|
GOVERNMENT OF VIETNAM
-------
|
SOCIALIST REPUBLIC OF VIETNAM
Independence - Freedom - Happiness
---------------
|
|
No. 363/2026/ND-CP
|
Hanoi, September 19, 2026
|
DECREE
ADMINISTRATIVE PENALTIES FOR
VIOLATIONS IN FIELD OF DATA
Pursuant to the Law on Government Organization No. 63/2025/QH15;
Pursuant to the Law on Local Government Organization No. 72/2025/QH15;
Pursuant to the Law on Promulgation of Legislative Documents No.
64/2025/QH15, amended by Law No. 87/2025/QH15;
Pursuant to the Law on Data No. 60/2024/QH15;
Pursuant to the Law on Handling of Administrative Violations No.
15/2012/QH13, amended by Law No. 67/2020/QH14, Law No. 56/2024/QH15, and Law
No. 88/2025/QH15;
At the request of the Minister of Public Security of Vietnam;
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
Chapter I
GENERAL PROVISIONS
Article 1. Scope
1.
This Decree provides for administrative violations, forms of penalties, levels
of penalties, enforcement of administrative penalties, remedial measures
applicable to each administrative violation, subjects liable to penalties,
competence to make written records of administrative violations, competence to
impose penalties and apply remedial measures, and specific maximum fines
applicable to each title for administrative violations in the field of data.
2.
This Decree does not regulate administrative violations falling within the
scope of the Decree prescribing administrative penalties for violations in the
field of cybersecurity and personal data protection.
Article 2. Regulated entities
1.
Vietnamese agencies, organizations, and individuals; foreign agencies,
organizations, and individuals in Vietnam; and foreign agencies, organizations,
and individuals directly participating in or relevant to data-related
operations in Vietnam that commit administrative violations prescribed in this
Decree.
2.
Organizations liable to administrative penalties under this Decree include:
a)
State agencies committing violations that do not fall within their assigned
state management tasks;
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
c)
Organizations established in accordance with the Law on Credit Institutions or
the Law on Investment;
d)
Public service providers;
dd)
Other organizations established in accordance with the law.
3.
Household businesses, households, and residential communities committing
administrative violations shall be subject to the fines applicable to
individuals committing administrative violations. Representatives of household
businesses, household heads, and heads of residential communities shall be
responsible for executing decisions on administrative penalties in accordance
with the law.
4.
Agencies and persons competent to make written records of administrative
violations and persons competent to impose administrative penalties and apply
remedial measures in the field of data under this Decree.
5.
Cadres, civil servants, public employees, members of the People’s Army or
People’s Public Security, and persons engaged in cipher work who commit
violations while performing official duties or assigned tasks, where such
violations fall within those official duties or assigned tasks, shall not be
penalized in accordance with the law on handling of administrative violations
but shall be handled in accordance with relevant laws.
State
agencies committing violations that fall within their state management tasks
shall not be penalized in accordance with the law on handling of administrative
violations but shall be handled in accordance with relevant laws.
Article 3. Prescriptive period for imposition of administrative penalties
1.
The prescriptive period for imposition of administrative penalties in the field
of data is 1 year.
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
3.
The time at which a violation terminates for the purpose of calculating the
prescriptive period shall be determined as follows:
a)
For violations of regulations on the provision of products and services
concerning data, the time at which a violation terminates for the purpose of
calculating the prescriptive period is the date on which the parties fulfill
their obligations;
b)
For violations involving registration, notification, or performance of
administrative procedures contrary to the law, the time at which a violation
terminates for the purpose of calculating the prescriptive period is the date
on which the registration, notification, or administrative procedure is carried
out.
4.
For administrative violations other than those prescribed in Clause 3 of this
Article, agencies and persons competent to impose administrative penalties
shall rely on relevant legislative documents, case files, documents, and the
circumstances of each specific case to determine whether a violation has
terminated or is ongoing in accordance with the law on handling of
administrative violations.
5.
If, within the period prescribed in Clause 1 of this Article, an individual or
organization deliberately evades or obstructs the imposition of penalties, the
prescriptive period for imposition of administrative penalties shall be
recalculated from the time at which such evasion or obstruction terminates.
Article 4. Forms of penalties and remedial measures
1.
The principal penalties in the field of data include:
a)
Warning;
b)
Fine.
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
a)
Fixed-term deprivation of the right to use licenses or practicing certificates,
including the Certificate of Eligibility to Provide Data Platform Services,
Certificate of Eligibility to Trade in Data Intermediation, Analysis, and
Summary Products and Services, and Certificate of Participation in Controlled
Experimentation;
b)
Confiscation of exhibits, means, tools, software, and data directly used to
commit the administrative violation (hereinafter collectively referred to as
“exhibits and means of administrative violations”);
c)
Fixed-term suspension of activities involving the provision, receipt,
disclosure, transfer, processing, connection, sharing, utilization, use,
analysis, summary, confirmation, or authentication of data;
d)
Fixed-term suspension of activities involving the administration or operation
of databases or data platforms, or of controlled experimentation activities;
dd)
Fixed-term suspension from participation in programs or projects supported by
the Data Development Fund;
e)
Expulsion of foreigners committing administrative violations.
3.
Remedial measures
Individuals
and organizations committing administrative violations prescribed in this
Decree may be subject to one or several of the following remedial measures:
a)
Mandatory restoration of data, databases, or the original state of data;
mandatory restoration of data supervision systems or remediation of security
vulnerabilities; mandatory restoration of data, encryption configurations, or
security keys to the state required by law; mandatory restoration or correction
of data or data histories that have been deleted, altered, falsified, or lost;
or mandatory restoration of data that have been erased, altered, or falsified
during confirmation or authentication;
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
c)
Mandatory application of technical and management measures to ensure data
safety; mandatory application of measures for data protection and data safety;
mandatory application of measures to ensure data safety and confidentiality;
mandatory application of technical measures to ensure data safety and security
and the safe operation of data platforms and data intermediation activities; or
mandatory application of confidentiality measures and withdrawal or deletion of
information and data that have been disclosed or used unlawfully;
d)
Mandatory notification of data incidents, their consequences, and remediation
results; mandatory notification to relevant organizations and individuals of
incorrect confirmation or authentication results that have been provided;
mandatory notification of unlawful data transfer or processing; or mandatory
notification of data transfers to affected organizations and individuals;
dd)
Mandatory removal of applications or software used to commit violations;
mandatory removal, withdrawal, or deactivation of applications or software used
to commit violations; or mandatory removal, withdrawal, or deactivation of
data, information, or digital content unlawfully disclosed in cyberspace or on
information systems;
e)
Mandatory promulgation of data collection and generation processes; mandatory
promulgation of technical processes for data storage and protection; or
mandatory development and completion of processes, technical standards, and
methods of confirmation and authentication in accordance with the law;
g)
Mandatory deletion or destruction of data for which the retention period has
expired; mandatory deletion or destruction of data unlawfully collected,
generated, copied, extracted, transferred, processed, stored, utilized, shared,
purchased, sold, transacted, or used; mandatory deletion or destruction of data
improperly confirmed or authenticated; mandatory deletion or destruction of
data or results of data analysis and summary that have been unlawfully
generated or used; or mandatory deletion or destruction of results and data
improperly collected or processed during experimentation;
h)
Mandatory correction, adjustment, or update of inaccurately generated or forged
data; mandatory supplementary provision, correction, adjustment, or update of
data that have been shared or provided inaccurately or incompletely or have
been falsified; mandatory provision of data or supplementation or update of
data that have been provided inaccurately or incompletely or have been
falsified; mandatory provision or disclosure of open data or supplementation or
update of open data that have been disclosed inaccurately or incompletely or
have been falsified; mandatory supplementary provision or correction of
information and documents; mandatory provision, supplementation, correction,
adjustment, or update of data, dossiers, and reports; mandatory full and
accurate disclosure of the scope and methods of service provision, service
prices, eligibility to participate in transactions, and relevant rights and
benefits; or mandatory full and accurate provision of inspection, assessment,
and appraisal results, information, documents, dossiers, and service provision
results;
i)
Mandatory remittance of illegal gains obtained from committing violations;
k)
Mandatory classification of data or update, maintenance, review, or adjustment
of data classification results in accordance with regulations; or mandatory
storage of data in conformity with applicable standards and technical
regulations;
l)
Mandatory assignment of rights to access and retrieve data in accordance with
the scope, subjects, and procedures prescribed by law; mandatory connection,
sharing, and synchronization of data or provision of data access rights in
accordance with the scope, subjects, and procedures prescribed by law or at the
request of competent authorities; or mandatory connection, interconnection, and
full update of transaction data and information concerning Written Certifications
of Rights to Utilize and Use Data with the National Data Platform;
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
n)
Mandatory withdrawal and destruction of forged or untruthful documents;
o)
Mandatory retention and full provision of system logs, access histories, data
processing histories, dossiers, documents, and relevant data; or mandatory
retention and full provision of system logs, data processing histories, and
documents concerning the handover, receipt, adjustment, copying, transmission,
transfer, revocation, deletion, or destruction of data;
p)
Mandatory assessment of the level of data connection and sharing; disclosure of
database ranking results or submission of database assessment and ranking
reports in accordance with regulations; mandatory performance of risk
assessments or data safety assessments in accordance with regulations;
mandatory conduct of emergency drills in accordance with regulations; or
mandatory development of emergency response plans in accordance with
regulations;
q)
Mandatory delisting or termination of transactions involving data or products
and services concerning data that fail to satisfy transaction conditions; or
mandatory application of measures to isolate, block, or control data sources,
information systems, accounts, or devices at risk of continuing to conduct
unlawful data transactions;
r)
Mandatory return of the Certificate of Eligibility to Provide Data Platform
Services or the Certificate of Eligibility to Trade in Data Intermediation,
Analysis, and Summary Products and Services;
s)
Mandatory repayment to the Fund of support or investment capital that has been
used for purposes or contents other than those approved by competent
authorities or that has been transferred, lent, leased, or used contrary to
regulations.
