Prohibition of buying and selling personal data, violations will be fined 10 times the amount of money collected

DNVN - The draft Law on Personal Data Protection introduces many "strong" regulations, including an absolute ban on the buying and selling of data and the possibility of a fine of up to 10 times the amount of profit from the violation.

On the morning of June 5, the National Assembly Standing Committee continued its 46th Session with the discussion of the draft Law on Personal Data Protection (DLCN).

The report on explanation, acceptance and revision presented by Lieutenant General Le Tan Toi - Chairman of the National Defense, Security and Foreign Affairs Committee, said that the draft has expanded the scope of application.

Lieutenant General Le Tan Toi - Chairman of the National Assembly's Committee on National Defense, Security and Foreign Affairs.

Accordingly, the law not only regulates the processing of personal data in the network environment, but also in the physical environment. At the same time, the law will apply to foreign organizations and individuals if they have processing activities related to Vietnamese citizens' data.

Regarding the rights of data owners, the draft has been revised to be clear and consistent with international practice. The basic rights include being informed, consenting, accessing and correcting, requesting deletion of data, withdrawing consent, requesting limitation of processing, etc.

Notably, the draft supplements and clarifies prohibited acts. In particular, the buying and selling of personal data is absolutely prohibited, except in cases where there are other legal provisions. Acts such as unauthorized disclosure, appropriation, disclosure, and loss of personal data are also prohibited.

Regarding handling violations, the draft clearly stipulates the principle that depending on the level and consequences, one may be subject to administrative sanctions or criminal prosecution. If damage is caused, the violating organization or individual must compensate.

The draft proposes very high fines for the trading of personal data. Specifically, the fine can be up to 10 times the amount of illegal profits. For violations of cross-border data transfer regulations, the maximum fine is 5% of the previous year's revenue.

For other violations, the maximum fine is VND3 billion. Individual violators will be fined half that of organizations. The Government will specify the fine level, the range of fines and the method of calculating illegal income.

Duy Loc

Source: https://doanhnghiepvn.vn/kinh-te/cam-mua-ban-du-lieu-ca-nhan-vi-pham-se-bi-phat-gap-10-lan-so-tien-thu-duoc/20250605103518107