Vietnam Decree 330: what the new data protection fines mean for payroll and HR data

Vietnam Decree 330 is the first regulation that puts a price on mishandling personal data in Vietnam, and employee data is one of the areas it names directly. Decree 330/2026/ND-CP sets administrative fines for cybersecurity and personal data protection violations, and it took effect on 19 August 2026, the day it was signed. For HR and finance teams at headquarters, the practical question is simple: which everyday payroll and HR habits now carry a fine, and how large can it get?

What is Vietnam Decree 330?

Vietnam Decree 330 is the Government decree on administrative sanctions in the fields of cybersecurity and personal data protection. It does not create new data duties. Those come from the Law on Personal Data Protection and Decree 356/2025/ND-CP. What the decree adds is the enforcement side: which acts are violations, the fine for each, and the corrective measures an authority can order.

The full text is published on the Government portal. For the underlying duties, read our guide to Vietnam personal data protection law and your payroll data. This article covers the penalties.

Two points matter for foreign-invested employers. First, the decree applies to Vietnamese and foreign organisations alike, including enterprises set up under the Law on Investment and foreign organisations involved in processing the personal data of Vietnamese citizens. Second, beyond the fine, an authority can add supplementary sanctions such as suspending activity for 1 to 24 months, revoking a licence, or expelling a foreign individual who committed the violation.

How high can personal data protection fines go?

For most violations, personal data protection fines under Decree 330 are capped at VND 3 billion per organisation. Two categories go higher: cross-border data transfer breaches can reach 5% of the previous year’s revenue, and illegal buying or selling of personal data can reach 10 times the proceeds.

Article 7 also sets a rule that headquarters often reads the wrong way round. In the data protection section, every amount is the fine for an organisation, and an individual who commits the same act pays half. In the cybersecurity sections it is the reverse: amounts are stated for individuals and doubled for organisations, with a maximum of VND 200 million for an organisation. So a figure quoted from the decree needs its section before it goes into a risk register.

Those are ceilings, not typical outcomes. Most HR-related acts fall between VND 10 million and VND 100 million per violation, and corrective orders, such as deleting data or stopping a transfer, often cost more than the fine.

Which employee data violations does Decree 330 name?

Article 61 is the article HR should read first. It lists violations in recruitment, workforce management and the use of labour, in three fine bands. Every amount below applies to the employer as an organisation.

The deletion rule needs care in payroll. Vietnamese tax, accounting and Social Insurance rules require some payroll records to be kept after an employee leaves, and Article 61 itself excludes cases where the law provides otherwise. Deleting everything on the last day is not the answer. The answer is a written retention schedule that states what you keep, why, and for how long.

Consent and purpose rules that touch HR

Separate provisions on consent and processing principles also reach HR. According to the Government’s summary of the decree, processing data without the data subject’s consent where consent is required costs VND 30 to 50 million. So does failing to keep a record of consent or failing to tell people that their sensitive data is being processed. Treating silence as consent costs VND 50 to 70 million.

The principles provisions, reported by the Government News portal, fine processing beyond the stated purpose, inaccurate data that is not corrected, and storage beyond the necessary period at VND 20 to 40 million. For employee data, a wrong bank account or an outdated dependant list in payroll is not only an operational error. Under Decree 330 it can also be a data accuracy breach.

Does sending payroll data to headquarters count as a cross-border data transfer?

In most group structures, yes. When a Vietnamese entity sends payroll registers, salary reviews or HR master data to a regional or global office, or loads them into an HR system hosted abroad, that is a cross-border data transfer of employee data. Article 56 of Decree 330 sets the fines for getting it wrong.

Revenue here means total revenue in the Vietnamese market in the preceding financial year. If the company had no revenue in Vietnam, or the percentage gives a figure below VND 3 billion, Article 56 applies fixed bands instead: VND 200 to 500 million, VND 500 million to 1 billion, or VND 1 to 3 billion, depending on how many people were affected.

For a typical FDI employer with a few hundred or a few thousand staff, the percentage bands are unlikely to apply to employee data alone, because the thresholds start at 10,000 people. The VND 30 to 100 million bands are the realistic exposure, and they are triggered by missing paperwork rather than by a leak.

The impact assessment dossiers

Article 55 covers the processing impact assessment that every controller should hold. Not preparing or maintaining it at the company’s office, or not sending the original to the Department of Cybersecurity and High-Tech Crime Prevention (Ministry of Public Security) within 60 days of starting processing, costs VND 20 to 30 million. Falsifying the dossier or refusing to correct it after a written request costs VND 50 to 100 million.

Payroll that flows to headquarters usually needs two dossiers: one for processing in Vietnam and one for the cross-border data transfer. The second is most often missing, because it feels like an internal group matter.

