VCI Legal – June 8, 2026

On 15 May 2026, the Government officially promulgated Decree No. 174/2026/ND-CP, which provides administrative sanctions in the fields of postal services, telecommunications, radio frequencies, electronic transactions, and information technology (the “Decree 174”). The Decree replaces previous regulatory provisions and establishes a comprehensive and stringent enforcement framework comprising both substantial monetary penalties and severe operational suspension measures. These sanctions are expected to have a direct and significant impact on technology enterprises, digital content providers, online service operators, and network infrastructure providers.

This article outlines the penalties applicable to selected violations relating to personal data protection, cybersecurity, the use of Internet services and social networking platforms, as well as acts involving civil cryptography under Decree 174..

KEY TAKEAWAYS

• Administrative fines under the Decree are imposed on legal entities. For individuals, the applicable fine is equal to 50% of the fine imposed on an organization for the same violation.
• Enhanced deterrence through supplementary sanctions: In addition to monetary penalties, enterprises may be subject to stringent enforcement measures, including the suspension of business operations or the revocation of licenses and permits for periods of up to 24 months, confiscation of instrumentalities and means used in the commission of violations, and the deportation of foreign individuals found to be in breach of the applicable regulations.
• Immediate preventive measures for serious violations: To promptly prevent acts that infringe upon national sovereignty, national interests, public order, social safety, or traditional cultural and moral values, competent authorities are empowered to temporarily suspend or seize the use of a “.vn” national domain name immediately upon detecting a serious violation.

KEY CONTENTS OF DECREE NO. 174/2026/ND-CP

1. Violations regarding information infrastructure for the application and development of information technology

• VND 100,000,000 to VND 140,000,000: For acts infringing upon the legitimate rights and interests of database owners.
• VND 140,000,000 to VND 170,000,000: For acts involving the destruction of information infrastructure.
• Supplementary measures: disgorgement of illegally obtained gains and restoration of the original condition prior to the violation.

2. Violations affecting users of information technology products and services

• VND 5,000,000 to VND 10,000,000: for concealing one’s identity or impersonating another organization or individual when transmitting information in cyberspace.
• VND 20,000,000 to VND 30,000,000: for failing to implement preventive measures or warning mechanisms to prevent children from accessing harmful online content.

• VND 30,000,000 to VND 50,000,000: (i) Creating, installing, or disseminating computer viruses or malicious software onto another person’s digital devices; or (ii) Producing or providing information technology products and services that promote obscenity, pornography, criminal activities, social vices, superstition, or conduct contrary to traditional cultural and moral values.

• Supplementary measures: onfiscation of exhibits and instrumentalities used in the commission of the violation and deportation of foreign offenders from the territory of Vietnam.
• Remedial measures: destruction of obscene or pornographic information technology products and services and restoration of systems or data affected by viruses or malicious software to their original condition.

3. Violations regarding responsibilities in utilizing social media services

• VND 20,000,000 to VND 30,000,000: for abusing social networking services to engage in any of the following acts:
• Providing or sharing fabricated, false, misleading, defamatory, or reputation-damaging information concerning agencies, organizations, or individuals;
• Providing, sharing, or disseminating content promoting social vices, prostitution, human trafficking, conduct contrary to national customs and traditions, or social morality;
• Providing or sharing content containing graphic descriptions of killings, assaults, accidents, horror, or other disturbing and violent acts;
• Providing, sharing, or distributing journalistic, literary, artistic, or other copyrighted works without the authorization of the intellectual property rights holder, or works that have not been licensed for circulation or have been prohibited from circulation;
• Advertising, promoting, or disseminating information relating to prohibited goods or services;
• Providing or sharing maps of Vietnam that inaccurately or incompletely depict the country’s national sovereignty;
• Providing or sharing hyperlinks directing users to prohibited online content.
• Failure by account owners, channel operators, community page administrators, or similar platform operators to prevent, remove, or disable access to unlawful content, content infringing upon the lawful rights and interests of organizations or individuals, or content adversely affecting children upon request of competent authorities.
• VND 30,000,000 to VND 50,000,000: for serious violations affecting ideological security and national interests, including acts such as distorting historical facts, denying revolutionary achievements, undermining national unity, promoting racial or gender discrimination, disclosing state secrets, or disseminating information causing public panic or social unrest.
• Remedial measures: mandatory removal of false, misleading, or unlawful content and mandatory suspension or disabling of accounts, community pages, community groups, and content channels used to commit the violation..

