Abstract

This article examines the legal liability of enterprises for personal data protection in Vietnam, thereby clarifying its theoretical foundations, legal framework, and practical implementation. The study identifies several shortcomings, including delays in issuing implementing guidelines, difficulties in proving damages, gaps in the criminal liability of commercial legal entities, high compliance costs, and challenges arising from cross-border data activities. On this basis, the article proposes improvements to the legal framework, including increasing fines based on revenue, introducing a statutory compensation mechanism, establishing criminal liability for commercial legal entities, promoting the application of technology and international cooperation, and supporting enterprises in strengthening their data governance capacity.

Keywords: Commercial legal entities; criminal liability; legal sanctions; personal data.