Procedures for Notification of Personal Data Protection Violations

Procedures for Notification of Personal Data Protection Violations plays a pivotal role in the mechanism to ensure information security and privacy rights of data subjects. In the context of complex cybersecurity incidents, compliance with this process not only helps organizations avoid administrative penalties but also demonstrates the highest responsibility towards customer privacy. In the following article, Long Phan Consulting Company will analyze this procedure in detail according to legal regulations.

When is an incident considered a violation and requires reporting?

Not every cybersecurity incident needs to be reported. Identifying the correct violation threshold is the first and most important step for effective legal compliance. According to Article 23 of the Personal Data Protection Law 2025, the notification obligation only arises when the enterprise discovers a violation with a risk of causing serious consequences.

Specifically, enterprises must evaluate based on the following factors:

• The Personal Data Controller, Personal Data Controller and Processor, or Third Party discovers violations of personal data protection regulations that may harm national defense, national security, social order and safety, or infringe upon the life, health, honor, dignity, or property of the personal data subject.
• Discovering acts of violating regulations on personal data protection.
• Personal data is processed for the wrong purpose, not in accordance with the agreement between the data subject and the data controller/processor.
• Not ensuring rights or incorrectly implementing the rights of the personal data subject.
• Other cases as prescribed by law.

>>>See more: List of Sensitive Personal Data Effective from January 1, 2026

The notification content violates regulations on personal data protection

According to Article 28 of Decree 356/2025/ND-CP, the content of the notification includes:

• Description of the nature of the violation, including: time, location, behavior, organizations/individuals, types of personal data, and the number of related data.
• Contact details of the personal data protection department/personnel or the organization/individual providing personal data protection services.
• Description of the possible consequences and damages of the violation.
• Description of measures taken to resolve and minimize the harm of the violation.

Procedure for notifying violations of regulations on personal data protection

Immediately upon detecting a violation, enterprises need to respond to the incident and carry out immediate preventive measures. According to Article 23 of the Personal Data Protection Law 2025 and Article 28 of Decree 356/2025/ND-CP, the detailed process is as follows:

Step 1: The Personal Data Controller, Personal Data Controller and Processor, or Third Party must notify the specialized personal data protection agency no later than 72 hours from the detection of the violation if it:

• Harms national defense, national security, social order, safety.
• Infringes upon the life, health, honor, dignity, property of the data subject. (If the Data Processor discovers the violation, they must promptly notify the Data Controller).

Step 2: The Personal Data Controller/Controller and Processor must make a minutes confirming the occurrence of the violation and coordinate with the specialized agency to handle the violation.

Step 3: Agencies, organizations, and individuals notify the specialized agency in cases of discovering violations, wrong purpose processing, failure to ensure rights, or other legal cases.

Step 4: The specialized personal data protection agency receives the notification and handles the violation. Relevant parties are responsible for preventing violations, remedying consequences, and coordinating with the agency.

Step 5: The Personal Data Controller/Controller and Processor/Third Party sends the notification to the specialized agency or via the National Portal on Personal Data Protection using Form No. 08 in the Appendix of Decree 356/2025/ND-CP.

How to notify authorities of violations of personal data protection regulations

Based on Article 23 of the Personal Data Protection Law 2025 and Article 28 of Decree 356/2025/ND-CP, the notification must be sent no later than 72 hours from detection.

Submission Methods:

1. Online:
   • Access the National Portal on Personal Data Protection.
   • Log in -> Select “Notify Data Violation” -> Fill in information according to the electronic form corresponding to Form No. 08 -> Digitally sign and send.
2. Direct Submission:
   • Submit directly at the Headquarters of the Department of Cybersecurity and High-Tech Crime Prevention (A05 – Ministry of Public Security).
   • Dossier includes: Written notification according to Form No. 08 (hard copy, with stamp and signature of legal representative).
3. Postal Service:
   • Send the dossier to the address of the specialized personal data protection agency. Submission time is calculated by the postmark.

Note: If full notification cannot be made within 72 hours, the enterprise can notify in phases, but the initial notification must be sent on time and state the reason for the delay in providing full information.