4.
Where the suspension prescribed in Points c, d, or dd Clause 2 of this Article
is imposed on an agency or organization directly managing or operating a
database serving state management, providing public services, or performing
essential public duties, the violating agency, organization, or individual
shall ensure the continuation of state management activities, public service
provision, and essential activities that are not directly related to the
violation.
Article 5. Enforcement of administrative penalties and remedial measures
1.
The confiscation of software and data involved in administrative violations
shall apply only to software and data that constitute exhibits or means
directly used to commit administrative violations or products or direct results
of administrative violations, as specifically prescribed in each relevant
article or clause of this Decree.
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
3.
The deletion or destruction of, or rendering inaccessible or unusable,
violating software or data shall be carried out within the necessary scope and
in proportion to the nature and severity of the violation; and shall not cause
the loss, damage, or alteration of, or obstruct the utilization or use of,
lawful data, software, or information systems of individuals or organizations,
unless such data, software, or systems cannot be separated from the violating
parts or otherwise prescribed by law.
4.
Before deleting or destroying, or rendering inaccessible or unusable, violating
software or data, the competent person shall make a written record clearly
specifying the name, type, capacity, format, storage location, identifier, hash
value, or other necessary technical information for identifying the violating
software or data. Where necessary, backups or copies shall be made, sealed, or
extracted to serve the verification and handling of violations, settlement of
complaints, denunciations, or disputes, or fulfillment of requests from
competent authorities.
5.
Where violating software or data are stored, copied, or distributed across
multiple devices, information systems, accounts, data repositories, storage
services, or different electronic environments, the violating individual or
organization shall provide the necessary information and access rights and
cooperate with competent authorities in deleting or destroying, or rendering
inaccessible or unusable, all such violating software or data.
6.
The confiscation, deletion, or destruction of, or rendering inaccessible or unusable,
violating software or data shall ensure data security and the protection of
state secrets, trade secrets, personal data, and the lawful rights and benefits
of relevant agencies, organizations, and individuals.
7.
The detection of administrative violations, making of written records of
administrative violations, verification of the circumstances of cases,
issuance, sending, receipt, and enforcement of decisions on administrative
penalties, and performance of other procedures for imposing administrative
penalties in the field of data in electronic environments shall comply with the
Law on Handling of Administrative Violations, its elaborating and guiding
documents, and other relevant laws.
Article 6. Levels of fines for administrative violations
1.
The maximum fine for an administrative violation in the field of data committed
by an individual is VND 100.000.000.
2.
The fines prescribed in Chapter II of this Decree apply to administrative
violations committed by individuals, except for those prescribed in Point b
Clause 1 Article 8, Articles 9 and 10, Clause 2 Article 13, and Clause 4
Article 16 of this Decree, for which the prescribed fines apply to
organizations. The fine imposed on an organization shall be twice the fine
imposed on an individual.
3.
A specific fine shall be determined based on the fine prescribed for each
violation in this Decree and the aggravating and mitigating circumstances
prescribed in the Law on Handling of Administrative Violations and its
elaborating and guiding documents.
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
ADMINISTRATIVE
VIOLATIONS, FORMS OF PENALTIES, AND REMEDIAL MEASURES
Article 7. Violations of regulations on prohibited acts in field of data
1.
A fine ranging from VND 40.000.000 to VND 60.000.000 shall be imposed for any
of the following violations:
a)
Forging, intentionally falsifying, causing the loss of, or damaging data in
databases of CPV agencies, the State, or the Committee of the Vietnam
Fatherland Front where the violation is not liable to criminal prosecution;
b)
Intentionally providing false data or failing to provide data at the lawful
request of a competent agency or person, except for the case prescribed in
Article 16 of this Decree.
2.
A fine ranging from VND 60.000.000 to VND 80.000.000 shall be imposed for any
of the following violations:
a)
Unlawfully obstructing or preventing the data processing or data administration
carried out by agencies, organizations, or competent persons in accordance with
the law;
b)
Attacking, appropriating, or sabotaging databases or information systems
serving the management, processing, administration, or protection of data where
the violation is not liable to criminal prosecution.
3.
Additional penalty
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
4.
Remedial measures
a)
Mandatory restoration of data, databases, or the original state of data in
respect of the violations prescribed in Point a Clause 1 and Point b Clause 2
of this Article;
b)
Mandatory application of technical measures to ensure data safety and security
in accordance with law in respect of the violation prescribed in Point b Clause
2 of this Article;
c)
Mandatory notification of the data incident, its consequences, and remediation
results to data subjects and other relevant organizations and individuals in
respect of the violation prescribed in Point b Clause 2 of this Article;
d)
Mandatory removal of applications or software used to commit the violations
prescribed in Clause 2 of this Article.
Article 8. Violations of regulations on data collection and generation
1.
A fine ranging from VND 20.000.000 to VND 40.000.000 shall be imposed for any
of the following violations:
a)
Collecting or generating data without the consent of data subjects or data
owners as prescribed by law;
b)
Failing to promulgate a process for data collection and generation, or failing
to assess and apply data protection measures before collecting or generating
data;
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
2.
A fine ranging from VND 40.000.000 to VND 60.000.000 shall be imposed for any
of the following violations:
a)
Intentionally collecting or generating data inconsistent with the master data;
b)
Intentionally collecting or generating forged data;
c)
Collecting or generating data beyond the notified scope or purposes;
d)
Committing any violation prescribed in Clause 1 of this Article where the data
are included in the national lists of core data and important data;
dd)
Committing any violation prescribed in Clause 1 of this Article that causes
sensitive information to be leaked, affects the lawful rights and benefits of
organizations or individuals, or affects national security.
3.
Additional penalties
a)
Confiscation of exhibits and means of administrative violations used to commit
the violations prescribed in Point a Clause 1 and Points a, b, and c Clause 2
of this Article;
b)
Suspension of database administration and operation for a period of 6 to 9
months in respect of the violations prescribed in Points d and dd Clause 2 of
this Article.
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
a)
Mandatory promulgation of a data collection and generation process in respect
of the violation prescribed in Point b Clause 1 of this Article;
b)
Mandatory deletion or destruction of data collected or generated contrary to
regulations in respect of the violations prescribed in Point a Clause 1 and
Points a, b, and c Clause 2 of this Article;
c)
Mandatory correction, adjustment, and update of inaccurately generated or
forged data in respect of the violations prescribed in Points a and b Clause 2
of this Article;
d)
Mandatory application of data protection and data safety measures in respect of
the violation prescribed in Point b Clause 1 of this Article;
dd)
Mandatory remittance of illegal gains obtained from committing the violations
prescribed in Point a Clause 1 and Points a, b, and c Clause 2 of this Article.
Article 9. Violations of regulations on data classification
1.
A fine ranging from VND 30.000.000 to VND 50.000.000 shall be imposed on any
agency or organization prescribed in Clause 2 Article 2 of this Decree for
committing any of the following violations:
a)
Failing to conduct data classification as prescribed by law;
b)
Failing to update or maintain data classification results as prescribed, or
failing to review and adjust classification results upon any change in the
processing purposes, utilization scope, or nature of the data.
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
Mandatory
classification of data or update, maintenance, review, or adjustment of data
classification results in accordance with regulations in respect of the
violations prescribed in Clause 1 of this Article.
Article 10. Violations of regulations on data storage
1.
A fine ranging from VND 10.000.000 to VND 30.000.000 shall be imposed on any
agency or organization prescribed in Clause 2 Article 2 of this Decree for
committing any of the following violations:
a)
Failing to promulgate a technical process for storing data under its management;
b)
Storing data without ensuring safety or failing to comply with standards and
technical regulations on data protection issued by competent authorities.
2.
A fine ranging from VND 30.000.000 to VND 70.000.000 shall be imposed on any agency
or organization prescribed in Clause 2 Article 2 of this Decree for committing
any of the following violations:
a)
Committing any violation prescribed in Clause 1 of this Article where the data
are core data or important data;
b)
Arbitrarily moving, copying, transferring, or storing core data or important
data on another system without the consent of the data owner or competent
authority;
c)
Storing core data or important data on systems or platforms located outside the
territory of Vietnam or managed by foreign organizations or individuals
contrary to the law.
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
a)
Mandatory storage of data in conformity with applicable standards and technical
regulations in respect of the violations prescribed in Point b Clause 1 and
Clause 2 of this Article;
b)
Mandatory deletion or destruction of data copied, transferred, or stored
contrary to regulations in respect of the violations prescribed in Points b and
c Clause 2 of this Article;
c)
Mandatory promulgation of a technical process for data storage in respect of
the violation prescribed in Point a Clause 1 of this Article.
Article 11. Violations of regulations on data administration and
management
1.
A fine ranging from VND 20.000.000 to VND 40.000.000 shall be imposed for any
of the following violations:
a)
Intentionally utilizing or using data beyond the assigned scope, thereby
affecting the lawful rights and benefits of organizations or individuals or
affecting state management activities;
b)
Concealing, deleting, or falsifying data histories, or altering data in a
manner that falsifies or causes the loss of such data.
2.
Additional penalty
Suspension
of data utilization and use for a period of 3 to 12 months in respect of the
violation prescribed in Point a Clause 1 of this Article.
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
a)
Mandatory restoration or correction of data or data histories that have been
deleted, altered, falsified, or lost in respect of the violation prescribed in
Point b Clause 1 of this Article;
b)
Mandatory remittance of illegal gains obtained from committing the violations
prescribed in Clause 1 of this Article.
