What the decree does
On 7 November 2026, Vietnamese state media reported that Deputy Prime Minister Ho Quoc Dung had signed Government Decree No. 401/2026/ND-CP. It sets administrative penalties for the digital technology industry and takes effect on 22 November 2026. The cap is VND100 million (about US$3,907) for individuals and VND200 million (about US$7,814) for organisations.
The decree is the enforcement layer for the Law on Digital Technology Industry. The National Assembly passed that law on 14 June 2025 and scheduled it to take effect on 1 January 2026. It covers semiconductors, AI and digital assets. Vietnam Briefing reports a vote of 441 of 445 deputies in favour.
The reported penalty bands are:
- VND10–60 million for failing to provide, update, connect or share data with the digital technology industry database.
- VND90–140 million for intentionally obstructing hardware, software or digital-service activity, or for helping others commit prohibited acts.
- VND140–170 million for using digital technology products or services to commit prohibited acts, where no other specialised law applies.
- VND150–200 million for fraud in applications for incentives for large key digital-technology projects or AI data centres, where the conduct does not warrant criminal prosecution.
- VND170–200 million for 'abusing digital technology activities' to infringe on national defence, national security, public order and safety, morality, public interests, human rights, citizens' rights, or the legitimate interests of individuals and organisations.
VietnamPlus reports that individuals pay half the organisational band.
The strongest case for the decree
A statute without penalties is a suggestion. Vietnam has just built a new regulatory category: a state-run industry database, incentive schemes for strategic projects, and a legal framework for digital assets. Incentives and subsidies invite fraud, and the decree's fines for false information in applications for support are a conventional safeguard for public money. Obligations to feed data into a government database also need some consequence.
The amounts are modest by regional standards. A cap of about US$7,800 is trivial for a large platform, and the decree reaches mainly domestic conduct. By comparison, Decree 330/2026/ND-CP, issued on 19 August 2026 for cybersecurity and personal data, sets cross-border data transfer penalties of up to 5% of prior-year revenue. Measured against that decree, Decree 401 is a low-stakes instrument. A regulator that fines in thousands of dollars is not building a chokepoint on innovation.
Where the design is weaker
The low ceiling does not settle the question, because the risk lies in how the top tier is defined rather than in its size. Most of the decree targets identifiable acts: failing to upload data, defrauding an incentive programme, or obstructing a production process. The 'abuse' tier lists national security, ethnic and national interests, morality, 'public interests' and 'citizens' rights'. Those are broad, open-textured categories, and the reported text gives no objective threshold for when using digital technology becomes abuse.
That matters for three reasons.
- Predictability. A developer or integrator cannot tell in advance whether a product that is later misused by a customer falls under the 'abuse' tier. The 'intentionally assisting' language in the lower tier helps limit liability, but the reported 'abuse' wording does not clearly carry the same intent requirement.
- Overlap. The decree states that the 140–170 million tier applies only where no specialised law imposes a penalty. The 'abuse' tier carries no such carve-out in the reporting. Vietnam already has separate regimes for cybersecurity and personal data under Decree 330, so a single act could be charged under more than one instrument. Whether that happens depends on the decree's full text and on how the authorities apply it.
- Proportionality. Putting 'human rights' in a list of interests that digital technology must not infringe is a sound aim. Enforcing it through an administrative fine set by a regulator, rather than through a court applying a defined standard, is a weaker mechanism than a statutory test with an appeal path.
A pro-innovation reading does not require opposing the decree. It requires distinguishing between penalties that protect a programme's integrity and penalties that depend on the regulator's reading of 'public interest'. The first kind is easy to defend. The second tends to give firms a reason to over-comply, and that is costly in a sector the law is meant to grow. The law sets a target of 150,000 digital technology businesses by 2035, and it offers startups support for up to half the cost of advanced technology and prototype development.
What to watch
I could not locate the full decree text in an official gazette, so the above rests on state-media summaries. Three things will show how the decree works in practice once it takes effect on 22 November:
- Guidance. Whether the Ministry of Science and Technology issues examples or thresholds that define 'abusing digital technology'.
- Sequencing. Whether enforcement of the top tier defers to specialised regimes such as Decree 330, or stacks on top of them.
- Publication. Whether sanction decisions are published, so firms can see how the category is applied.
The decree's headline numbers are small and its structure is mostly conventional. Its open-ended top tier is the part to scrutinise, and clearer definitions would address it at little cost to the regulator.