DECREE NO. 24/2025/ND-CP STRENGTHENING THE PROTECTION OF CONSUMER PERSONAL DATA

On February 21, 2025, the Government issued Decree No. 24/2025/ND-CP ("Decree 24"), amending and supplementing a number of provisions of Decree No. 98/2020/ND-CP ("Decree 98") on administrative sanctions for violations in commercial activities, production and trading of counterfeit and prohibited goods and protection of consumer rights. Decree 24 takes effect from February 21, 2025 with many important new points to tighten the management of commercial transactions in cyberspace as well as improve the quality of personal and consumer data protection.

Increased penalties for violations of consumer information protection regulations

One of the notable changes is that Decree 24 has increased the penalties for violations of consumer information protection, especially related to the protection of personal data. Specifically:

(i) The act of collecting and using personal information of consumers without valid consent will be fined from VND 20 - 30 million (Article 46.1.h);

(ii) The act of transferring personal information of consumers to a third party without consent will be fined from VND 30 - 40 million (Article 46.1.d);

(iii) No measures to protect consumer information during the process of collection, storage, use. Consumer complaints about unauthorized collection or use of information are not received or are refused to be resolved will be fined from VND 30 - 40 million (Article 46.2.a and Article 46.2.c).

In addition, Decree 24 also adds provisions binding responsibilities with sanctions for data controllers in authorizing or hiring third parties to process consumer information, specifically:

(i) Data controllers must prepare documents when authorizing or hiring third parties to collect, store, use, edit, update, and delete consumer information (Article 46.1.a);

(ii) The authorization document must clearly define the scope of responsibility of each party in protecting consumer information (Article 46.1.b);

(iii) Consumers must have consent before authorizing or hiring third parties to process consumer information (Article 46.1.c).

These provisions help enhance the responsibility of data controllers in managing and protecting customers' personal data, especially when using third-party services.

Strictly punish violations that affect sensitive information or are committed by organizations operating large digital platforms

The concept of “Sensitive personal data” is defined by Decree 13/2023/ND-CP on Protection of Personal Data as data that, when violated, will affect the legitimate rights and interests of individuals, such as data on religion, politics, etc.

In order to protect this group of information, Decree 24 applies a fine twice the normal fine in cases where the relevant information affected by the violation is sensitive personal data of consumers (Article 46.3). In addition, if the violation is committed by an organization that establishes and operates a large digital platform, the fine will be increased by 4 times (Article 46.4).

Tightening the handling of violations in cyberspace transactions

Decree 24 imposes a fine of up to 70 million VND on entities that violate cyberspace transactions, for example:

(i) Forcing consumers to use their platform by preventing or forcing them to register for another intermediary service to use the platform (Article 53a.1.a);

(ii) Concealing or distorting consumers' reviews of products, services or sellers on the platform, except in cases where such reviews violate the law or social ethics (Article 53a.1.c);

(iii) Providing false or misleading information about products, services or businesses on the platform (Article 53a.1.e);

(iv) Disturbing consumers by contacting or marketing against their wishes to promote products or services or to force them to enter into contracts (Article 53a.1.g);

(v) Refusing to compensate, refund or return products or services when the products or services do not match the information registered, announced, listed, advertised, introduced or committed to customers (Article 53a.1.l).

Sanctions for violations of regulations on protection of vulnerable consumer rights

The Law on Protection of Consumers’ Rights 2023 has defined vulnerable consumer groups as well as prescribed the responsibilities of Enterprises when dealing with this group. Decree 24 has added specific sanctions to strengthen the protection of this group. Accordingly, businesses can be fined from 30-70 million VND if they violate their obligations to vulnerable consumers such as:

(i) Refusing to resolve complaints but not responding in writing or not stating the legal basis (Article 46a.1.b);

(ii) Not developing or publicizing policies to protect vulnerable consumers, or not training employees on these policies (Article 46a.1.e and Article 46a.1.g).

ALTAS Services

(i) Conducting Legal Review of businesses in commercial activities, production, trading of counterfeit and prohibited goods and protecting consumer rights to avoid violating sanctions under Decree 24;

(ii) Consulting, drafting documents, implementing registration procedures for granting Certificates of eligibility for business, related Business Licenses for businesses to operate legally;

(iii) Consulting, reviewing, drafting Contracts, Agreements, Terms of Service between businesses and consumers to ensure compliance with the provisions of Decree 24; and

(iv) Consulting, drafting documents, forms on Protection of Personal Data, consumer information protection in compliance with legal regulations.

Conclusion

ALTAS LAW is committed to supporting investors and businesses in this volatile period. Please contact Member Lawyer Chris Luong at email chris.luong@altas.vn if investors need more detailed information or support in carrying out legal procedures.

Copyright © 2025 ALTAS LAW. All rights reserved. Ownership: This documentation and content (Content) is a proprietary resource owned exclusively by ALTAS LAW (meaning ALTAS LAW, ALTAS CORP and its member firms). Use of this Content does not of itself create a contractual relationship, nor any attorney/client relationship, between ALTAS LAW and any person. Disclaimers: The Content provided is for informational purposes only and may not reflect the latest legal or regulatory developments. Summaries of laws, regulations, and practices are subject to change. This Content does not constitute legal or professional advice for any specific situation and should not be relied upon as a substitute for reviewing and complying with applicable laws, rules, regulations, or official forms. Always seek legal counsel before making any decisions or taking any action based on this Content. ALTAS LAW, along with its editors and contributing authors, make no guarantees regarding the accuracy of the Content and explicitly disclaim any liability for any consequences resulting from actions taken, allowed, or omitted, whether fully or partially based on any part of the Content. The Content may include links to external websites, and external sites may also link to it. ALTAS LAW is not responsible for the content or functionality of any such external websites and disclaims all liability for any issues arising from their content or operation. Please note: Past results do not guarantee similar outcomes.

Written: Luong Van Chuong - Partner Lawyer at  ALTAS Law & Dang Thi Ngoc Lan - Legal Senior Assistant

Date: 05/03/2025