Fines of up to $1,570 for unauthorized consumer data sharing
Transferring consumer information to a third party without the consumer's consent as prescribed will also be fined.
The Government has issued Decree No 24/2025/ND-CP, dated February 21, 2025, stipulating increased penalties for administrative violations regarding consumer rights protection.
Specifically, regarding violations concerning the protection of consumer information, the decree stipulates a fine of VND20-30 million (nearly $783 – 1,150) against the following actions: Collecting and using consumer information without the consumer's consent as prescribed; and using consumer information that is inaccurate or does not conform to the notified purpose and scope.
A fine of VND30-40 million (nearly $1,150 – 1,570) will be applied to the following actions: Failing to take measures to ensure the safety and security of consumer information when collecting, storing, or using it, or failing to take measures to prevent actions that violate the safety and security of consumer information as prescribed.
Transferring consumer information to a third party without the consumer's consent as prescribed will also be fined VND30-40 million (nearly $1.150 – 1,570).
The decree also clearly states that the fine will be doubled if the information involved is sensitive personal data of the consumer. The fine will be quadrupled if the violation is committed by a large digital platform operator.