4. Violations regarding storage, leasing, transmission, provision, access, collection, processing, exchange, and use of information

• VND 10,000,000 to VND 20,000,000 for the following categories of violations:
  1. Breach of System Security and Data Integrity
• Unauthorized Interference with Information and Information Systems: Acts of accessing, using, disclosing, disrupting, or damaging information systems and digital data without the authorization of the lawful owner.
• Obstruction of Data Transmission: Unlawfully hindering the transmission of data over networks; engaging in unauthorized manipulation, deletion, alteration, or duplication of data that compromises the accuracy and integrity of the original information.
  2. Breach of Obligations to Protect Privacy Rights and Personal Data
• Failure to Exercise Due Care in Data Protection: Failure to establish or implement the necessary managerial and technical safeguards, resulting in the loss, theft, unauthorized disclosure, or destruction of personal information.
• Unlawful Processing and Exploitation of Data: Collecting, processing, or using information belonging to other organizations or individuals without obtaining valid consent, or utilizing such information for purposes inconsistent with applicable legal requirements.
• Breach of Confidentiality Obligations: Disclosing information classified as state secrets, private information, personal and family secrets, or failing to ensure confidentiality for entities leasing data storage infrastructuree.
  3. Lack of Coordination in State Administration and Law Enforcement
• Failure to Fulfil Content Control Obligations: Failure to implement measures to prevent, restrict, or remove unlawful content upon request by competent authorities when providing transmission services or leasing data storage infrastructure.
• Failure to Fulfil Identification and Monitoring Obligations: Failure to identify entities leasing storage services or failure to exercise due diligence in monitoring and supervising digital information in accordance with regulatory requirements.
• Obstruction of Investigative Activities: Failure to cooperate or coordinate with competent authorities in investigating unlawful acts arising during the operation of digital services.
  4. Abuse of Cyberspace to Infringe Upon Lawful Rights and Interests
• Defamation and Damage to Reputation: Using digital information to threaten, harass, distort facts, or disseminate defamatory statements that undermine the reputation of organizations or the honour and dignity of individuals.
• Dissemination of False or Misleading Information: Impersonating organizations or individuals for the purpose of distributing fabricated content, fraudulent information, or false statements.
• Commercialization or Promotion of Prohibited Content: Using digital information infrastructure to advertise, promote, or disseminate information concerning goods and services prohibited under applicable laws.
  5. Violation of the Secrecy of Correspondence and the Security of Communications
• Unlawful Interception of Correspondence and Electronic Communications: Engaging in the appropriation, seizure, interception, or intentional access to the contents of another person’s letters, telegrams, telex messages, facsimiles, or other forms of electronic communications during transmission.
• Illegal Interception or Recording of Communications: Engaging in the unauthorized listening to, monitoring of, or recording of telephone conversations or other forms of private communications
• VND 30,000,000 to VND 50,000,000 for the following violations: (i) Failing to ensure the confidentiality of private information transmitted via public telecommunications networks, or unlawfully disclosing private information relating to telecommunications service users; or (ii) Providing, exchanging, transmitting, storing, or using information and services containing gambling-related content or facilitating gambling activities; obscene, pornographic, superstitious, immoral content, or content contrary to the nation’s cultural traditions and social ethics.
• VND 50,000,000 to VND 70,000,000: (i) Unlawfully trading, transferring, purchasing, selling, or exchanging private information of telecommunications service users; or; (ii) Concealing one’s identity or electronic address, or impersonating the name or electronic address of another organization or individual when sending emails or electronic messages.
• VND 70,000,000 to VND 100,000,000 for providing, exchanging, transmitting, storing, or using digital information for the purpose of disseminating false or misleading information concerning the territorial sovereignty of the Socialist Republic of Vietnam.
• VND 50,000,000 to VND 70,000,000: for the following violations: (i) Propagating or inciting violence, or disseminating reactionary ideologies that do not yet constitute a criminal offence; or; (ii) Providing information or images that infringe upon national sovereignty; distort historical facts; deny revolutionary achievements; or insult the nation, distinguished historical figures, or national heroes.
• Supplementary Sanctions: Suspension or revocation of the right to use a social networking service licence for a period of up to 24 months; confiscation of exhibits and instrumentalities used in the commission of the administrative violation.
• Remedial Measures: Disgorgement of illegally obtained gains; Mandatory recovery or withdrawal of telecommunications numbers and numbering resources; Mandatory revocation or withdrawal of domain names used in connection with the violation.