Article 12. Violations of regulations on data access and retrieval
1.
A warning shall be imposed for any of the following violations:
a)
Assigning data access and retrieval rights contrary to the prescribed process
or without approval from a competent authority;
b)
Failing to record data access and retrieval logs as required by the law on data;
c)
Failing to periodically inspect the assignment of data access and retrieval
rights and data access and retrieval logs as prescribed.
2.
A fine ranging from VND 20.000.000 to VND 40.000.000 shall be imposed for any
of the following violations:
a)
Granting data access or retrieval rights to unauthorized entities or beyond the
authorized scope or purposes;
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
c)
Allowing another person to use an account, digital certificate, or access key
under one’s management or use to access or retrieve data;
d)
Deleting, altering, or falsifying data access or retrieval logs.
3.
A fine ranging from VND 40.000.000 to VND 60.000.000 shall be imposed for any
of the following violations:
a)
Intentionally accessing or retrieving data beyond the authorized scope;
b)
Refusing, obstructing, or intentionally delaying lawful data access or
retrieval by competent state agencies;
c)
Unlawfully accessing or retrieving core data or important data;
d)
Using automated tools, data access or retrieval software, or data mining or
scanning tools, or unlawfully interfering with systems to collect or retrieve
data.
4.
Additional penalty
Confiscation
of exhibits and means of administrative violations used to commit the violation
prescribed in Point d Clause 3 of this Article.
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
a)
Mandatory assignment of data access and retrieval rights in accordance with the
scope, subjects, and procedures prescribed by law in respect of the violation
prescribed in Point a Clause 1 of this Article;
b)
Mandatory revocation, locking, or deactivation of access accounts, access
codes, decryption keys, digital certificates, system administration rights, or
data utilization rights granted or used contrary to regulations in respect of
the violations prescribed in Points a, b, and c Clause 2 and Points a and c
Clause 3 of this Article;
c)
Mandatory removal, withdrawal, or deactivation of applications or software used
to commit the violation prescribed in Point d Clause 3 of this Article;
d)
Mandatory remittance of illegal gains obtained from committing the violations
prescribed in Clauses 2 and 3 of this Article.
Article 13. Violations of regulations on data connection, sharing, and
coordination
1.
A fine ranging from VND 20.000.000 to VND 40.000.000 shall be imposed for any
of the following violations:
a)
Connecting or sharing data with organizations or individuals without obtaining
the required approval from a competent authority, or failing to comply with the
approved contents, conditions, or process;
b)
Sharing or providing data beyond the scope or purposes permitted under a
contract or written agreement or beyond the scope of assigned rights.
2.
A fine ranging from VND 60.000.000 to VND 80.000.000 shall be imposed on any
agency prescribed in Clause 2 Article 2 of this Decree for committing any of
the following violations:
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
b)
Sharing or providing data in an incorrect standard format, under an incorrect
data model, or contrary to the standards of the Common Data Dictionary, thereby
causing data inaccuracies or obstructing data integration or synchronization;
c)
Sharing or providing data through channels that are unsafe, unencrypted, or
uncontrolled, or that fail to ensure data protection measures in accordance
with national standards.
3.
A fine ranging from VND 80.000.000 to VND 100.000.000 shall be imposed for any
of the following violations:
a)
Sharing or providing core data, important data, or national data without
authorization or for purposes beyond those authorized;
b)
Intentionally altering, falsifying, or concealing data during data sharing or
provision;
c)
Using data connections, data application programming interfaces (APIs), or data
sharing platforms to unlawfully collect, copy, or extract data.
4.
Additional penalties
a)
Suspension of data connection, sharing, utilization, and use for a period of 1
to 6 months in respect of the violations prescribed in Points a and b Clause 1,
Point c Clause 2, and Clause 3 of this Article;
b)
Confiscation of exhibits and means of administrative violations used to commit
the violations prescribed in Points a and b Clause 1 and Clause 3 of this
Article.
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
a)
Mandatory connection or sharing of data or provision of data access rights in
accordance with the scope, subjects, sequences, and procedures prescribed by
law or at the request of competent authorities in respect of the violation
prescribed in Point a Clause 2 of this Article;
b)
Mandatory supplementary provision, correction, adjustment, or update of data
shared or provided inaccurately or incompletely or that have been falsified in
respect of the violations prescribed in Point b Clause 2 and Point b Clause 3
of this Article;
c)
Mandatory deletion or destruction of data unlawfully collected, copied, or
extracted in respect of the violation prescribed in Point c Clause 3 of this
Article;
d)
Mandatory remittance of illegal gains obtained from committing the violations
prescribed in Clauses 1 and 3 of this Article.
Article 14. Violations of regulations on data analysis and summary
1.
A fine ranging from VND 20.000.000 to VND 40.000.000 shall be imposed for any
of the following violations:
a)
Analyzing or summarizing data from data sources that the violator is not
permitted to access, retrieve, or use;
b)
Analyzing or summarizing data that require approval from a competent authority
under the law without obtaining such approval, or for purposes inconsistent
with those approved;
c)
Analyzing or summarizing data beyond the scope or volume permitted under
assigned rights or contracts.
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
a)
Conducting data analysis or summary connected to national databases or
specialized databases without complying with prescribed connection standards,
API standards, integration standards, or metadata standards;
b)
Using the results of data analysis or summary to share or provide data to a
third party contrary to the approved contents, or without approval from a
competent authority where such approval is required by law;
c)
Failing to implement measures to ensure data safety, data confidentiality,
anonymization, or encryption, or failing to record processing logs for core
data or important data during data analysis or summary.
3.
A fine ranging from VND 80.000.000 to VND 100.000.000 shall be imposed for any
of the following violations:
a)
Intentionally analyzing or summarizing data obtained from unlawful sources,
leaked data, or data that may not be processed;
b)
Analyzing or summarizing core data or important data without approval or beyond
the permitted scope;
c)
Altering, forging, or falsifying models, algorithms, formulas, or results of
data analysis or summary.
4.
Additional penalties
a)
Suspension of data analysis and summary activities for a period of 1 to 6
months in respect of the violations prescribed in Clause 2 and Points a, b, and
c Clause 3 of this Article;
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
5.
Remedial measures
a)
Mandatory deletion or destruction of data or results of data analysis or
summary unlawfully generated or used in respect of the violations prescribed in
Points a, b, and c Clause 1, Point b Clause 2, and Clause 3 of this Article;
b)
Mandatory application of measures to ensure data safety and data
confidentiality in respect of the violation prescribed in Point c Clause 2 of
this Article;
c)
Mandatory remittance of illegal gains obtained from committing the violations
prescribed in this Article.
Article 15. Violations of regulations on data confirmation and
authentication
1.
A fine ranging from VND 20.000.000 to VND 40.000.000 shall be imposed for any
of the following violations:
a)
Failing to conduct data confirmation or authentication upon a lawful request
from a competent organization or individual;
b)
Confirming or authenticating data without assigned authority or tasks, or
beyond the assigned scope.
2.
A fine ranging from VND 40.000.000 to VND 60.000.000 shall be imposed for any
of the following violations:
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
b)
Using data confirmation or authentication results for improper purposes, beyond
the permitted scope, or contrary to the law.
3.
A fine ranging from VND 60.000.000 to VND 80.000.000 shall be imposed for any
of the following violations:
a)
Forging data confirmation or authentication results; erasing, altering, or
interfering with confirmed or authenticated data;
b)
Using tools, software, or systems to generate forged authentication results or
to bypass or compromise lawful authentication mechanisms;
c)
Taking advantage of data confirmation or authentication activities to conceal
violations, generate false information, or obtain illegal gains;
d)
Providing data confirmation or authentication services without satisfying the
conditions prescribed by law.
4.
Additional penalties
a)
Fixed-term deprivation of the right to use the license for the provision of
data confirmation and authentication services for a period of 3 to 12 months in
respect of the violation prescribed in Point c Clause 3 of this Article;
b)
Confiscation of exhibits and means of administrative violations used to commit
the violations prescribed in Points b and c Clause 3 of this Article;
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
5.
Remedial measures
a)
Mandatory deletion, destruction, or deactivation of data confirmation or
authentication results generated contrary to regulations in respect of the
violations prescribed in Point b Clause 1, Point a Clause 2, and Points a, b,
and d Clause 3 of this Article;
b)
Mandatory revocation, cancellation, or deactivation of authentication or
confirmation results that have been altered or falsified in respect of the
violation prescribed in Point a Clause 2 of this Article;
c)
Mandatory restoration of data erased, altered, or falsified during confirmation
or authentication in respect of the violation prescribed in Point a Clause 3 of
this Article;
d)
Mandatory notification to relevant organizations and individuals of incorrect
confirmation or authentication results that have been provided in respect of
the violations prescribed in Point a Clause 2 and Points a, b, and c Clause 3
of this Article;
dd)
Mandatory development and completion of processes, technical standards, and
methods of confirmation and authentication in accordance with law in respect of
the violation prescribed in Point d Clause 3 of this Article;
e)
Mandatory remittance of illegal gains obtained from committing the violations
prescribed in Clauses 2 and 3 of this Article.
Article 16. Violations of regulations on data provision for state
agencies
1.
A fine ranging from VND 20.000.000 to VND 40.000.000 shall be imposed for any
of the following violations:
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
b)
Arbitrarily delaying or prolonging the period for data provision without a
justifiable reason.
2.
A fine ranging from VND 40.000.000 to VND 60.000.000 shall be imposed for any
of the following violations:
a)
Intentionally providing falsified, inaccurate, altered, or incomplete data, or
data of an incorrect type, level of detail, volume, frequency, or method
contrary to a lawful request;
b)
Failing to notify the state agency that the data no longer exist, have been
damaged, or have been altered for reasons not arising from the state agency’s
request;
c)
Providing data without the consent of data subjects where the law does not
permit mandatory data provision;
d)
Failing to provide data to competent state agencies in cases where data
provision is mandatory under the law on data.
