Data subject rights in Vietnam: the 6 groups of rights under Article 4 of Law 91/2025
A data subject is the individual reflected by personal data. Clause 1, Article 4 of the Personal Data Protection Law No. 91/2025/QH15 sets out 6 groups of data subject rights in Vietnam for controlling and protecting their own personal information.
Personal Data Protection Law No. 91/2025/QH15
Official legal texts
Key takeaways for businesses
- Clause 1, Article 4 of Law 91/2025 sets out 6 groups of rights: to be informed; to consent to or permit processing and to withdraw consent; to access, view, correct or request correction; to be provided with data, to deletion, to restriction of processing and to object to processing; to complain, denounce, sue and claim compensation; and to request protection measures.
- Businesses must set up a channel for receiving and responding to data subject requests (DSRs) within the prescribed time limits.
- Refusing to give effect to a user's rights without a legitimate reason is a violation of the law.
What rights do data subjects have under Law 91/2025/QH15?
Data subject rights in Vietnam are the paramount statutory rights protecting privacy and individuals' self-determination over their personal information. Under Clause 1, Article 4 of Law 91/2025/QH15, data subjects have 6 core groups of rights.
For the right to be informed, businesses can refer to how a personal data processing notice is presented so that readers understand the purpose, the responsible entity and related information.
The 6 groups of data subject rights in Vietnam that businesses must ensure
- Right to be informed: To be notified of the processing of their data.
- To consent to or permit processing and to withdraw consent: To voluntarily consent or refuse, and to request withdrawal of consent already given, except in the cases under Article 19 or where the law provides otherwise (Clause 1, Article 10).
- To access, view, correct or request correction: To view their personal data and request its correction.
- To be provided with data, to deletion, to restriction of processing and to object to processing: To request a copy of the data, deletion of the data, or to restrict or object to the processing of their personal data.
- To complain, denounce, sue and claim compensation: To denounce, sue or claim compensation when their privacy is infringed.
- To request protection measures: To request that the necessary measures be applied to protect their personal data.
Note: in addition to the 6 groups of rights above, Clause 2, Article 4 of Law 91/2025 also provides for an obligation to protect one's own personal data — this is an obligation of the data subject, not a right.
Business obligations when receiving requests to exercise data subject rights in Vietnam
To build these rights into day-to-day operations, businesses need a point of contact to track requests and staff who understand how to coordinate. LexData provides an outsourced DPO to help receive and track data subject requests, as well as training for the DPO and request-handling team within an agreed scope.
Frequently asked questions
If a customer asks for their data to be deleted, must the business delete it immediately?
The business must delete the data within the prescribed time limit (20 days, or 30 days if the processor/third party must be asked), except in the cases not requiring consent under Article 19 of Law 91/2025 or where the law requires the data to be retained (for example, accounting records and invoices for the retention period under accounting and tax law, or transaction data under anti-money laundering law). Where the data cannot be deleted for a legitimate reason, the business must notify the data subject (Clauses 2 and 5, Article 14 of Law 91/2025).
What is the maximum time for a business to respond to a customer's request?
Under Article 5 of Decree 356/2025/ND-CP, for every type of request the business must respond to the data subject within 02 working days. The time limits for carrying out each type of request are: 15 days for withdrawal of consent, restriction of processing and objection to processing (20 days if the processor/third party must be asked to stop processing); 10 days for viewing, correcting and providing data (15 days if a processor/third party is involved); 20 days for deleting data (30 days if a processor/third party is involved); 15 days for requests to apply data protection measures. The time limit may be extended at most 01 time: by no more than 15 days for withdrawal of consent, restriction of or objection to processing and requests for protection measures; no more than 10 days for viewing, correcting and providing data; and no more than 20 days for deletion. The business must give reasons and bears the burden of proving that the extension is necessary and reasonable.
The Vietnamese original of this entry has been reviewed for legal accuracy against the Personal Data Protection Law No. 91/2025/QH15 and current implementing legislation. This English edition is an unofficial translation for reference; the official legal texts are in Vietnamese.
Meet the LexData teamGo further with LexData
Personal Data Protection Officer (DPO) Training for Businesses
Work with our lawyers on the filings and documents, end to end.
Learn about the service