5. Violations Relating to Business Activities in the Civil Cryptography Sector

• VND 20,000,000 to VND 30,000,000: for the following violations (i) Failure to manage, preserve, and maintain records and documentation relating to the technical solutions and technologies of civil cryptographic products in accordance with applicable laws; or (ii) Failure to establish, maintain, and safeguard records containing customer information, including the identity of customers, categories, quantities, and intended uses of civil cryptographic products and services; or (iii) Failure to submit, or submission of reports more than one month overdue, regarding the business operations of civil cryptographic products and services, including the export and import of civil cryptographic products
• VND 30,000,000 to VND 40,000,000: for failure to apply for amendments or supplements to a Licence for the Provision of Civil Cryptographic Products and Services following changes to the enterprise name or legal representative.
• VND 40,000,000 to VND 50,000,000: for the following violations: (i) Failure to continuously satisfy any of the conditions required for maintaining a Licence for the Provision of Civil Cryptographic Products and Services; or (ii) Failure to refuse the provision of civil cryptographic products or services upon discovering that an organization or individual has violated laws governing the use of such products or services, or has breached contractual commitments agreed with the licensed provider; or (iii) Use of civil cryptographic products or services supplied by an unlicensed provider without notifying the Government Cipher Committee.
• VND 50,000,000 to VND 60,000,000: for the following violations: (i) Providing inaccurate or misleading information in support of an application for a Licence for the Provision of Civil Cryptographic Products and Services; or (ii) Conducting business activities beyond the scope authorized under the relevant licence; or (iii) Refusing to provide competent state authorities with necessary information relating to encryption keys upon lawful request.
• VND 60,000,000 to VND 180,000,000: for conducting business activities involving civil cryptographic products and services without the required licence, depending on the value of the infringing goods, ranging from less than VND 50,000,000 to VND 300,000,000 or more.
• VND 80,000,000 to VND 100,000,000: for the following violations: (i) Failure to cooperate with, or facilitate, competent authorities in implementing operational or investigative measures upon request; or (ii) Failure to temporarily suspend or cease the provision of civil cryptographic products and services when required by competent authorities for the purposes of safeguarding national defence, national security, public order, and social safety.
• VND 100,000,000 to VND 120,000,000:for conducting business activities involving civil cryptographic products and services where the intended users or purposes of use may adversely affect national defence, national security, public order, or social safety
• Supplementary Sactions: Suspension or revocation of the Licence for the Provision of Civil Cryptographic Products and Services for a period of up to six (06) months; Suspension of business operations for a period of up to six (06) months; Confiscation of exhibits and instrumentalities used in the commission of the violation.
• Remedial Measures: Mandatory submission of reports on the business operations of civil cryptographic products and services; Mandatory establishment, maintenance, and protection of customer information records; Mandatory notification regarding the use of civil cryptographic products and services supplied by unlicensed providers; Mandatory disclosure of information relating to encryption keys as required by competent authorities; Disgorgement of illegally obtained gains.