3.
A fine ranging from VND 60.000.000 to VND 80.000.000 shall be imposed for any
of the following violations:
a)
Providing forged data or data with an incorrect origin or nature;
b)
Taking advantage of the provision or non-provision of data to obstruct the
operations of state agencies or obtain illegal gains;
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
4.
A fine ranging from VND 80.000.000 to VND 100.000.000 shall be imposed on any
agency or organization prescribed in Clause 2 Article 2 of this Decree that
commits any of the following violations during data receipt:
a)
Failing to ensure data safety, thereby resulting in data leakage, loss, or
unauthorized access during the receipt and use of data;
b)
Failing to delete or destroy data upon expiry of the retention period
prescribed by law or the determined retention period, unless otherwise
prescribed by law.
5.
Additional penalties
a)
Suspension of data provision or receipt activities for a period of 6 to 12
months in respect of the violations prescribed in Clause 4 of this Article;
b)
Confiscation of exhibits and means of administrative violations used to commit
the violations prescribed in Point a Clause 2, Point a Clause 3, and Point b
Clause 4 of this Article.
6.
Remedial measures
a)
Mandatory provision of data or supplementation or update of data that have been
provided inaccurately or incompletely or have been falsified in respect of the
violations prescribed in Clause 1, Points a and d Clause 2, and Point a Clause
3 of this Article;
b)
Mandatory deletion or destruction of data for which the retention period has
expired in respect of the violation prescribed in Point b Clause 4 of this
Article;
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
d)
Mandatory remittance of illegal gains obtained from committing the violations
prescribed in Point a Clause 2 and Clause 3 of this Article.
Article 17. Violations of regulations on data disclosure
1.
A warning shall be imposed for any of the following violations:
a)
Failing to disclose open data, or disclosing open data after the prescribed
deadline, at an incorrect frequency, or in a form inconsistent with regulations;
b)
Disclosing data without ensuring accessibility, utilization, or usability, or
in a format inconsistent with the technical standards for open data.
2.
A fine ranging from VND 20.000.000 to VND 40.000.000 shall be imposed for any
of the following violations:
a)
Disclosing data that do not accurately reflect the master data;
b)
Disclosing data that may not be disclosed under the law.
3.
A fine ranging from VND 40.000.000 to VND 80.000.000 shall be imposed for any
of the following violations:
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
b)
Intentionally disclosing inaccurate data to cause confusion or obstruct the
operations of other organizations or individuals;
c)
Failing to analyze and assess impacts on national defense and security, foreign
affairs, macroeconomic situations, social stabilization, or community health
and safety before disclosing data.
4.
Additional penalties
a)
Suspension of data disclosure activities for a period of 1 to 6 months in
respect of the violations prescribed in Clause 3 of this Article;
b)
Confiscation of exhibits and means of administrative violations used to commit
the violation prescribed in Point b Clause 3 of this Article.
5.
Remedial measures
a)
Mandatory removal, withdrawal, or deactivation of data, information, or digital
content unlawfully disclosed in cyberspace or on information systems in respect
of the violations prescribed in Clause 2 and Points a and b Clause 3 of this
Article;
b)
Mandatory provision or disclosure of open data, or supplementation or update of
data that have been disclosed inaccurately or incompletely or have been
falsified, in respect of the violations prescribed in Clause 1, Point a Clause
2, and Points a and b Clause 3 of this Article;
c)
Mandatory remittance of illegal gains obtained from committing the violations
prescribed in Clause 2 and Points a and b Clause 3 of this Article.
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
1.
A fine ranging from VND 20.000.000 to VND 40.000.000 shall be imposed for any
of the following violations:
a)
Failing to encrypt data or apply data encryption and decryption measures when
transmitting, storing, or sharing data in cases where encryption or decryption
is required by law;
b)
Failing to inspect, assess, or authenticate persons performing data decryption
or granting access rights to encrypted data as prescribed.
2.
A fine ranging from VND 40.000.000 to VND 60.000.000 shall be imposed for any
of the following violations:
a)
Encrypting or decrypting data beyond the assigned authority or scope or without
complying with technical processes;
b)
Decrypting data without the consent of the data owner, data governing body, or
competent authority;
c)
Failing to ensure information safety or data security during encryption or
decryption, thereby resulting in data leakage, data loss, or loss of data
safety.
3.
A fine ranging from VND 60.000.000 to VND 100.000.000 shall be imposed for any
of the following violations:
a)
Disclosing, disseminating, exchanging, purchasing, or selling tools or software
supporting unlawful decryption;
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
c)
Encrypting data included in the list of state secrets without using state
cipher as prescribed.
4.
Additional penalties
a)
Suspension of database administration and operation for a period of 3 to 6
months in respect of the violations prescribed in Points b and c Clause 3 of
this Article;
b)
Confiscation of exhibits and means of administrative violations used to commit
the violation prescribed in Point a Clause 3 of this Article.
5.
Remedial measures
a)
Mandatory restoration of data, encryption configurations, or security keys to
the state required by law in respect of the violations prescribed in Clause 2
and Point c Clause 3 of this Article;
b)
Mandatory removal, withdrawal, or deactivation of applications or software used
to commit the violation prescribed in Point a Clause 3 of this Article;
c)
Mandatory remittance of illegal gains obtained from committing the violations
prescribed in Clause 2 and Points a and b Clause 3 of this Article.
Article 19. Violations of regulations on cross-border data transfer and
processing
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
a)
Failing to submit an impact assessment dossier within the prescribed time limit
in the case of the cross-border transfer or processing of core data or
important data;
b)
Failing to amend or supplement an impact assessment dossier upon any change in
the purposes, methods, scope, or types of data transferred or processed; any
change in the purposes or methods of data processing that affects data security
or safety; any extension of the retention period for core data or important
data; any change in data protection policies or regulations or the
cybersecurity environment; or any change in the actual control of the data
transferor or data recipient;
c)
Failing to retain and preserve an impact assessment dossier as prescribed;
d)
Failing to submit an impact assessment report within the prescribed time limit
in the case of data transfer under an exception mechanism;
dd)
Failing to execute a written agreement between the data transferor and the data
recipient containing the mandatory contents.
2.
A fine ranging from VND 40.000.000 to VND 60.000.000 shall be imposed for any
of the following violations:
a)
Transferring or processing data beyond the scope, types, volume, frequency, or
duration declared, assessed, or approved;
b)
Failing to comply with regulations on the quantification of important data
during cross-border data transfer or processing;
c)
Failing to fulfill obligations to cooperate, provide information, or give
explanations at the request of competent authorities;
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
3.
A fine ranging from VND 60.000.000 to VND 80.000.000 shall be imposed for any
of the following violations:
a)
Conducting cross-border transfer or processing of core data without carrying
out an impact assessment as prescribed;
b)
Transferring core data without obtaining the written approval of a competent
authority as prescribed by law;
c)
Providing an untruthful impact assessment dossier or erasing or altering
documents in a manner that falsifies the dossier;
d)
Failing to comply with a competent authority’s request to suspend cross-border
data transfer or processing activities.
4.
A fine ranging from VND 80.000.000 to VND 100.000.000 shall be imposed for any
of the following violations:
a)
Conducting cross-border transfer or processing of core data or important data
in a manner that affects or poses a risk of affecting national defense,
national security, social order and safety, national interests, public
interests, or the lawful rights and benefits of data subjects;
b)
Taking advantage of cross-border data transfer or processing activities to
conceal unlawful data transfers or commit other acts contrary to the law.
5.
Additional penalties
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
b)
Confiscation of exhibits and means of administrative violations used to commit
the violations prescribed in Points a and b Clause 3 and Points a and b Clause
4 of this Article;
c)
Expulsion from the territory of the Socialist Republic of Vietnam of foreigners
committing the violations prescribed in Clause 4 of this Article.
6.
Remedial measures
a)
Mandatory deletion or destruction of data transferred or processed contrary to
regulations in respect of the violations prescribed in Point a Clause 2, Points
a and b Clause 3, and Point a Clause 4 of this Article;
a)
Mandatory deletion or destruction of data transferred or processed contrary to
regulations in respect of the violations prescribed in Point a Clause 2, Points
a and b Clause 3, and Point a Clause 4 of this Article;
c)
Mandatory application of technical and management measures to ensure data
safety in respect of the violations prescribed in Point d Clause 2 and Clause 4
of this Article;
d)
Mandatory remittance of illegal gains obtained from committing the violations
prescribed in Clauses 2, 3, and 4 of this Article.
Article 20. Violations of regulations on data audits and database ratings
1.
A fine ranging from VND 20.000.000 to VND 40.000.000 shall be imposed for any of
the following violations:
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
b)
Failing to conduct data self-audits or self-assessments at the request of a
competent authority;
c)
Failing to review, update, or standardize data in accordance with audit
conclusions;
d)
Failing to report the results of implementing data audit recommendations within
the prescribed time limit.
2.
A fine ranging from VND 40.000.000 to VND 60.000.000 shall be imposed for any
of the following violations:
a)
Failing to fully provide dossiers, documents, reports, or data serving a data
audit at the request of a competent authority;
b)
Providing inaccurate or untruthful information, data, or dossiers, or
concealing data during a data audit;
c)
Failing to assess the level of data connection and sharing according to the
Rating Index Set promulgated by the Ministry of Public Security of Vietnam;
d)
Failing to disclose the rating results of databases under one’s management as
prescribed;
dd)
Failing to submit database assessment and rating reports to the Ministry of
Public Security of Vietnam as prescribed.