The competent authority receives

The notification must be sent to the specialized personal data protection agency under the Ministry of Public Security (Department of Cybersecurity and High-Tech Crime Prevention).

>>>See more: Confidentiality agreements between company and employee

Long Phan Consulting Company provides consulting services on procedures for notifying violations of personal data protection regulations

The procedure for notifying about violations of personal data protection regulations at Long Phan Consulting Company is designed to help businesses respond quickly and accurately to data breaches. With our team of experienced experts, we are committed to working alongside our clients to optimize processes and minimize potential risks.

Our services include:

• Assisting in drafting and finalizing notification documents regarding violations of personal data protection regulations;
• Assisting in the preparation of impact assessment reports;
• The representative will handle the procedures with
• Risk Management and Prevention Consulting Services

Long Phan Consulting Company is proud to be a pioneer in providing comprehensive support services. Let us protect your business from stringent legal risks.

Frequently Asked Questions about The procedures for Notification of Personal Data Protection Violations

Below, Long Phan Consulting Company provides some frequently asked questions related to procedures for Notification of Personal Data Protection Violations. We invite interested clients to refer to this information:

Do foreign businesses without branches in Vietnam have to comply with this notification requirement?

Yes. According to point c, clause 2, Article 1 of the 2025 Law on Personal Data Protection, this regulation applies to foreign agencies, organizations, and individuals participating in or related to the processing of personal data of Vietnamese citizens and people of Vietnamese origin. If a foreign enterprise processes data of Vietnamese citizens and a violation occurs, they must still comply with the notification process.

Besides notifying the Ministry of Public Security, are there any other agencies that need to be notified?

Answer: Currently, the 2025 Law on Personal Data Protection stipulates that the Cyber ​​Security and High-Tech Crime Prevention Department (Ministry of Public Security) is the focal point for receiving violation notifications. However, depending on the field of activity, businesses may have the obligation to notify other specialized management agencies (for example, the State Bank of Vietnam for the finance and banking sector).

Is a business required to notify customers (data subjects) when a data breach occurs?

Yes. According to Article 23 of the 2025 Law on Personal Data Protection, in addition to notifying the Ministry of Public Security, businesses are responsible for notifying data holders about data breaches, except in cases where such actions endanger national security. Notifying customers helps them proactively take measures to protect their assets and personal information.

Do minor incidents like accidentally sending an email containing personal information to the wrong person need to be reported?

A risk assessment is necessary. If sending the email by mistake has the potential to harm the reputation, property, or infringe upon the rights of the data subject as defined in Article 23 of the 2025 Personal Data Protection Law (e.g., containing financial information, passwords, etc.), then the business must still follow the notification procedures to avoid future legal risks.

What are the principles for protecting personal data from January 1, 2026?

Based on Article 3 of the Law on Personal Data Protection 2025, the principles for protecting personal data from January 1, 2026 are as follows:

• In compliance with the provisions of the 2013 Constitution, the provisions of the 2025 Law on Personal Data Protection, and other relevant laws.
• Personal data may only be collected and processed within the scope and for specific, clearly defined purposes, ensuring compliance with legal regulations.
• Ensuring the accuracy of personal data and having it corrected, updated, and supplemented as necessary; storing it for a period appropriate to the purpose of processing the personal data, except where otherwise provided by law.
• Implement a synchronized and effective approach involving appropriate institutional, technical, and human resources measures and solutions to protect personal data.
• Proactively prevent, detect, stop, combat, and promptly and strictly handle all violations of laws on personal data protection.
• Protecting personal data is linked to protecting national and ethnic interests, serving socio-economic development, ensuring national defense, security, and foreign relations; and ensuring harmony between protecting personal data and protecting the legitimate rights and interests of agencies, organizations, and individuals.

Conclusion

The data violation notification process requires accuracy, timeliness, and deep legal understanding. To ensure your business responds effectively to incidents and minimizes legal risks, please contact Long Phan Consulting Company via Hotline 1900636389 for professional assistance.