In the past two years, the legal framework for data in Vietnam has shifted rapidly from a "protection" mindset to data governance throughout the life cycle. In just two months, the Government issued Decree 330/2026/ND-CP on sanctioning administrative violations in the field of cyber security and personal data protection and Decree 363/2026/ND-CP ("Decree 363") on sanctioning administrative violations in the field of data. Decree 363 was issued on September 19, 2026 and takes effect from November 11, 2026.
For many businesses, the fine may be the easiest part of the risk to quantify.
The notable point of Decree 363 is not only in the fines. Article 6 determines the maximum fine of 100 million VND for individuals; the fine for organizations is twice, or a maximum of 200 million VND. Meanwhile, Clause 3 of Article 4 stipulates 18 remedial measures that can directly impact data, systems, processes and business activities. Therefore, for many businesses, the fine may be the easiest part of the risk to quantify; the more difficult part to predict lies in what to do after the violation has occurred.
1. How remedial measures for violations impact businesses
Clause 3, Article 4 of Decree 363 lists 18 remedial measures. These are not groups that are pre-classified by the Decree. However, from the perspective of impacts on businesses, these measures can be temporarily classified into four groups to better identify risks:
Group 1: Processing, recovering and adjusting data[1].
Group 2: Strengthen data governance systems, processes and mechanisms[2].
Group 3: Notifying, providing and processing information[3].
Group 4: Direct impact on economic interests, transactions or business conditions[4].
This grouping is only analytical and groups can intersect. For example, forced data deletion is both a data processing measure and can directly impact business operations if that data is the input of a product, algorithm or service. Similarly, the requirement to apply technical measures is not only a technological problem but can force businesses to change their operational processes.
Group 1 and Group 3 generally have a more defined scope of implementation, such as restore, correct, update data, or fulfill notification obligations. However, completing one measure does not mean that the enterprise has fulfilled all its obligations if the same act is subject to other remedial measures.
Group 2 is noteworthy in that the remediation does not stop at fixing a specific data. Businesses may have to fix vulnerabilities, apply data security measures, reclassify data, decentralize access, or complete the process. At that time, the cost of the breach shifts from a payable to a requirement to change the way the system is designed and operated.
Meanwhile, Group 4 has the most obvious level of business impact. Depending on the behavior, the enterprise may have to pay back illegal profits, return the certificate of eligibility for business or return the capital that has been used for improper purposes. Compliance costs can therefore be extended to opportunity costs, interrupted revenue or affect the ability to continue a certain business activity. It is necessary to distinguish these measures from additional sanctions such as suspension of operations, which are separately regulated by the Decree.
2. Why are remedies more worrisome than fines?
Fines have a ceiling; remedial costs do not have a corresponding "ceiling".
Fines are determined according to the framework of each act and are limited by the maximum level in Article 6 of Decree 363. Therefore, when identifying acts and violators, it can be relatively easy for businesses to estimate the fine directly. Remedial measures are different: The Decree determines what must be done, but the cost of implementation depends on the data architecture, the size of the system, and the spread of the violation.
The same obligation to delete, restore or correct data, the actual cost may be very different between a centralized storage enterprise and an enterprise whose data is backed up, synchronized and distributed across multiple systems or multiple providers. The larger the data scale and the more distributed the data architecture, the more likely the cost of "post-violation" remediation is to be separated from the fine level stated in the Decree.
A single breach can create a whole chain of remedial obligations.
Decree 363 allows the application of one or more remedial measures depending on each act. Therefore, the risk does not necessarily end when the business completes a technical operation. Data deletion may be accompanied by a notification obligation; data recovery may be accompanied by a remedy for vulnerabilities; illegal use of data may also entail the obligation to return illegal profits.
Article 14 is a clear example. For acts of deliberately analyzing and synthesizing data from illegal sources, leaked data or data that is not allowed to be processed, in addition to a fine of between VND 80 million and VND 100 million for individuals (the fine for organizations applied under Article 6), violators may also be forced to delete or destroy data or analysis and synthesis results illegally created and used and return illegal profits[5].
In reality, "data deletion" may not be as simple as deleting a file. If the data has been backed up, synced to another system, used to create reports, analytical models, or derivative products, the business must first know where the data is, how it has been processed, and what results have been produced. In this case, the ability to trace the data becomes a condition for fulfilling the obligation to remedy itself.
Similarly, for some acts related to databases and information systems, Article 7 allows the simultaneous application of obligations such as restoring data or its original condition, applying technical measures to ensure safety, notifying of incidents and remedial results, or removing applications and software used for violations. This is why the cost of a violation cannot be read only from the "penalty" column.
Source: Facebook of the Ministry of Public Security
Fixes can touch the assets and revenue-generating infrastructure itself.
Unlike fines – which are essentially financial obligations – many remedial measures directly impact the data and systems that businesses are using to do business. For digital businesses, data can be product inputs, analytics models, scoring systems, CRM, marketing, logistics, or AI models. Forcible deletion, adjustment, or discontinuation of a data set can therefore directly affect the operability of a product or service.
The risk is even greater when businesses are unable to determine the origin and path of data. Without knowing where a data set has been copied to, who it was shared with, in what systems it is used in, or what results it produces, the implementation of corrective decisions can be lengthy and require the simultaneous involvement of legal, information technology, information security, data governance, and business departments.
Therefore, the worrying point is not necessarily an individual remedy, but the gap between the legal requirement to be implemented and the actual capacity of the enterprise to implement that requirement quickly, accurately and without disrupting business activities.
3. Enterprises need to prepare for remedying the consequences of violations
Decree 363 raises an important governance issue: if an enterprise is forced to delete, restore, correct or trace a data set, does it know where that data is located, what systems it has gone through, and who is responsible?
From this perspective, compliance is not only about preventing violations, but also about building capacity to be ready to remedy them. To do this, businesses should:
Data mapping: Businesses need to identify the data groups that are collecting, creating, storing, sharing and processing; storage locations; related systems; subjects with access and important data transfer flows.
Ensuring traceability: The system should enable the identification of the origin, location, processing history and, to the extent feasible, copies or results arising from the data. This is the foundation for making requests for deletion, correction, update, or restoration without having to review the entire system from scratch.
Test for remediation in practice: Don't just evaluate whether the system is "secure". Businesses need to test whether they can isolate a data set, revoke access, restore data, process backups, or implement the necessary technical measures in a reasonable time.
Develop a remediation playbook: The process should determine how to localize violations, preserve necessary information, decide on handling measures, fulfill notification obligations, and record evidence of the remediation process.
Clearly define internal responsibilities: Legislation cannot fix a data incident on its own. Businesses should delineate in advance the roles of legal, information technology, information security, data governance, and business departments; at the same time, identify the focal point who has the right to make decisions when it needs to be handled quickly.
Decree 363 shows that the cost of a data breach cannot be measured only by the amount stated in the sanctioning decision. For businesses with large and complex data systems, the maximum penalty under the Decree may be the most quantifiable risk; more difficult to predict are the costs of tracing, deleting, restoring data, fixing the system, changing processes, and the possibility of disrupting business operations.
Therefore, the important question is not only "how much will be fined if violated?", but also "if forced to fix it, does the business know where the data is, how to handle it, and who can do it right away?". The ability to answer that question reflects the essence of the level of perfection of the data management system.
Lawyer Nguyen Van Phuc - Nguyen Thi Bao Khanh
HM&P Law Firm