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
a)
Failing to comply with a competent authority’s decision on an extraordinary
data audit;
b)
Failing to carry out mandatory data connection or sharing in accordance with
audit conclusions;
c)
Falsifying or intentionally altering database assessment or rating indexes.
4.
Additional penalty
Confiscation
of exhibits and means of administrative violations used to commit the violation
prescribed in Point c Clause 3 of this Article.
5.
Remedial measures
a)
Mandatory retention and full provision of system logs, access histories, data
processing histories, dossiers, documents, and data serving the audit in
respect of the violations prescribed in Point a Clause 1, Points a and b Clause
2, and Point a Clause 3 of this Article;
b)
Mandatory provision, supplementation, correction, adjustment, or update of
data, dossiers, and reports in respect of the violations prescribed in Point d
Clause 1 and Points a, b, and dd Clause 2 of this Article;
c)
Mandatory assessment of the level of data connection and sharing, disclosure of
database rating results, or submission of database assessment and rating
reports as prescribed in respect of the violations prescribed in Points c, d,
and dd Clause 2 of this Article;
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
dd)
Mandatory remittance of illegal gains obtained from committing the violations
prescribed in Point a Clause 2 and Point c Clause 3 of this Article.
Article 21. Violations of regulations on other operations in data
processing
1.
A fine ranging from VND 20.000.000 to VND 40.000.000 shall be imposed for any
of the following violations:
a)
Failing to establish or carry out data adjustment or update activities, or
failing to implement procedures for data revocation, deletion, or destruction
as prescribed by law;
b)
Failing to notify affected organizations and individuals of a data transfer
upon reorganization, dissolution, or bankruptcy;
c)
Failing to prepare or retain records of the handover, receipt, adjustment,
copying, transmission, transfer, or destruction of data as prescribed;
d)
Failing to fully specify the scope, duration, confidentiality obligations, and
responsibilities of the parties in an entrustment contract or agreement as
prescribed.
2.
A fine ranging from VND 40.000.000 to VND 60.000.000 shall be imposed for any
of the following violations:
a)
Transferring data upon reorganization, dissolution, or bankruptcy without a
data transfer plan as prescribed;
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
c)
Assigning another organization or individual to process data without an
entrustment contract or agreement;
d)
Failing to apply measures to ensure data safety.
3.
A fine ranging from VND 60.000.000 to VND 100.000.000 shall be imposed for any
of the following violations:
a)
Revoking, deleting, or destroying core data or important data contrary to the
prescribed process or without ensuring that the data cannot be recovered;
b)
Failing to prepare dossiers or documents proving the deletion or destruction of
core data or important data;
c)
Failing to implement measures to prevent abuse, leakage, or use for improper
purposes during entrusted data processing.
4.
Additional penalty
Suspension
of data processing activities for a period of 1 to 6 months in respect of the
violations prescribed in Clause 3 of this Article.
5.
Remedial measures
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
b)
Mandatory notification of data transfers to affected organizations and
individuals in respect of the violation prescribed in Point b Clause 1 of this
Article;
c)
Mandatory remittance of illegal gains obtained from committing the violations
prescribed in Clause 2 of this Article.
Article 22. Violations of regulations on risk identification and
management, data protection, and monitoring of data processing activities
1.
A fine ranging from VND 10.000.000 to VND 20.000.000 shall be imposed for any
of the following violations:
a)
Failing to establish mechanisms for identifying, assessing, and providing early
warnings of risks arising during data processing as prescribed;
b)
Failing to record data processing logs and retain them for at least 6 months in
respect of important data or core data;
c)
Failing to notify relevant organizations and individuals of a data incident
that causes damage.
2.
A fine ranging from VND 20.000.000 to VND 40.000.000 shall be imposed for any
of the following violations:
a)
Failing to periodically conduct risk assessments of core data or important
data, except where an impact assessment dossier for cross-border data transfer
or processing has been prepared in accordance with the law;
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
c)
Failing to develop an emergency response plan for data incidents;
d)
Failing to periodically conduct drills of contingency plans for core data or
important data safety incidents as prescribed by law;
dd)
Failing to promulgate technical processes or data protection regulations, or
failing to apply appropriate data protection measures when providing data
externally.
3.
A fine ranging from VND 40.000.000 to VND 60.000.000 shall be imposed for any
of the following violations:
a)
Failing to monitor data processing activities during data connection or sharing
as prescribed by law;
b)
Failing to ensure the traceability and transparency of data processing
activities as required for monitoring;
c)
Failing to provide information, system logs, or monitoring reports at the
request of competent authorities;
d)
Obstructing, delaying, or falsifying data monitoring activities conducted by
competent authorities;
dd)
Failing to implement mitigation measures following an early risk warning,
thereby resulting in data disclosure, leakage, or loss of data safety.
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
a)
Failing to notify the Ministry of Public Security of Vietnam or the Ministry of
National Defense of Vietnam of a core data or important data incident as
required;
b)
Failing to comply with a competent authority’s request to remedy a violation or
temporarily cease or suspend data processing activities;
c)
Failing to comply with technical standards and regulations or data protection
requirements during data connection or sharing;
d)
Intentionally concealing or falsifying monitoring data, system logs, or risk
assessment reports;
dd)
Failing to establish a management system for data protection and data backup
during data processing.
5.
Additional penalty
Suspension
of data processing, connection, and sharing activities for a period of 3 to 6
months in respect of the violations prescribed in Points b, c, d, and dd Clause
4 of this Article.
6.
Remedial measures
a)
Mandatory restoration of data monitoring systems and remediation of security
vulnerabilities in respect of the violations prescribed in Points a, b, and d
Clause 3 and Points c and dd Clause 4 of this Article;
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
c)
Mandatory development of an emergency response plan as prescribed in respect of
the violation prescribed in Point c Clause 2 of this Article;
d)
Mandatory conduct of emergency drills as prescribed in respect of the violation
prescribed in Point d Clause 2 of this Article;
dd)
Mandatory notification of data incidents, their consequences, and remediation
results to data subjects or relevant organizations and individuals in respect
of the violations prescribed in Point c Clause 1, Point b Clause 2, and Point a
Clause 4 of this Article;
e)
Mandatory promulgation of technical processes for data protection in respect of
the violation prescribed in Point dd Clause 2 of this Article;
g)
Mandatory remittance of illegal gains obtained from committing the violation
prescribed in Point d Clause 4 of this Article.
Article 23. Violations of regulations on data platform operations
1.
A fine ranging from VND 20.000.000 to VND 40.000.000 shall be imposed for any
of the following violations:
a)
Failing to fully develop or maintain the operational plans, processes, and
regulations of the data platform, technical plans, storage plans, or measures
to ensure data integrity in accordance with the approved dossier;
b)
Failing to establish or ensure uninterrupted channels for receiving information
and using data platform services 24 hours per day and 7 days per week, except
in cases of force majeure, or failing to issue a notice and take remedial measures
in such cases;
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
d)
Failing to develop or disclose sets of indexes and technical specifications for
assessing and managing the quality of data products and services, or a system
of indexes for assessing data assets and supporting the pricing of data
products and services;
dd)
Failing to submit periodic or ad hoc reports on data platform operations to
competent authorities according to the prescribed forms and time limits;
e)
Failing to disclose or promptly update the Data Platform Operating Regulations,
service prices, lists of payment intermediary service providers and payment
service providers, or other information subject to mandatory disclosure;
g)
Failing to develop, operate, or regularly update a system for analyzing and
summarizing market data to provide market price information; or failing to list
or update the list of price appraisal enterprises eligible to provide price
appraisal services on the data platform’s system;
h)
Failing to develop or operate a system for receiving, processing, storing, and
disclosing user reviews and feedback; failing to ensure the authenticity or
integrity of review information; or failing to permit the Seller to respond to
reviews or incident reports concerning data products and services;
i)
Failing to establish, maintain, or disclose methods for receiving requests for
assistance in resolving issues arising from transactions on the data platform;
k)
Failing to notify the receipt of a request, available assistance measures, or
the expected processing time; failing to issue a notice or request
supplementary information or documents; failing to process an assistance
request; or failing to notify an extension of the request-processing period
within the prescribed time limit.
2.
A fine ranging from VND 40.000.000 to VND 60.000.000 shall be imposed for any
of the following violations:
a)
Failing to satisfy the prescribed conditions concerning personnel, physical
facilities, technical equipment, management processes, or plans for ensuring
security and order;
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
c)
Failing to fully perform responsibilities for monitoring activities on the data
platform, or failing to promptly suspend transactions or suspend or cancel the
listing of data or data products and services in cases where transactions or
listings are required to be suspended or canceled as prescribed;
d)
Failing to implement emergency response, backup, or disaster recovery plans or
conduct emergency data safety drills as prescribed;
dd)
Failing to provide instructions to or require parties participating in the
platform to implement measures to protect data, trade secrets, and important
data;
e)
Failing to authenticate the identity or legal capacity of entities
participating in data transactions on the platform in accordance with the law
on e-identification and authentication;
g)
Failing to establish a system for ensuring the safety of data transactions or
failing to instruct parties participating in data transactions to implement
safety measures;
h)
Failing to ensure that the information system satisfies information system
security requirements of at least level 3;
i)
Failing to connect or share data between another data platform and the National
Data Platform through the Data Coordination and Sharing Platform, or failing to
comply with technical requirements for connection and interconnection as
prescribed;
k)
Failing to moderate the contents of purchase or sale offers; failing to verify
legal status, the Certificate of Eligibility for Business Operations, or the
completeness and validity of service information posted on the data platform;
l)
Listing data or data products and services without a decision approving the
listing, or listing contents inconsistent with the approved dossier;
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
n)
Failing to fully record and retain data messages, the time of sending and
receipt, and the parties’ confirmation operations during the making,
acceptance, amendment, withdrawal, cancellation, or termination of a
transaction offer;
o)
Failing to suspend a transaction within 24 hours from the time of detecting or
receiving substantiated information concerning a case requiring transaction
suspension; or failing to review, verify, or decide how to handle the suspended
transaction within the prescribed time limit;
p)
Failing to establish or operate a technical system that ensures the correct
identification of entities, authenticates the parties’ consent, and records and
timestamps electronic contracts, appendices to electronic contracts, or
documents amending or supplementing electronic contracts;
q)
Failing to retain electronic contracts, the parties’ confirmation information,
or transaction dossiers; or failing to ensure the integrity or retrievability
and searchability of electronic contracts throughout the prescribed retention
period;
r)
Failing to develop or implement policies and processes for identifying,
assessing, providing early warnings of, and handling risks; failing to
periodically review and assess risks; or failing to establish a mechanism for
controlling risks associated with data products and services generated from
data analysis and summary activities.
