On November 11, 2026, Decree 363/2026/ND-CP on sanctioning administrative violations in the field of data ("Decree 363") officially took effect. For businesses, the issue worth noting is not only the new fines, but also the many data processing activities that are taking place on a daily basis: from collecting, storing, decentralizing access to hiring suppliers and transferring data abroad are now placed under a more specific sanction mechanism.
According to the Data Law 2024, "data" is understood as data about things, phenomena, events, expressed in digital form, including one or a combination of sounds, images, digits, writing and symbols. The scope of data within this legal framework may include data on business activities, transactions, finance, production, engineering, customers, personnel or other data that enterprises create, manage and process in digital form.
One of the noteworthy points of Decree 363 is that sanctioned violations are regulated at many different stages in the data processing process
With the scope of regulation for digital data in general, Decree 363 requires businesses to recognize data compliance more broadly than personal data protection activities. Personal data in digital form can simultaneously fall under the concept of data under the Data Law, but Decree 363 does not regulate administrative violations that fall within the scope of Decree 330/2026/ND-CP on cybersecurity and personal data protection ("Decree 330"). Therefore, for activities related to digital personal data, enterprises need to specifically identify obligations and violations to determine the corresponding sanctioning mechanism, instead of only relying on the type of data to choose Decree 330 or Decree 363.
Notably, Article 35 of Decree 363 stipulates that acts that started before November 11, 2026 but are still ongoing when the Decree takes effect will be handled according to Decree 363. Therefore, the time before November 11, 2026 is not only the preparation period for new obligations but also the time when businesses need to identify and handle behaviors that are at risk of continuing. On that basis, this article focuses on risk groups that need to be prioritized for review.
1. Data governance throughout the data lifecycle
One of the noteworthy points of Decree 363 is that sanctioned violations are regulated at many different stages in the data processing process, from collection, creation, storage to data access, connection, sharing and analysis. Accordingly, sanctioning risks in the field of data not only arise from inappropriate use or sharing of data, but can also stem from shortcomings in the internal governance and control mechanisms of enterprises.
Specifically, acts such as failing to promulgate the process of collecting and creating data, failing to carry out the required assessment or processing data beyond the permitted scope and purpose may be fined from 20 to 40 million VND for individuals; the fine for organizations is twice the fine for individuals according to Article 6 of Decree 363. In addition to the obligations at the stage of collection and creation, the Decree also sets requirements for classification, storage, data management, decentralization of access rights, connection control, sharing and maintenance of processing logs. Therefore, enterprises should not only check whether there are policies and processes in place, but also clarify: what data the enterprise has; who has the right to access and process; and can prove the history of data processing when requested by the competent authority.
2. Cross-border data transfer and processing
Decree 363 shows that the completion of the impact assessment dossier does not mean that the enterprise has completed all compliance obligations related to cross-border data transfer and processing activities. The risk lies not only in the lack of dossiers but also in the distance between the prepared dossier and the actual operating data flow. Enterprises must ensure that data transfer and processing activities do not exceed the scope, type of data, volume, frequency, duration and contents that have been declared, assessed or approved. When changes arise that are subject to update, the impact assessment dossier must also be amended and supplemented accordingly.
In addition, enterprises must ensure the storage of records, establish appropriate written agreements between the transferor and the data recipient, and apply technical and managerial measures to ensure data security during cross-border transfer and processing. Failure to comply with these requirements, especially for core data and important data, not only gives rise to sanctioning risks but in some cases can also lead to the suspension of cross-border data transfer and processing activities from 03 to 12 months.
3. Data risk management needs to be established on a verifiable basis
Decree 363 stipulates sanctions for shortcomings in the mechanism for identifying and managing data risks and supervising data processing activities, in which some acts can be sanctioned immediately from failing to establish or implement management measures as required by law.
Accordingly, enterprises may be sanctioned for acts such as failing to establish a mechanism to identify, assess and warn of risks in data processing or failing to develop an incident response plan. For core data and important data, Decree 363 also sets specific requirements related to the duration of keeping processing activity logs for at least 06 months, periodic risk assessment and periodic contingency plan rehearsals. In addition, enterprises must also ensure the traceability and transparency of data processing activities and provide information, system logs or monitoring reports when requested by competent authorities.
