{"id":9907,"date":"2026-09-30T09:40:14","date_gmt":"2026-09-30T02:40:14","guid":{"rendered":"https:\/\/test.dimac-law.com\/?p=9907"},"modified":"2026-09-30T09:40:14","modified_gmt":"2026-09-30T02:40:14","slug":"decree-330-2026-just-made-compliance-a-question-of-proof-not-intent","status":"publish","type":"post","link":"https:\/\/dimac-law.com\/vi\/decree-330-2026-just-made-compliance-a-question-of-proof-not-intent\/","title":{"rendered":"DECREE 330\/2026 JUST MADE COMPLIANCE A QUESTION OF PROOF, NOT INTENT"},"content":{"rendered":"

Th\u00e2n Tr\u1ecdng L\u00fd – Lu\u1eadt s\u01b0 Th\u00e0nh vi\u00ean<\/strong><\/p>\n

Decree No.\u202f330\/2026\/ND-CP was issued by the Government of Vietnam on 19 August 2026 and took effect the same day (\u201cDecree 330\/2026\u201d). No grace period, no transitional runway. It finally puts real teeth behind the Law on Personal Data Protection No.\u202f91\/2025\/QH15, which has been in force since 1 January 2026 without a matching sanction to enforce it.<\/strong><\/p>\n

Most of the conversation has circled the same three numbers, VND 3 billion, 5 per cent of revenue, ten times the proceeds of a violation. Clients ask me about them first. In my view, none of the three is what should keep a compliance officer up at night. <\/p>\n

The real shift is not the ceiling, it\u2019s the onus<\/h4>\n

Read the Decree closely and one idea runs through nearly every article. The business now has to prove it complied. It is no longer the regulator\u2019s job to prove that it didn\u2019t. <\/p>\n

Article 43.1(g) fines a business VND 30 to 50 million simply for failing to keep a consent log, or for being unable to produce one when a data subject asks or the authority inspects. Nobody needs to have complained. No data needs to have leaked. The absence of the record is the violation and entails risks. <\/p>\n

A company that has quietly done everything right for years, but never wrote any of it down, is exposed under this Decree in a way it never was before.<\/p>\n

Article 44 deserves more attention than it\u2019s getting<\/h4>\n

This is the provision I expect in-house teams to reach for most often. It sets hard, numeric deadlines for responding to data subjects. <\/p>\n

    \n
  • 2 working days to acknowledge a valid request<\/li>\n<\/ul>\n
      \n
    • 10 days to grant access, correction or provision of data<\/li>\n<\/ul>\n
        \n
      • 15 days to act on a withdrawal of consent, restriction or objection<\/li>\n<\/ul>\n
          \n
        • 20 days to act on an erasure request<\/li>\n<\/ul>\n

          Miss them, and the controller pays VND 30 to 40 million. This is, in substance, a statutory service level agreement. If your organisation doesn\u2019t already have a data subject request workflow built around these exact numbers, that\u2019s the first document you should draft after reading this article. <\/p>\n

          Watch the 500-person line, not just the headline fines<\/h4>\n

          Article 48.3 penalises collecting personal data unlawfully by technological means. Fines start at VND 100 to 200 million for as few as 500 basic data subjects and rise to VND 500 to 800 million past 5,000. <\/p>\n

          I suppose that five hundred people is not a large number. A tracking SDK, a background collection feature, a modest scraping job, any of these can put an organisation over that line before anyone in the business realises it. <\/p>\n

          Foreign investors should read Article 56 carefully<\/h4>\n

          The Decree reaches foreign enterprises providing cross-border services and foreign organisations processing Vietnamese citizens\u2019 data, no local commercial presence required.<\/p>\n

          The revenue-based penalty does not apply across the board. Article 56.3 reserves it for three specific failures, a missing transfer impact assessment, concealed or misdeclared data flows that lead to a breach, or transferring data after a stop order by the authority. For those, fines run from 1 per cent up to 5 per cent of revenue depending on scale. Add to that a six to twelve-month suspension of cross-border transfer activity, and an obligation to make the overseas recipient destroy the data and prove it. For any group running HR, CRM or cloud infrastructure outside Vietnam, this is the single largest operational exposure in the Decree. <\/p>\n

          Recommendation<\/h4>\n

          Three things worth doing immediately for businesses. First, review your consent mechanism and, more importantly, your ability to prove it. Second, build a response workflow around the Article 44 deadlines. Finally, map every technology-enabled collection point and cross-border data flow you have. <\/p>\n

          The question a regulator will ask next is not whether your business leaked data. It\u2019s whether you can prove you did things properly. Those are very different conversations to be having. <\/p>\n

          This article reflects the author\u2019s personal views and does not constitute legal advice on any specific matter.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

          Th\u00e2n Tr\u1ecdng L\u00fd – Lu\u1eadt s\u01b0 Th\u00e0nh vi\u00ean Decree No.\u202f330\/2026\/ND-CP was issued by the Government of Vietnam on 19 August 2026 and took effect the same day (\u201cDecree 330\/2026\u201d). No grace period, no transitional runway. It finally puts real teeth behind the Law on Personal Data Protection No.\u202f91\/2025\/QH15, which has been in force since 1 […]<\/p>\n","protected":false},"author":17,"featured_media":9997,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[71,101],"tags":[284],"class_list":["post-9907","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cap-nhat-phap-ly","category-home-staying-shared-vi","tag-dimac-law-firm"],"acf":[],"_links":{"self":[{"href":"https:\/\/dimac-law.com\/vi\/wp-json\/wp\/v2\/posts\/9907","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dimac-law.com\/vi\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dimac-law.com\/vi\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dimac-law.com\/vi\/wp-json\/wp\/v2\/users\/17"}],"replies":[{"embeddable":true,"href":"https:\/\/dimac-law.com\/vi\/wp-json\/wp\/v2\/comments?post=9907"}],"version-history":[{"count":1,"href":"https:\/\/dimac-law.com\/vi\/wp-json\/wp\/v2\/posts\/9907\/revisions"}],"predecessor-version":[{"id":9999,"href":"https:\/\/dimac-law.com\/vi\/wp-json\/wp\/v2\/posts\/9907\/revisions\/9999"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dimac-law.com\/vi\/wp-json\/wp\/v2\/media\/9997"}],"wp:attachment":[{"href":"https:\/\/dimac-law.com\/vi\/wp-json\/wp\/v2\/media?parent=9907"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dimac-law.com\/vi\/wp-json\/wp\/v2\/categories?post=9907"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dimac-law.com\/vi\/wp-json\/wp\/v2\/tags?post=9907"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}