What happens if a payslip or payroll file leaks?

A leaked payroll file triggers notification duties, and Decree 330 fines both silence and delay. Under Article 54, a controller or processor that notifies the data protection authority more than 72 hours after discovering a violation that causes or may cause harm faces VND 40 to 60 million.

• VND 10 to 20 million: a processor, such as a payroll vendor, that finds a violation but does not promptly inform the controller (the employer); not recording the incident; or knowingly understating the scale of an incident in the report.
• VND 20 to 40 million: not notifying the authority at all when a violation is found, when data is processed for the wrong purpose, or when data subject rights are not respected.
• VND 40 to 60 million: notifying later than 72 hours in harmful cases.
• VND 60 to 80 million: not taking measures to stop the violation, or not cooperating with the authority.

Payroll incidents are rarely dramatic: a payslip batch sent to the wrong list, or a salary sheet shared through an open link. The employer must find out, decide and record what it did, fast.

Who should own data protection in the Vietnam entity?

Article 57 makes the appointment of a data protection person a compliance item in its own right. Appointing someone without a college degree or at least 2 years of relevant experience costs VND 20 to 30 million. Relevant fields listed in the decree include legal, IT, data security, risk management, compliance and HR management.

Smaller failures carry a warning or a fine of VND 10 to 20 million: no confidentiality agreement, no training, or an appointment letter that does not set out the role’s functions. A regional privacy officer can work, but the local appointment document still has to meet the decree’s wording.

What should HR and finance fix first under Vietnam Decree 330?

Start with the items that are cheap to fix and easy for an inspector to check. Paperwork gaps attract fines even when no data has leaked.

1. Map employee data flows: List every place payroll and HR data goes: HRIS, payroll vendor, banks, insurers, auditors, regional office. Mark each one that is outside Vietnam.
2. Check the two dossiers: Confirm a processing impact assessment exists for HR data, and a separate one for each cross-border data transfer of payroll data. Note the date each was filed.
3. Write a retention schedule: State how long you keep candidate data, active employee files and leaver payroll records, and which law requires each period.
4. Review consent and notices: Make sure employees have been told what data is collected, why, who receives it, and that some of it goes abroad. Keep the record.
5. Disclose monitoring tools: If you use attendance cameras, screen tracking or device monitoring, put a written notice in place before the next inspection.
6. Test the 72-hour process: Agree who decides, who notifies and who documents an incident, including what your payroll vendor must tell you and how fast.
7. Check the appointment letter: Confirm the named data protection person meets the education and experience criteria in Article 57.

Questions to ask your payroll vendor

Your payroll provider is a processor of employee data, and Decree 330 fines processors directly. Under Article 51, a processor that does not delete or return all personal data when the contract ends faces VND 30 to 50 million. The controller that does not require it to do so faces the same band. Under Article 52, a transfer agreement that does not define each party’s data protection responsibilities costs VND 20 to 30 million.

Three questions cover most of the risk: Does our contract define roles, security measures and deletion at the end of the service? Where is our employee data hosted, and does any of it leave Vietnam? How fast will you tell us about an incident? Where a provider runs personal data processing as a business line, ask also about its certificate. Article 59 fines operating that business without one at VND 50 to 80 million. For a broader view of how terra handles this, see how terra protects payroll and HR data.

Does Decree 330 replace the earlier data rules?

No. Decree 330 sits on top of the substantive rules. The Law on Personal Data Protection and Decree 356/2025/ND-CP define what employers must do. Decree 330 defines what happens when they do not. Older content that quotes fines “under Decree 13/2023” is out of date, as Decree 13 has been replaced. We explain the background in why data protection matters for payroll.

For HQ reporting, the useful framing is per violation, not per company. One audit can find several separate acts, such as no transfer dossier, no monitoring notice and an over-retained leaver archive. Each is fined in its own band.

How terra helps employers manage employee data under Decree 330

Most Decree 330 risk in HR comes from how payroll data is collected, stored, shared and deleted every month. Under terra Payroll, those steps run inside a controlled process with defined access, so the evidence an inspector asks for already exists.

• Process payroll in Vietnam with role-based access, and document which reports leave the country and to whom.
• Set retention and deletion rules for leaver payroll records in line with tax and Social Insurance requirements.
• Define processor duties, incident notification timelines and end-of-contract deletion in the service agreement.
• Review HR and payroll data practices against current law through our HR and payroll compliance assessment.

Conclusion

Vietnam Decree 330 turns data protection duties for employee data into fines with clear bands, from VND 20 million for a candidate file to a share of revenue for serious transfer failures. Most exposure for FDI employers is administrative: missing dossiers, missing notices and data kept too long. Fix those first, and the rest becomes a matter of routine.