“Infringing on,” “illegally buying or selling,” or “obstructing the protection of” personal data could become new offenses in Việt Nam’s upcoming amended Penal Code.
The Latest: On June 26, the Ministry of Public Security (MPS) published a draft policy dossier for the amended Penal Code.
- Driven by the emergence of “many new acts dangerous to society […] especially in cybersecurity,” the ministry proposed adding 10 new criminal offenses, which include the illegal trading and infringement of personal data.
- The Ministry of Public Security will collect public feedback on the draft from June 26 to July 16.
The Details: According to the MPS, current rules exhibit numerous limitations regarding high-tech crimes, cybercrimes, and offenses in finance and securities, as they do not fully describe new methods and tactics.
- On page 72 of the policy impact assessment in the dossier, the ministry noted that “some acts have not been fully described in criminal offenses and do not cover new realities.”
- The MPS cited several acts that have emerged in practice but are “not specifically mentioned” in the current Penal Code, such as “fraud through virtual exchanges,” “manipulating social media data for profit,” “spreading deepfakes” and “money laundering using cryptocurrency.”
- The ministry also stated that many of these acts currently “do not meet the conditions to fit existing criminal offenses.” This limitation forces prosecutors to handle them through indirect charges, such as Article 174 on obtaining property by fraud, which “causes controversy and risks letting dangerous conduct go unpunished.”
10 New Criminal Offenses: To address the current limitations, the MPS proposed adding the following 10 offenses:
- Infringing on personal data
- Illegally buying or selling personal data
- Obstructing personal data protection activities
- Establishing or joining a criminal organization
- Proliferating weapons of mass destruction
- Financing the proliferation of weapons of mass destruction
- Producing or trading food, food additives or animal feed in violation of quality regulations
- Violating regulations on the treatment of ordinary waste and household solid waste
- Illegal fishing
- Violating regulations on the provision, business, or use of telecommunications and internet services
The Background: The illegal collection, sale, leakage, and dissemination of people’s personal data have become increasingly common, with sensitive information widely exposed online.
In October 2025, Việt Nam Airlines confirmed that about 7.3 million customer records had been leaked after hackers breached the company through the third-party platform Salesforce.
- According to published information, the leaked data included names, phone numbers, dates of birth, and membership numbers. It was the second major data breach for the airline in nearly a decade, following a 2016 cyberattack that paralyzed its systems and exposed more than 410,000 passenger records.
Why It Matters: Việt Nam is moving toward building a cybersecurity control infrastructure that the MPS will manage. The police are both drafting laws and acting as the agency that enforces them and manages data infrastructure.
- Earlier, Government Decree 147/2024 required social media service providers to verify user accounts using phone numbers in Việt Nam.
- Furthermore, the amended Cybersecurity Law, passed by the National Assembly in December 2025 and in effect from July 1, gives the ministry authority to manage IP addresses and online identities.
- Additionally, the Personal Data Protection Law, which takes effect on Jan. 1, allows the ministry to use personal data without the data subject’s consent in cases involving “the protection of national security, social order, and safety.”
- The law also allows other state agencies to use personal data for “analysis and synthesis” to “serve leadership, direction, and state management.”
Thành Phương wrote this article in Vietnamese and published it in Luật Khoa Magazine on July 7, 2026. The Vietnamese Magazine has the copyrights to the English translation.
