Personal data retention period in Vietnam: how long can you keep data under Law 91/2025?
The personal data retention period in Vietnam is how long a business may keep personal data before it must delete or destroy it. Law 91/2025/QH15 sets no single period: data may be kept only for a period appropriate to the processing purpose unless the law provides otherwise (Clause 3, Article 3), and must be deleted or destroyed once the purpose is achieved or the statutory retention period ends (Points b and c, Clause 1, Article 14).
Personal Data Protection Law No. 91/2025/QH15, Decree 330/2026/ND-CP and sector laws on accounting, medical examination and treatment, and anti-money laundering
Official legal texts
- Law 91/2025/QH15 — Government e-portal (official Vietnamese text)
- Decree 330/2026/ND-CP — Government e-portal (official Vietnamese text)
- Anti-Money Laundering Law 14/2022/QH15 — Government Gazette (official Vietnamese text)
- Circular 33/2025/TT-BYT on medical record retention — Government e-portal (official Vietnamese text)
Key takeaways for businesses
- There is no single retention period for personal data. The period comes from three sources in order of priority: mandatory sector-law retention periods, agreement with the data subject, and the processing purpose (Clause 3, Article 3 and Point c, Clause 1, Article 14 of Law 91/2025/QH15).
- Data must be deleted or destroyed once the processing purpose is achieved or the statutory retention period ends, without waiting for a request from the data subject (Points b and c, Clause 1, Article 14). Data on unsuccessful job applicants, and on employees after their contract ends, must be deleted or destroyed unless agreed otherwise or another law provides (Article 25).
- Keeping employee data beyond the permitted period, or failing to delete it when the contract ends, is fined VND 50–70 million (Points a and b, Clause 2, Article 61 of Decree 330/2026/ND-CP); failing to delete or destroy data in cases required by law is fined VND 30–50 million (Point a, Clause 2, Article 51).
What is the personal data retention period in Vietnam?
The law sets no single retention period for personal data. Clause 3, Article 3 of the Personal Data Protection Law No. 91/2025/QH15 requires data to be "stored for a period appropriate to the purpose of processing personal data, unless the law provides otherwise". A business's personal data retention period is therefore determined from three sources, in order of priority:
- Sector law that fixes a minimum retention period (accounting, healthcare, anti-money laundering and so on). This is a floor: you may not delete earlier.
- Agreement with the data subject, for example in a contract, privacy notice or consent form. Point c, Clause 1, Article 14 and Point b, Clause 2, Article 25 both refer to periods set by agreement.
- The processing purpose. Where no statutory period exists, data may be kept only until the purpose is achieved (Point b, Clause 1, Article 14).
This sits within the six principles in Article 3; see data protection principles. It means the business must build its own retention periods and be able to explain them. When the retention period ends, the default is deletion, destruction or de-identification.
When must personal data be deleted after the retention period?
Clause 1, Article 14 of Law 91/2025 lists six cases in which data must be deleted or destroyed. Two are tied to retention and need no request from the data subject:
- The processing purpose has been achieved (Point b), for example applicant files after a recruitment round or attendee data after an event.
- The retention period required by law has ended (Point c).
The other four are a request from the data subject who accepts the risks (Point a), a decision of a competent state authority (Point d), an agreement (Point dd) and other cases provided by law (Point e). Deletion must use secure means that prevent intrusion and unauthorised restoration (Clause 3, Article 14); see data protection measures. Where deletion is impossible for a legitimate reason, the data subject must be told (Clause 5, Article 14). For the request process see right to erasure.
Personal data retention period by type of record
The table collects the minimum retention periods LexData has checked against the legal text. It covers only records with a clear statutory period; for anything else, use the processing purpose.
