These regulations are stipulated in Decree 330/2026/ND-CP on administrative penalties for cybersecurity and personal data protection. The Government issued the decree, which took effect on 19/8 and comprises four chapters and 82 articles.

Under Clause 2, Article 50, organizations that publicly disclose personal data without the data subject's consent, except as otherwise provided by law, will be fined 30-50 million dong. These fines for personal data protection violations apply to organizations; individuals committing the same offense will face one-half of the fine, ranging from 15-25 million dong.

The same fines also apply to the public disclosure of personal data that infringes upon the data subject's legal rights and interests.

In addition to monetary fines, offenders may be compelled to remove or recall the publicly disclosed personal data.

These regulations establish a significant legal boundary for instances of posting others' data online for purposes of accusation, reporting, dispute, or "calling out". However, the decree does not stipulate that merely posting information related to another person automatically incurs a penalty. Enforcement depends on the data disclosed, the subject's consent, and cases permitted by law.

Disclosing data with proper intent but exceeding scope can also lead to fines

Article 50 addresses more than just disclosing data without consent.

Organizations may be fined 20-30 million dong if they publicly disclose personal data without a specific purpose, outside permitted circumstances; disclose data beyond the necessary scope or type for the intended purpose; or disclose data that does not accurately reflect its origin. Individuals committing the same offense will face one-half of the fine.

Failure to control or monitor public disclosure activities, or to implement measures to prevent unauthorized access, use, disclosure, copying, modification, deletion, or destruction of publicly available data, also falls under the scope of penalties.

Thus, the decree not only addresses "whether disclosure is permitted" but also controls the purpose and extent of such disclosure. A public disclosure purpose does not mean all data related to an individual can be made public.

This point directly impacts social media users: when reporting an incident, publicly disclosed data must still remain within legal limits.

How does this differ from previous regulations?

Before Decree 330, Decree 15/2020 penalized the illegal collection, use, sharing, and dissemination of personal information, with a maximum fine of 30 million dong for organizations.

Decree 330 separates "public disclosure of personal data" into a distinct offense, specifying provisions for purpose, scope, and consent. It also increases the fine for public disclosure without consent to 30-50 million dong for organizations.

Following Decree 13/2023 and the Personal Data Protection Law, which took effect in 2026, Decree 330 further specifies violations with corresponding fines and remedial measures.

Publicly disclosing others' data to "call them out" may incur a fine. *Xuan Minh*

Silence is not considered consent

Another notable set of regulations is found in Article 43, concerning the consent of personal data subjects.

The decree imposes fines of 30-50 million dong on organizations for various actions, including: processing data after collection without consent; establishing default consent methods; creating unclear or misleading distinctions between consent and non-consent; and failing to provide full information about data types, processing purposes, and the data subject's rights and obligations.

The consent mechanism must also ensure that users provide consent for each specific data processing purpose.

Notably, collecting or processing data when users remain silent or do not respond, then unilaterally deeming this as consent, can result in fines of 50-70 million dong for organizations. Individuals committing the same offense will face one-half of the fine.

Thus, consent is not merely about whether users click an "agree" button, but also about how businesses design and record that consent.

Buying and selling data can incur fines up to billions of dong

The most severe penalties target the illegal buying and selling of personal data.

Article 53 stipulates that certain acts of illegal buying and selling of personal data can be penalized with fines ranging from two to 10 times the revenue generated from the violation. Offenders may also be required to destroy or delete all traded data, surrender the illicit gains, and notify affected data subjects.

For illegal data trading that infringes upon national defense, security, order, economy, life, health, honor, dignity, property, or the legal rights and interests of organizations or individuals, fines can reach up to 3 billion dong.

For social media users, "calling out" someone does not equate to the right to publicly disclose all information about the person being reported. It is crucial to distinguish between content necessary for reporting an incident and personal data that does not need to be made public.

Pham Hai