On February 21st, 2025, the Government issued Decree No. 24/2025/ND-CP amending and supplementing Decree No. 98/2020/ND-CP on administrative penalties for violations in the field of consumer rights protection. Accordingly, the Decree supplements the fine level for several violations related to consumer information committed by enterprises, specifically as follows:
– A fine from VND 20 to 30 million shall be imposed for the following violations:
Failure to make a document authorize or hire a third party to collect, store, use, modify, update, or delete consumer information; making a document authorizing or hiring a third party to collect, store, use, modify, update, or delete consumer information, the content of the document does not specify the scope and responsibilities of each party in protecting consumer information; authorizing or hiring a third party to collect, store, use, modify, update, or delete consumer information without the consent of the consumer; failure to build or build information protection rules generally applicable to consumers with incomplete content; failure to publicly or publicly information protection rules generally applicable to consumers in the wrong form; failure to allow consumers access to the information protection rules generally applicable to consumers before or at the time of information collection.
– A fine from VND 30 to 40 million shall be imposed for the following violations:
Failure to receive or failure to resolve consumer feedback, requests, or complaints related to information being illegally collected, used for the wrong purpose and scope as notified; failure to notify the competent state management agency within 24 hours from the time of discovering that the information system has been attacked, creating a risk of loss of consumer information safety and security; failure to have measures to ensure consumer information safety and security during collection, storage, and usage, or to prevent violations of consumer information safety and security according to the regulations; transferring consumer information to third parties without the consent of the consumer according to the
Additionally, the fine shall be doubled for the above-mentioned violations in case the relevant information is sensitive personal data of the consumer.
Decree No. 24/2025/ND-CP takes effect from the date of issuance.