LEGISLATIVE ASSESSMENT

• Decree No. 174/2026/ND-CP represents a significant shift toward a more stringent and proactive regulatory enforcement framework. Rather than relying solely on administrative fines, the Decree expands the authorities’ enforcement toolkit by introducing measures capable of directly restricting a company’s operational capacity, including domain name revocation, suspension of business activities, and long-term licence revocation.
• For enterprises operating in the digital services, information technology, online platform, and civil cryptography sectors, compliance with cybersecurity, information security, personal data protection, and privacy obligations has evolved from a best-practice standard into a mandatory legal requirement. The availability of severe supplementary sanctions, particularly operational suspension and licence revocation, demonstrates the increasingly deterrent nature of Vietnam’s digital regulatory regime and underscores the Government’s commitment to protecting the lawful rights and interests of users in cyberspace..

SOLUTIONS AND ACTIONS

1. Organizations should review and assess their technical infrastructure to ensure that data storage systems located in Vietnam comply with information security standards equivalent to, or exceeding, Level 3 Information Security Certification requirements under applicable regulations.
2. Organizations should implement automated data encryption measures and establish robust data classification frameworks. Internal procedures should also be developed to facilitate the automated deletion, destruction, or anonymization of data upon expiration of the applicable retention period or upon receipt of a lawful request from a data subject.
3. Organizations operating online platforms or digital services should integrate AI – driven monitoring tools into their content governance systems to detect, review, and prevent in real time the dissemination of false information, violent or pornographic content, unlawful materials, and visual content that infringes upon Vietnam’s territorial sovereignty or violates applicable laws.

About VCI Legal:

VCI Legal is an award-winning business law firm in Vietnam with a wide range of legal and corporate services, among other things, corporate, banking & finance, tax, labor & HR, real estate and dispute resolution with special focus on international investment disputes, We also offer our specialized type of service called “In-House Counsel Service” with the aim of assisting our clients in dealing with all types of internal and external issues arising from their day-to-day operations and business activities. With our offices in both Hanoi and Ho Chi Minh City, we have a tremendous depth of experience in providing well-reasoned and comprehensive legal advice to not only multinationals and Fortune 500 companies, but also small and medium enterprises.

Our professional team comprises one of the leading law firms in Vietnam with service quality highly recommended and acknowledged by international legal service reviewers such as: The Legal 500, AsiaLaw Profiles, IFLR, KPMG’s Tax Directors’ Handbook, Acquisition International, ACQ Global, Global Law Experts, Finance Monthly, and Chambers & Partners.

For many years, VCI Legal has been ranked among the top law firms in Vietnam for corporate, finance, insurance, taxation, employment, intellectual property and investment. With a “Can Do Attitude” combined with a “Know How” capacity, our firm is big enough to provide comprehensive legal support for any in-house legal matters, yet small enough to care about each of our clients. We undertake each engagement with the mindset of a long-term relationship, with the will to give whatever it takes to understand and fulfill your needs.

Ho Chi Minh City

Suite P7-42.18, Vinhomes Central Park, 720A Dien Bien Phu, Thanh My Tay Ward, Ho Chi Minh City, Vietnam

Tel.: (+84) 028 3827 2029 Fax: (+84) 028 3823 4436

Hanoi

Suite 1903, Floor 19, W1 Tower, Vinhomes Westpoint, Pham Hung, Tu Liem Ward, Hanoi City, Vietnam

Tel.: (+84) 024 3936 4985 – (+84) 024 3936 4987

Affiliated Offices: Beijing – Shanghai – Hanoi – Ho Chi Minh City – Singapore – New Delhi – Dubai – Doha – Zurich – Paris – Rome – Brescia – Washington D.C. – Los Angeles