Proposal to Fine Up to 5% of Revenue for Customer Data Breaches: A Stronger Regulatory Move in the Digital Era

In a context where personal data is increasingly considered a valuable asset in the digital economy, protecting user information is no longer merely a matter of ethics or corporate responsibility but has become a mandatory legal obligation. Vietnam is taking a significant step forward in strengthening its legal framework as the Ministry of Public Security proposes fines of up to 5% of total revenue for organizations that seriously violate personal data protection regulations.

This is regarded as one of the most severe penalties to date, reflecting a clear trend toward stricter data governance and alignment with international standards. Rather than symbolic fines, the new policy aims to create real deterrence for businesses that collect and exploit user data.

According to the draft decree on administrative sanctions in cybersecurity and personal data protection, violations such as using data beyond permitted purposes, failing to provide mechanisms for users to refuse data sharing, or not clearly defining data retention and deletion timelines may result in fines ranging from VND 50 million to VND 70 million. However, the most notable aspect is not the base fine itself, but the new approach to determining the severity of violations.

Specifically, the scale of a data breach becomes a key factor. As the number of affected individuals increases, penalties escalate accordingly. Incidents involving hundreds of thousands of users may see fines doubled, while those affecting millions could face significantly higher penalties. Notably, if a breach impacts five million citizens or more, or in cases of repeat violations, fines may reach up to 5% of the organization’s total revenue from the previous fiscal year in Vietnam.

Beyond financial penalties, the draft also introduces a range of additional sanctions with stronger deterrent effects. Violating organizations may face temporary suspension of business licenses, suspension of personal data processing activities, or even confiscation of tools and means used in the violation. At the same time, mandatory remedial measures may include irreversible deletion of unlawfully obtained data, restitution of illegal profits, and public apologies to affected individuals.

Another notable development is the expansion of regulatory scope to cover emerging fields such as artificial intelligence. The use of personal data to train or operate AI systems in violation of regulations may also be subject to penalties. This reflects a shift in regulatory thinking, recognizing data not just as stored information but as a critical input for modern technologies.

Prior to this proposal, Vietnam had already established an initial legal foundation for personal data protection through Decree No. 13/2023/ND-CP, alongside the 2018 Cybersecurity Law and related regulations on administrative sanctions in the information technology sector. However, previous penalties were generally considered insufficient to drive meaningful behavioral change among businesses. The introduction of revenue-based fines represents a major step forward, enhancing enforceability and aligning regulations more closely with real-world practices.

In the international context, Vietnam’s approach follows a broader global trend. The European Union’s General Data Protection Regulation (GDPR), for instance, allows fines of up to 4% of global annual turnover. Meanwhile, several Asian countries such as Singapore, South Korea, and Japan have also increased penalties to address rising risks of data breaches. Vietnam’s proposed 5% revenue-based fine, even if applied domestically, signals a strong commitment to stricter enforcement.

The impact of this proposal on businesses is expected to be significant, particularly for sectors heavily reliant on data such as e-commerce, finance, technology, and advertising. For years, many companies have operated under a “collect as much data as possible” mindset without sufficient attention to control and protection. Under the new regulatory framework, this approach will need to change.

More broadly, this policy reflects a growing trend in modern governance, where data is increasingly treated as a strategic asset similar to financial capital or natural resources. As a result, businesses will need to go beyond investing in technology systems and develop comprehensive data governance frameworks, including impact assessments, risk management, and transparent data processing practices.

Ultimately, the proposal to impose fines of up to 5% of revenue is not merely a technical regulation but a clear signal that Vietnam is entering a new phase of stricter data governance. As the digital economy continues to expand, protecting personal data will become a critical factor in ensuring business sustainability and maintaining user trust in the digital environment.