Việt Nam's Data Law Gets Its Price List: Nghị định 363/2026/NĐ-CP

Tomorrow, 25 September 2026, Việt Nam’s first rulebook for data exchanges, Nghị định 314/2026/NĐ-CP, takes effect. The sanctions that give it force arrive seven weeks later. On 19 September 2026 the Government signed Nghị định 363/2026/NĐ-CP, which sets administrative fines for violations in the data field. It takes effect on 11 November 2026. It is the enforcement companion to Luật Dữ liệu số 60/2024/QH15, which has been in force since 1 July 2025.

What the document is

Number: 363/2026/NĐ-CP
Issuer: the Government, signed by Deputy Prime Minister Hồ Quốc Dũng on the proposal of the Minister of Public Security
Signed: 19 September 2026
Effective: 11 November 2026 (Điều 34)
Structure: 4 chapters, 36 articles. Chapter II (Điều 7–26) lists the violations, Chapter III sets who may impose fines, and Chapter IV covers entry into force and transition.

The decree has a deliberate boundary. Under Điều 1 k2 it does not cover violations that fall under the decree on cybersecurity and personal data protection, which is Nghị định 330/2026/NĐ-CP, covered on this blog in August. In short, 330 prices privacy and cybersecurity breaches, and 363 prices everything else the Data Law regulates: how data is collected, classified, stored, shared, analysed, verified, published, encrypted, sent abroad and traded. Under Điều 2 it also reaches foreign organisations and individuals that “directly participate in or are connected to data activities in Việt Nam”.

What changes

The Data Law created obligations that had no specific penalty attached until now: classifying data, handling “core” and “important” data, impact assessments for cross-border transfers, licensing for data exchanges and intermediaries, and a regulatory sandbox. Nghị định 363 gives each of these a fine band.

Ceilings. Under Điều 6, the maximum fine is 100 million đồng for an individual, and an organisation pays twice the individual rate, so up to 200 million đồng. A few provisions are already written at the organisational rate and are not doubled: Điều 8 k1 b, Điều 9, Điều 10, Điều 13 k2 and Điều 16 k4. The limitation period is one year (Điều 3).

Some notable fine bands (individual rates unless noted):

Collecting data without the consent of the data subject or owner: 20–40 million đồng. If the data is core or important, or the collection leaks sensitive information, the band rises to 40–60 million đồng and the database operation can be suspended for 6–9 months (Điều 8).
Scraping. Using automated tools or software to access or extract data without authorisation costs 40–60 million đồng. Using a data connection, API or data-sharing platform to collect, copy or extract data illegally costs 80–100 million đồng (Điều 12 k3 d; Điều 13 k3 c).
Falsifying models, algorithms, formulas or analytical results: 80–100 million đồng, plus up to six months’ suspension of analysis activity (Điều 14 k3 c).
Storing core or important data on systems or platforms located outside Việt Nam, or managed by foreign parties, in breach of the law: 30–70 million đồng for organisations (Điều 10 k2 c).
Cross-border transfers. Failing to file an impact assessment on time costs 20–40 million đồng. Transferring core data without an assessment or without written approval costs 60–80 million đồng. Transfers that harm national security or data subjects cost 80–100 million đồng, can bring a 3–12 month suspension, and can lead to expulsion of a foreign violator (Điều 19).
Incident duty. Failing to notify the Ministry of Public Security or the Ministry of Defence of an incident involving core or important data costs 60–100 million đồng. Failing to keep processing logs for at least six months costs 10–20 million đồng (Điều 22).

Data exchanges and intermediaries get the longest articles. Under Điều 23, an exchange that lacks a 24/7 support channel, operates below security level 3, fails to halt a suspect transaction within 24 hours, or does not keep transaction traces for at least 10 years faces fines of 20–80 million đồng, depending on the breach. Operating without a certificate costs 60–80 million đồng. Trading prohibited data, including core or important data and data without the subject’s consent, costs 80–100 million đồng. Several of these breaches can also bring a 12–18 month suspension of the exchange. The sandbox rules are specific as well: test data and copies must be deleted within 24 hours of the test ending, and raw seller data must never leave the test environment. Điều 24 applies the same pattern to intermediary services and targets conflicts of interest, such as an intermediary assessing data it sells itself.

Beyond fines, the decree can confiscate software and data used in a violation. Điều 5 requires officials to record the name, size, location and hash of any data or software before deleting it or cutting off access, and to limit deletion so that lawful data is not damaged. Remedies also include forced deletion, forced notification of affected parties, and disgorgement of illegal profits.

Who enforces it

Enforcement is led by the police. The Director of the Trung tâm dữ liệu quốc gia (National Data Center), the Director of the Cục An ninh mạng (Department of Cybersecurity) and provincial police directors may impose the full 100/200 million đồng ceiling. Heads of professional divisions at the National Data Center may impose up to 80/160 million đồng. Provincial and commune People’s Committee chairs, inspectors of the Ministries of Defence and Public Security, and the Government Cipher Board also hold sanctioning powers (Điều 27–30).

Practical implications

Data exchanges and intermediaries that launch under Nghị định 314 from 25 September have until 11 November before these fines apply. That is the window to align certificates, logs, 24-hour suspension procedures and sandbox deletion routines with the obligations that will be fined.
Companies with data pipelines, including analytics firms, AI teams training on third-party data and anyone scraping or consuming APIs, should check whether their sources are authorised. Unauthorised extraction through an API is in the top fine band.
Firms hosting data abroad need to know whether any of their datasets count as core or important data, because that classification decides whether storage and transfer rules apply.
Continuing violations are covered. Under Điều 35, conduct that began before 11 November but is still ongoing on that date is sanctioned under the new decree.

Open questions

Low ceilings for large players. Nghị định 330 allows fines of up to 3 billion đồng, or 5% of revenue for unlawful cross-border transfers of personal data. Here the cap is 200 million đồng for an organisation. For large platforms, the real deterrents will more likely be disgorgement, suspension and loss of certificates.
Where 330 ends and 363 begins. Many datasets mix personal and non-personal data. When one act breaches both regimes, the decree gives no rule for which one applies beyond the scope exclusion in Điều 1.
The classification trigger. Many of the heaviest bands depend on data being “core” or “important”. Companies will need clear lists and methods for quantifying important data before they can assess their exposure.

Sources

This post is general information, not legal advice.