3.
A fine ranging from VND 60.000.000 to VND 80.000.000 shall be imposed for any
of the following violations:
a)
Providing data platform services without the Certificate of Eligibility to
Provide Data Platform Services as prescribed, or operating after such
Certificate has expired;
b)
Continuing to provide data platform services after a competent authority has
issued a decision suspending operations or revoking the Certificate of
Eligibility to Provide Data Platform Services;
c)
Using the issued Certificate of Eligibility to Provide Data Platform Services
for purposes or within a scope inconsistent with the Certificate; or providing
data platform services beyond the approved scope, type, entities, products, or
services;
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
dd)
Failing to return the Certificate of Eligibility to Provide Data Platform
Services to the competent authority after a revocation decision has been issued;
e)
Organizing an auction of data or data products and services without satisfying
the conditions for organizing auctions prescribed by the law on property
auction, or entering into a service contract with an organization ineligible to
practice property auction;
g)
Failing to establish or operate a technical system serving auctions that
satisfies requirements for accurately and truthfully recording the time of bid
submission and bid prices, ensuring information safety and confidentiality,
retaining the history of auction developments, or satisfying technical
requirements applicable to online auction websites;
h)
Failing to refuse to organize an auction of data or data products and services
that have not been permitted for transactions;
i)
Failing to design or operate a testing environment separate from the data
platform’s official operating system and external information systems; or
failing to provide technical tools for controlling data flows and preventing,
detecting, and stopping unauthorized access to, copying of, or extraction of
data from the testing environment;
k)
Failing to automatically terminate access rights or delete testing data,
copies, and working data within 24 hours from the expiry of the testing period;
l)
Failing to conduct technical inspections of outputs before permitting their
extraction from the testing environment; failing to retain technical activity
logs of the testing environment; or failing to provide such logs at the request
of competent authorities;
m)
Failing to fully record and retain transaction information immediately after
the completion of the delivery of data or data products and services; failing
to establish, maintain, or operate a system for recording, retaining, and
tracing transactions; or failing to retain information, dossiers, and logs
serving transaction tracing for at least 10 years;
n)
Failing to issue a Written Certification of Rights to Utilize and Use Data to
the Buyer; failing to maintain a centralized lookup system for transaction
status and data use rights; or failing to connect and interconnect transaction
data and information concerning Written Certifications of Rights to Utilize and
Use Data with the National Data Platform.
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
a)
Organizing transactions, purchases, sales, or exchanges on a data platform
involving data that may not be transacted, including data included in the lists
of core data and important data; data for which consent has not been obtained
from data subject matters, unless otherwise prescribed by law; or other data
prohibited from transactions under the law;
b)
Taking advantage of data platform operations to unlawfully purchase, sell, or
transfer data, conceal the origin of data, or legitimize unlawfully collected
or processed data;
c)
Failing to suspend a transaction, cancel a listing, or apply necessary
technical measures upon detecting that the provision of data platform services
or the listing or transaction of data poses a risk of affecting national
defense, national security, social order and safety, or infringing upon the
lawful rights and benefits of organizations or individuals;
d)
Continuing to organize data transactions or maintain the listing of violating
data products or services after a competent authority has requested the
suspension, termination, or cancellation of the listing or transaction;
dd)
Listing, offering to purchase, offering to sell, auctioning, or organizing
transactions involving data or data products and services generated from
national databases or specialized databases without documents proving the right
to provide, utilize, use, or transact such data, products, or services, or
without permission from a competent agency, organization, or person;
e)
Permitting a Testing Participant to download, copy, or extract master data from
the testing environment, or permitting the extraction of outputs containing the
Seller’s master data.
5.
A fine ranging from VND 40.000.000 to VND 60.000.000 shall be imposed on a
Seller or Buyer for committing any of the following violations:
a)
Providing incomplete, inaccurate, or unlawful information for registering a
transaction account;
b)
Conducting transactions involving data or data products and services without
using the transaction account and payment account registered on the data
platform;
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
d)
Failing to promptly update or supplement information or documents upon any
change while the data or data products and services remain listed;
dd)
Inspecting, assessing, or appraising data or data products and services
provided by the Seller itself or a transaction in which the Seller has relevant
rights or benefits;
e)
Failing to prove the lawful origin, ownership, or right to provide, utilize,
use, transfer, or transact data or data products and services;
g)
Utilizing or using data or data products beyond the agreed scope, purposes,
duration, or conditions; or retransferring, copying, or using data beyond the
transferred rights to utilize or use such data.
6.
Additional penalties:
a)
Fixed-term deprivation of the right to use the Certificate of Eligibility to
Provide Data Platform Services for a period of 6 to 12 months in respect of the
violations prescribed in Point c Clause 3 and Clause 4 of this Article;
b)
Suspension of data platform administration and operation for a period of 12 to
18 months in respect of the violations prescribed in Clause 2 and Points g, h,
i, k, l, m, and n Clause 3 of this Article;
c)
Confiscation of exhibits and means of administrative violations used to commit
the violations prescribed in Points a, b, d, dd, and e Clause 4 of this Article.
7.
Remedial measures:
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
b)
Mandatory return of the Certificate of Eligibility to Provide Data Platform
Services in respect of the violation prescribed in Point dd Clause 3 of this
Article;
c)
Mandatory application of technical measures to ensure data safety and security
and the safe operation of the data platform in respect of the violations
prescribed in Points b, g, p, q, and r Clause 2 of this Article;
d)
Mandatory application of measures to isolate, block, or control data sources,
information systems, accounts, or devices at risk of continuing to conduct
unlawful data transactions in respect of the violations prescribed in Points a,
b, and c Clause 3, Clause 4, and Point g Clause 5 of this Article;
dd)
Mandatory retention and full provision of system logs, transaction histories,
access histories, data processing histories, and relevant documents at the
request of competent authorities in respect of the violations prescribed in
Points n and q Clause 2, Points g, l, m, and n Clause 3, and Clause 4 of this
Article;
e)
Mandatory remittance of illegal gains obtained from committing the violations
prescribed in Clauses 3, 4, and 5 of this Article;
g)
Mandatory withdrawal and destruction of forged or untruthful documents in
respect of the violation prescribed in Point d Clause 3 of this Article;
h)
Mandatory cancellation of listings or termination of transactions involving
data or data products and services that fail to satisfy transaction conditions
in respect of the violations prescribed in Points c, k, and l Clause 2, Point h
Clause 3, and Points a, b, c, d, and dd Clause 4 of this Article;
i)
Mandatory connection, interconnection, and full update of transaction data and
information concerning Written Certifications of Rights to Utilize and Use Data
with the National Data Platform in respect of the violations prescribed in
Point i Clause 2 and Point n Clause 3 of this Article;
k)
Mandatory restoration, supplementation, and full update of dossiers, electronic
contracts, information, logs, and transaction histories in respect of the
violations prescribed in Points n and q Clause 2 and Points m and n Clause 3 of
this Article.
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
1.
A fine ranging from VND 20.000.000 to VND 40.000.000 shall be imposed for any
of the following violations:
a)
Failing to establish, implement, or maintain data protection measures in
accordance with the plan appraised by a competent authority;
b)
Failing to retain service dossiers or logs of data intermediation activities as
prescribed;
c)
Failing to fulfill obligations to authenticate users’ identities in accordance
with the law on e-identification and authentication;
d)
Failing to disclose, or incompletely or inaccurately disclosing, the scope and
methods of provision and prices of data intermediation services on the data
platform;
dd)
Failing to provide, or incompletely providing, results of the inspection,
assessment, or appraisal of data or data products and services to the Seller,
the data platform service provider, or a competent authority as prescribed;
e)
Failing to disclose its status as a Seller when concurrently participating in
the data platform as a Seller;
g)
Failing to fully disclose rights or benefits related to any party participating
in a transaction before providing data intermediation services;
h)
Failing to provide information, documents, dossiers, or service provision
results at the request of a data platform service provider or competent
authority.
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
a)
Providing data intermediation services without satisfying the conditions
concerning personnel, equipment, physical facilities, confidentiality plans, or
technical plans prescribed by law;
b)
Failing to ensure that data are accessed by the proper entities, for the proper
purposes, and within the proper scope under the service provision contract;
c)
Failing to control, monitor, detect, or prevent unauthorized access or data
processing activities on the data intermediation platform;
d)
Failing to provide, or incompletely providing, assistance in or inspection,
assessment, or appraisal of dossiers and data or data products and services
within the agreed scope of services;
dd)
Storing data beyond the necessary period or processing data beyond the
permitted scope;
e)
Failing to notify affected organizations and individuals of a data breach as
prescribed upon the occurrence of a data leakage or loss incident;
g)
Failing to ensure independence, objectivity, accuracy, truthfulness, or
transparency during the inspection, assessment, or appraisal of data or data
products and services;
h)
Providing inspection, assessment, or appraisal results that are inaccurate,
untruthful, non-objective, or inconsistent with the information or documents
used for the inspection, assessment, or appraisal;
i)
Inspecting, assessing, or appraising data or data products and services
directly provided by the data intermediation service provider in its capacity
as a Seller, or transactions in which such provider has related rights or
benefits;
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
3.
