Vietnam’s data regulatory environment is becoming increasingly structured and enforcement-driven. The Law on Data Security, together with Decree No. 330/2026/ND-CP on administrative sanctions in cybersecurity and personal data protection and Decree No. 333/2026/ND-CP on detailed implementation of the Law on Cybersecurity, is reshaping compliance expectations and organizational accountability. 

For DPOs, these developments call for a more integrated approach to data protection and cybersecurity, with greater focus on aligning existing governance frameworks, clarifying regulatory responsibilities, and translating new requirements into practical and sustainable compliance measures. 

To explore these developments in practice, Data Protectify will host the “DPO Talk: New Sanctions & Data Security Law - DPO Actions”, an exclusive session for our DPO Network on 30 September 2026, focusing on the Data Security Law, the evolving cybersecurity and personal data protection sanctions landscape, and practical actions for DPOs navigating these regulatory changes. 

Part 03