia Business Law Journal. Based in both Hanoi and Ho Chi Minh City in Vietnam, the firm aims to provide the most practical, efficient, and lawful advice to its domestic and international clients. If we can be of assistance, please email to [email protected].
ASL LAW is the top-tier Vietnam law firm for in-depth legal advice in Vietnam and internationally. If you need any advice, please contact us for further information or collaboration.