A fine ranging from VND 60.000.000 to VND 80.000.000 shall be imposed for any
of the following violations:
a)
Providing data intermediation services without being issued the Certificate of
Eligibility to Trade in Data Intermediation, Analysis, and Summary Products and
Services as prescribed;
b)
Continuing to provide data intermediation services after the Certificate of
Eligibility to Trade in Data Intermediation, Analysis, and Summary Products and
Services has been revoked or has expired;
c)
Using an issued Certificate of Eligibility to Trade in Data Intermediation,
Analysis, and Summary Products and Services for improper purposes or beyond its
permitted scope;
d)
Providing forged or untruthful documents in an application for issuance,
reissuance, or replacement of the Certificate of Eligibility to Trade in Data
Intermediation, Analysis, and Summary Products and Services where the violation
is not liable to criminal prosecution;
dd)
Failing to comply with a competent state agency’s request to temporarily cease
or suspend operations or remedy a violation;
e)
Transferring core data or important data to a third party without the consent
of data subjects or without satisfying the conditions prescribed by law;
g)
Taking advantage of data intermediation activities to create an unfair
competitive advantage, unlawfully influence transaction results, or infringe
upon the lawful rights and benefits of parties participating in transactions.
4.
A fine ranging from VND 80.000.000 to VND 100.000.000 shall be imposed for any
of the following violations:
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
b)
Providing data intermediation services that affect or pose a risk of seriously
affecting national defense, national security, social order and safety, social
ethics, or community health;
c)
Legitimizing unlawfully collected data, concealing the origin of data, or
fabricating evidence during data intermediation activities.
5.
Additional penalties
a)
Fixed-term deprivation of the right to use the Certificate of Eligibility to
Trade in Data Intermediation, Analysis, and Summary Products and Services for a
period of 6 to 12 months in respect of the violations prescribed in Points c,
dd, e, and g Clause 3 and Clause 4 of this Article;
b)
Confiscation of exhibits and means of administrative violations used to commit
the violations prescribed in Point d Clause 3 and Points a, b, and c Clause 4
of this Article.
6.
Remedial measures
a)
Mandatory deletion or destruction of data unlawfully collected, processed,
utilized, shared, purchased, sold, transacted, or used in respect of the
violations prescribed in Point e Clause 3 and Points a and c Clause 4 of this
Article;
b)
Mandatory return of the Certificate of Eligibility to Trade in Data Intermediation,
Analysis, and Summary Products and Services in respect of the violations
prescribed in Points b and d Clause 3 of this Article;
c)
Mandatory application of technical measures to ensure data safety and security
and the safe conduct of data intermediation activities in respect of the
violations prescribed in Points b and c Clause 2 of this Article;
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
dd)
Mandatory notification of the data incident, its consequences, and remediation
results to data subjects and other relevant organizations and individuals in
respect of the violation prescribed in Point e Clause 2 of this Article;
e)
Mandatory remittance of illegal gains obtained from committing the violations
prescribed in Clauses 3 and 4 of this Article;
g)
Mandatory withdrawal and destruction of forged or untruthful documents in
respect of the violation prescribed in Point d Clause 3 of this Article;
h)
Mandatory full and accurate disclosure of the scope and methods of service
provision, service prices, status of participation in transactions, and related
rights and benefits in respect of the violations prescribed in Points d, e, and
g Clause 1 of this Article;
i)
Mandatory full and accurate provision of inspection, assessment, and appraisal
results, information, documents, dossiers, and service provision results in
respect of the violations prescribed in Points dd and h Clause 1 and Point h
Clause 2 of this Article;
k)
Mandatory cancellation of inspection, assessment, or appraisal results that
fail to ensure independence, objectivity, accuracy, or truthfulness in respect
of the violations prescribed in Points g, h, and i Clause 2 of this Article;
l)
Mandatory application of confidentiality measures and withdrawal or deletion of
information and data that have been disclosed or used unlawfully in respect of
the violation prescribed in Point k Clause 2 of this Article.
Article 25. Violations of regulations on National Data Development Fund
1.
A fine ranging from VND 20.000.000 to VND 40.000.000 shall be imposed on an
organization or individual receiving loans, support, or investment from the
National Data Development Fund for committing any of the following violations:
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
b)
Providing inaccurate, untruthful, or unlawful information or documents
concerning the borrowing or use of support or investment capital from the
National Data Development Fund;
c)
Failing to fulfill, or incompletely fulfilling, commitments or obligations
under agreements concluded with the National Data Development Fund and relevant
parties, except for the violations prescribed in Clause 2 of this Article.
2.
A fine ranging from VND 40.000.000 to VND 60.000.000 shall be imposed on an
organization or individual receiving loans, support, or investment from the
National Data Development Fund for committing any of the following violations:
a)
Using loan, support, or investment capital for improper purposes or for
contents other than those approved by competent authorities;
b)
Transferring, lending, leasing, or permitting another organization or
individual to use support or investment capital from the National Data
Development Fund contrary to the law or the contents approved by competent
authorities.
3.
Additional penalty
Suspension
from participation in programs or projects supported by the National Data
Development Fund for a period of 3 to 6 months in respect of the violation
prescribed in Point a Clause 2 of this Article.
4.
Remedial measures
a)
Mandatory supplementary provision or correction of information and documents in
respect of the violations prescribed in Points a and b Clause 1 of this Article;
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
c)
Mandatory withdrawal and cancellation of forged or untruthful documents in
respect of the violation prescribed in Point b Clause 1 of this Article;
d)
Mandatory remittance of illegal gains obtained from committing the violations
prescribed in Clause 2 of this Article.
Article 26. Violations of regulations on controlled testing activities
in data construction, development, protection, administration, processing, and
use
1.
A fine ranging from VND 10.000.000 to VND 20.000.000 shall be imposed for any
of the following violations:
a)
Failing to develop or promulgate, or failing to fully retain, a controlled
testing plan as prescribed;
b)
Failing to comply, or incompletely complying, with periodic or ad hoc reporting
requirements or to provide information concerning the testing process to the
authority that issued the Certificate of Participation in Controlled Testing;
c)
Failing to conduct periodic risk assessments in accordance with the approved
testing plan;
d)
Failing to disclose, or incompletely or inaccurately disclosing, mandatory
information for protecting users of products and services during testing;
dd)
Failing to report incidents or serious risks arising during testing within the
prescribed time limit.
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
a)
Conducting controlled testing activities without being issued the Certificate
of Participation in Controlled Testing as prescribed;
b)
Conducting testing beyond the geographical scope, duration, scale, or subjects
approved in the Certificate of Participation in Controlled Testing without
obtaining approval from a competent authority for the adjustment;
c)
Failing to prepare an application for adjustment of the controlled testing plan
when adjusting its contents as prescribed;
d)
Failing to arrange the receipt and settlement of users’ complaints or feedback
in accordance with the testing plan or at the request of a competent authority;
dd)
Failing to implement measures to ensure data safety and protect the lawful
rights and benefits of users of products and services during testing.
3.
A fine ranging from VND 40.000.000 to VND 60.000.000 shall be imposed for any
of the following violations:
a)
Intentionally preparing or providing false information or concealing or erasing
contents in an application for the issuance, adjustment, extension, or
termination of controlled testing activities;
b)
Continuing testing after the testing period or its extended period has expired
without approval from a competent authority;
c)
Failing to comply with a competent authority’s request to temporarily cease or
suspend operations or revoke the Certificate of Participation in Controlled
Testing;
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
dd)
Allowing an incident to occur during testing that causes significant damage to
users’ lawful rights and benefits or seriously disrupts the operation of an
information system where the violation is not liable to criminal prosecution.
4.
A fine ranging from VND 60.000.000 to VND 80.000.000 shall be imposed for any
of the following violations:
a)
Using experimental products or services to process core data or important data
beyond the approved scope, purposes, or conditions;
b)
Taking advantage of controlled testing activities to conceal or facilitate acts
infringing upon data security, cyber information safety, or the lawful rights
and benefits of data subjects;
c)
Failing to comply with a competent authority’s request to apply measures to
ensure data safety, restore systems, or remedy consequences following a serious
incident during testing.
5.
Additional penalties
a)
Fixed-term deprivation of the right to use the Certificate of Participation in
Controlled Testing for a period of 3 to 12 months in respect of the violation
prescribed in Point b Clause 3 and the violations prescribed in Points a and b
Clause 4 of this Article;
b)
Suspension of data connection, sharing, utilization, and use for a period of 3
to 6 months in respect of the violation prescribed in Point dd Clause 2, the
violations prescribed in Points d and dd Clause 3, and the violations
prescribed in Clause 4 of this Article;
c)
Suspension of database administration and operation for a period of 6 to 9
months in respect of the violations prescribed in Clause 4 of this Article;
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
6.
Remedial measures
a)
Mandatory deletion or destruction of results and data collected or processed
contrary to regulations during testing in respect of the violation prescribed
in Point a Clause 4 of this Article;
b)
Mandatory remittance of illegal gains obtained from committing the violations
prescribed in Points a and b Clause 4 of this Article.
Chapter III
COMPETENCE TO
IMPOSE ADMINISTRATIVE PENALTIES
Article 27. Competence of Presidents of People’s Committees to impose
administrative penalties
1.
