Decree on Administrative Sanctions against Cybersecurity and Personal Data Protection violations

Vietnam's Ministry of Justice has recently released a dossier regarding the examination of the Draft Decree on Cybersecurity Administrative Sanctions (Draft CASD), which has been developed by the Ministry of Public Security (MPS) and underwent multiple rounds of public consultations. The Draft CASD delineates various violations, along with their corresponding penalties and remedies in the realms of cybersecurity and personal data protection.

This marks the fourth iteration of the Draft CASD, following the publication of its third version on 31 May 2023. Key highlights from the latest version include:

• The majority of cybersecurity and personal data protection violations from the third version of the Draft CASD are maintained, with consistent monetary fines (up to VND 200 million for companies, with doubling for repeat offences, or in certain cases resulting in data breaches, fines can amount to 5% of the companies' revenue from the previous financial year).
• A novel addition proposes the imposition of temporary or fixed-term suspension (lasting 1 to 3 months) on data processing, in addition to measures such as revocation of relevant business licenses and confiscation of violating assets.
• The CASD has been proposed to take effect on 1 June 2024.
• Violations occurring prior to the promulgation of the CASD may still face sanctions in accordance with the CASD once the Decree takes effect.

The cybersecurity and personal data protection regulations were introduced through the Cybersecurity Law in 2018, Decree 53/2022/ND-CP in 2022, and Decree 13/2023/ND-CP in 2023, lacking sufficient enforcement mechanisms. The nearing completion of the Draft CASD suggests that the enforcement and sanctioning aspects of the Cybersecurity Law and PDPD are approaching fruition. Given this scenario, it's crucial for companies to take proactive steps. At KPMG, our cybersecurity and personal data protection expert team is collaborating closely with companies across different sectors to help them establish comprehensive compliance frameworks. Should you have any inquiries or need further assistance, please feel free to reach out to us without hesitation.