The requirements for logs, monitoring reports, risk assessment records and incident-related information show that risk management cannot stop at internal policies and processes. Businesses must also implement in a way that can be checked, traced and proven in practice. In other words, having a process on paper does not mean compliance. Failure to provide monitoring logs and reports as required or concealing or falsifying monitoring data and system logs is also a sanctioned act under Decree 363.
Source: Government News
4. Entrusting data processing: handing over data does not mean assigning responsibility
Hiring a service provider or a third party to process data does not exclude the responsibility of the entrusting party's control. Decree 363 therefore sets requirements for both the entrustment relationship and the outsourced data processing process. This activity must be established on the basis of an appropriate contract or agreement, which fully stipulates the scope, duration of processing, confidentiality obligations and responsibilities of the parties. Entrusting other organizations and individuals to process data without a contract or entrustment agreement may result in a fine of between VND 80 and 120 million for the organization. For core data and important data, the entrusting party must also verify the entrustee's ability to ensure data security before entrusting the processing.
The entrusting party's control responsibilities continue to be set throughout the entrusting party's data processing process. Depending on the specific act, failure to apply data security measures or failure to take measures to prevent misuse, leakage, and misuse of data may lead to significant fines; some acts may also be subject to the suspension of data processing activities. Therefore, enterprises need to check not only the contract but also the supplier due diligence mechanism, supervision during implementation, coordination in troubleshooting, and the ability to return, delete or restore data when the trust relationship is terminated.[1]
5. What do businesses need to do before November 11, 2026?
Decree 363 is about to come into effect. In order to be proactive in compliance, businesses should review data management and processing activities in practice, especially with groups of obligations that may give rise to sanctions risks under the Decree.
First, catalog and review data governance throughout the entire processing lifecycle. Businesses need to identify the data groups that are creating, collecting, storing, accessing, connecting, sharing, and processing; storage location; subjects with access rights; mechanisms for classification, decentralization, and logging. The focus is not only on having a process but also on the ability to demonstrate that the process is being operated in practice, especially for core data and critical data.
Second, review the risk management mechanism and the suppliers and third parties that are processing the data. Contracts and trust agreements need to be compared with the requirements of the scope, processing period, confidentiality and responsibilities of the parties. At the same time, businesses need to check the mechanism for supplier capacity appraisal, risk assessment, data security measures, log management, incident response coordination and the ability to retrieve, delete, return or restore data when needed.
Third, compare the actual cross-border data transfer and processing activities with the dossiers made. In case there is cross-border core data or important data, enterprises need to check the conformity between the impact assessment dossier and the actual data flow, including the scope, type of data, volume, frequency, duration, transferor, recipient and technical and management measures. The gap between the dossier and the actual operation is a point that needs to be prioritized for identification and processing.
Fourth, identify and remedy acts that are at risk of continuing through the effective date of the Decree. According to Article 35 of Decree 363, acts that have ended before November 11, 2026 but are detected or considered after this time shall be handled according to the regulations in effect at the time the act is committed. Conversely, if the act began before November 11, 2026 but continues when Decree 363 takes effect, Decree 363 will be applied for handling.
This transitional regulation makes the review before November 11, 2026 mean that enterprises not only need to prepare for new obligations but also need to handle ongoing behaviors to limit the risk of entering the sanctions mechanism of Decree 363.
Decree 363 not only adds a new penalty system, but also puts the actual data management ability of enterprises under a more specific inspection and sanction mechanism. Before November 11, 2026, what needs to be done should not only be to supplement policies or processes. Businesses need to know where the data is, who is processing it, whether the cross-border data flow is consistent with the established records, whether the supplier is controlled, and whether the system is capable of proving compliance. In data governance, the gap between paper-based processes and actual operations is where sanctions risks are most likely to arise.
[1] Point d, Clause 2, Point c, Clause 3 and Clause 4, Article 21 of Decree 363.