Presidents of People’s Committees of communes shall be entitled to:
a)
Issue warnings;
b)
Impose fines of up to VND 50.000.000 on individuals and up to VND 100.000.000
on organizations;
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
d)
Confiscate exhibits and means of administrative violations;
dd)
Apply the remedial measures prescribed in Clause 3 Article 4 of this Decree.
2.
Presidents of People’s Committees of provinces shall be entitled to:
a)
Issue warnings;
b)
Impose fines of up to VND 100.000.000 on individuals and up to VND 200.000.000
on organizations;
c)
Impose fixed-term deprivation of the right to use licenses or practicing
certificates or fixed-term suspension of operations;
d)
Confiscate exhibits and means of administrative violations;
dd)
Apply the remedial measures prescribed in Clause 3 Article 4 of this Decree.
Article 28. Competence of People’s Public Security to impose penalties
for administrative violations
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
a)
Issue warnings;
b)
Impose fines of up to VND 10.000.000 on individuals and up to VND 20.000.000 on
organizations;
c)
Confiscate exhibits and means of administrative violations whose value does not
exceed twice the maximum fine prescribed in Point b of this Clause.
2.
Heads of commune-level Public Security offices shall be entitled to:
a)
Issue warnings;
b)
Impose fines of up to VND 50.000.000 on individuals and up to VND 100.000.000
on organizations;
c)
Impose fixed-term deprivation of the right to use licenses or practicing
certificates or fixed-term suspension of operations;
d)
Confiscate exhibits and means of administrative violations;
dd)
Apply the remedial measures prescribed in Clause 3 Article 4 of this Decree.
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
a)
Issue warnings;
b)
Impose fines of up to VND 80.000.000 on individuals and up to VND 160.000.000
on organizations;
c)
Impose fixed-term deprivation of the right to use licenses or practicing
certificates or fixed-term suspension of operations;
d)
Confiscate exhibits and means of administrative violations;
dd)
Apply the remedial measures prescribed in Clause 3 Article 4 of this Decree.
4.
Heads of Immigration Divisions of provincial-level Public Security have the
competence to impose penalties prescribed in Clause 3 of this Article and may
decide to impose expulsion.
5.
Directors of provincial-level Public Security shall be entitled to:
a)
Issue warnings;
b)
Impose fines of up to VND 100.000.000 on individuals and up to VND 200.000.000
on organizations;
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
d)
Confiscate exhibits and means of administrative violations;
dd)
Impose expulsion;
e)
Apply the remedial measures prescribed in Clause 3 Article 4 of this Decree.
6.
The Director of the National Data Center, Director of the Police Department for
Administrative Management of Social Order, and Director of the Department of
Cybersecurity shall be entitled to:
a)
Issue warnings;
b)
Impose fines of up to VND 100.000.000 on individuals and up to VND 200.000.000
on organizations;
c)
Impose fixed-term deprivation of the right to use licenses or practicing
certificates or fixed-term suspension of operations;
d)
Confiscate exhibits and means of administrative violations;
dd)
Apply the remedial measures prescribed in Clause 3 Article 4 of this Decree.
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
Article 29. Competence of Inspectorates to impose penalties
1.
Inspectors of the Ministry of National Defense of Vietnam and the Ministry of
Public Security of Vietnam and inspectors of the Government Cipher Committee
shall be entitled to:
a)
Issue warnings;
b)
Impose fines of up to VND 10.000.000 on individuals and up to VND 20.000.000 on
organizations;
c)
Confiscate exhibits and means of administrative violations whose value does not
exceed twice the maximum fine prescribed in Point b of this Clause.
2.
Heads of inspectorate delegations of inspectorates of provincial-level Public
Security and the Government Cipher Committee, and heads of inspectorate
delegations at the military-zone level and of the Hanoi Capital Command shall
be entitled to:
a)
Issue warnings;
b)
Impose fines of up to VND 50.000.000 on individuals and up to VND 100.000.000
on organizations;
c)
Confiscate exhibits and means of administrative violations;
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
3.
The Chief Cipher Inspector, Chief Defense Inspectors of military zones, Chief
Defense Inspector of the Hanoi Capital Command, and Chief Inspectors of
provincial-level Public Security shall be entitled to:
a)
Issue warnings;
b)
Impose fines of up to VND 80.000.000 on individuals and up to VND 160.000.000
on organizations;
c)
Impose fixed-term deprivation of the right to use licenses or practicing
certificates or fixed-term suspension of operations;
d)
Confiscate exhibits and means of administrative violations;
dd)
Apply the remedial measures prescribed in Clause 3 Article 4 of this Decree.
4.
Chief Inspectors of the Ministry of National Defense of Vietnam and the
Ministry of Public Security of Vietnam and heads of inspectorate delegations
established by the Chief Inspectors of the Ministry of National Defense of
Vietnam and the Ministry of Public Security of Vietnam shall be entitled to:
a)
Issue warnings;
b)
Impose fines of up to VND 100.000.000 on individuals and up to VND 200.000.000
on organizations;
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
d)
Confiscate exhibits and means of administrative violations;
dd)
Apply the remedial measures prescribed in Clause 3 Article 4 of this Decree.
Article 30. Competence of heads of inspection teams to impose
administrative penalties
1.
Heads of inspection teams established by heads of organizations affiliated with
ministries or ministerial agencies that perform state management tasks of such
ministries or ministerial agencies, and heads of inspection teams established
by heads of organizations affiliated with the Government Cipher Committee, have
the competence to impose penalties prescribed in Clause 2 Article 29 of this
Decree.
2.
Heads of inspection teams established by Ministers or heads of
ministerial-level agencies, and heads of inspection teams established by the
Head of the Government Cipher Committee, have the competence to impose
penalties prescribed in Clause 3 Article 29 of this Decree.
3.
Heads of inspection teams shall impose penalties within the inspection period
and in respect of violations detected during the inspection.
Article 31. Competence to make written records of administrative
violations
1.
Persons competent to impose administrative penalties prescribed in Articles 27,
28, 29, and 30 of this Decree have the competence to make written records of
administrative violations falling within their competence to impose penalties
in accordance with the Law on Handling of Administrative Violations and this
Decree.
2.
Civil servants and public employees performing official duties or assigned
tasks in the field of data; members of the People’s Army or People’s Public
Security; and persons engaged in cipher work who are performing official duties
or assigned tasks related to the field of data may make written records of
administrative violations detected within the scope of the functions, tasks,
entitlements, sectors, or geographical areas assigned to them for management or
inspection in accordance with the law.
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
Article 32. Delineation of competence to impose penalties
1.
Persons of the People’s Public Security competent to impose penalties may
impose administrative penalties and apply remedial measures for the
administrative violations prescribed in Chapter II of this Decree according to
the competence prescribed in Article 28 of this Decree and within the scope of
their assigned functions, entitlements, and tasks.
2.
Presidents of People’s Committees at all levels may impose administrative
penalties and apply remedial measures for the administrative violations
prescribed in Chapter II of this Decree within their respective local
management areas and according to the competence prescribed in Article 27 of
this Decree.
3.
Inspectorate officials holding titles competent to impose administrative
penalties may impose administrative penalties and apply remedial measures for
the administrative violations prescribed in this Decree within the scope of
their assigned tasks and official duties and according to the competence
prescribed in Article 29 of this Decree.
4.
Heads of inspection teams prescribed in Article 30 of this Decree may impose
administrative penalties and apply remedial measures for administrative
violations detected during inspections, within the scope of their assigned
tasks and entitlements, and according to the competence prescribed in Article
30 of this Decree.
Article 33. Inter-sectoral cooperation mechanism for imposing
administrative penalties in field of data
1.
State agencies competent to impose administrative penalties in the field of
data shall establish a cooperation mechanism with relevant agencies, including:
a)
Specialized agencies in the fields of information and communications, public
security agencies, justice agencies, inspectorates, and units managing
specialized sectors;
b)
Units managing or operating national databases, specialized databases, data
centers, and important information systems.
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
a)
Exchanging and sharing data concerning violations, technical monitoring
reports, and professional information serving investigation and handling;
b)
Cooperating inter-sectoral inspections and examinations where there are signs
of complex violations or violations involving multiple sectors;
c)
Assisting in remedying consequences and assessing risks to affected data
systems;
d)
Cooperating in providing proposals for amendments and improvements to the law where
difficulties or conflicts arise in handling data violations;
dd)
Developing processes for cooperation, information exchange, verification, and
joint handling of data violations.
3.
The agency taking charge of handling a violation shall consolidate the
cooperation results and submit periodic or ad hoc reports to the competent
authority.
Chapter IV
IMPLEMENTATION
PROVISIONS
Article 34. Entry into force
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
Article 35. Transitional provisions
1.
Administrative violations in the field of data that terminated before the
effective date of this Decree but are detected or remain under consideration or
settlement after this Decree comes into force shall be handled in accordance
with the Decree of the Government of Vietnam on administrative penalties and
relevant legislative documents that were effective when the violations were
committed.
Administrative
violations in the field of data that commenced before the effective date of
this Decree and remain ongoing when this Decree comes into force shall be
handled in accordance with this Decree.
2.
Where a decision on administrative penalties was issued or fully executed
before the effective date of this Decree, but the penalized individual or
organization continues to lodge a complaint, the matter shall be handled in
accordance with the Law on Handling of Administrative Violations, the Decree of
the Government of Vietnam on administrative penalties, and relevant legislative
documents that were effective when the decision on administrative penalties was
issued.
Article 36. Implementation responsibilities
1.
The Ministry of Public Security of Vietnam shall provide guidance on and
organize the implementation of this Decree.
2.
Ministers, Directors of ministerial agencies, Presidents of People’s Committees
at all levels, and relevant organizations and individuals shall implement this
Decree.
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
ON BEHALF OF THE GOVERNMENT
PP. PRIME MINISTER
DEPUTY PRIME MINISTER
Ho Quoc Dung