Personal data retention periods by type of record, checked against the source text or full text on official portals
| Type of record | Retention period | Basis |
|---|---|---|
| Accounting documents used for management and administration, including vouchers not used directly to post books or prepare financial statements | At least 5 years | Point a, Clause 5, Article 41 of the Accounting Law 88/2015/QH13 |
| Vouchers used directly to post books and prepare financial statements; accounting books; annual financial statements | At least 10 years, unless another law provides | Point b, Clause 5, Article 41 of the Accounting Law |
| Accounting documents of historical value or important economic, security or defence significance | Permanent | Point c, Clause 5, Article 41 of the Accounting Law |
| E-invoices | No separate figure; kept correctly and for the full period under accounting law | Point b, Clause 1, Article 5 of Decree 254/2026/ND-CP |
| Inpatient and outpatient medical records | 10 years | Article 69 of the Law on Medical Examination and Treatment 15/2023/QH15 (refers to archiving law); Annex to Circular 33/2025/TT-BYT |
| Medical records of patients who died | 30 years | Annex to Circular 33/2025/TT-BYT |
| Psychiatric, work-accident and traffic-accident records; tissue or organ transplant and cosmetic surgery records | 20 years | Annex to Circular 33/2025/TT-BYT |
| Customer identification information and transaction records of reporting entities under anti-money laundering law | 5 years from the end of the transaction, account closure or report date, depending on the record | Clauses 1 and 2, Article 38 of the Anti-Money Laundering Law 14/2022/QH15 |
| Labour management book | No period stated; must be prepared, updated and produced on request of the competent authority | Clause 1, Article 12 of the Labour Code 2019 |
| Data of unsuccessful job applicants | No minimum period; must be deleted or destroyed unless otherwise agreed | Point c, Clause 1, Article 25 of Law 91/2025/QH15 |
| Employee data after the contract ends | As set by law or agreement; deleted or destroyed unless agreed otherwise or another law provides | Points b and c, Clause 2, Article 25 of Law 91/2025/QH15 |
| Images and sound recorded in public places | No general period; the time needed for the purpose of collection | Clause 4, Article 32 of Law 91/2025/QH15 |
Four cautions when reading the table:
- A sector-law minimum is a floor. The data inside that record may be kept; data outside it, such as marketing lists or attendance photos, must still be deleted when its purpose ends.
- The Accounting Law has been consolidated and amended several times. Clause 5, Article 41 is the basis for the 5-year, 10-year and permanent periods; check the latest consolidated text when building a retention schedule.
- Anti-money laundering records: Law No. 23/2026/QH16 amending the Anti-Money Laundering Law takes effect on 1 December 2026. LexData has not confirmed whether Article 38 is changed; financial institutions and banks should check before that date.
- Personnel records and archives: the Archives Law 33/2024/QH15 and Circular 10/2022/TT-BNV contain retention tables in which personnel files have long periods. How far these bind the personnel files of a private business is not clear from the texts; businesses should identify the rules that apply to them rather than apply a multi-decade period to every file, because that would conflict with the deletion duty in Article 25 of Law 91/2025.
Data-localisation and system-log duties under cybersecurity law (Decree 333/2026/ND-CP) are a different matter: they are duties to keep data in Vietnam and supply data to authorities, applying to defined groups of businesses, not a general personal data retention period; see data localization in Vietnam.
How to set a personal data retention period for each record
To meet Clause 3, Article 3 and Points b and c, Clause 1, Article 14, a business should keep a retention schedule for each type of data. The steps are:
- List data types and purposes, which you can take from a record of processing activities (ROPA).
- Find the statutory period for each type, as in the table above. Record the basis so you can explain it in an inspection.
- Where there is no statutory period, set one by purpose and record the reason. An example for illustration only (not a rule): customers with no transaction or interaction for a period the business defines move to deletion or de-identification.
- Define what happens at expiry: delete, destroy or de-identify, who does it, and how processors confirm it; see the data processing agreement.
- Tell data subjects the period in the privacy notice; in finance, banking and credit information, consent must state the retention period (Point c, Clause 2, Article 8 of Decree 356/2025/ND-CP). See privacy notice.
- Review periodically and keep deletion logs as evidence.
Backups are often missed: the law has no separate rule on backups, but Clause 3, Article 14 requires secure deletion that prevents unauthorised restoration, so the schedule should state how data in backups is handled.
What are the fines for keeping personal data too long?
Decree 330/2026/ND-CP has no single article for over-retention; the acts are spread across contexts. The amounts apply to organisations (individuals pay half):
Fines linked to retention and deletion of personal data under Decree 330/2026/ND-CP
| Act | Fine | Basis |
|---|---|---|
| Keeping employee data beyond the period set by law or agreement; failing to delete or destroy employee data when the contract ends (unless agreed or provided otherwise) | VND 50–70 million | Points a and b, Clause 2, Article 61 |
| Failing to delete or destroy applicant data when not hiring (unless agreed otherwise) | VND 20–50 million | Point d, Clause 1, Article 61 |
| Failing to delete or destroy data in cases required by law; controller failing to ask processors or third parties to delete; processor failing to delete or return data at the end of the contract | VND 30–50 million | Points a, b and c, Clause 2, Article 51 |
| Deleting or destroying data by unsafe means; failing to prevent unauthorised restoration | VND 10–30 million | Points b and c, Clause 1, Article 51 |
| Paid transfer of data without setting a retention period suited to the transfer purpose or deleting data once the purpose is achieved | VND 30–50 million | Point c, Clause 2, Article 52 |
| Big data processing without an appropriate storage, deletion and destruction policy | VND 20–30 million | Point a, Clause 1, Article 66 |
| Using cloud computing without an appropriate storage, deletion and destruction policy | VND 20–50 million | Point d, Clause 1, Article 69 |
Remedies commonly ordered include deletion or destruction of the data to the point it cannot be restored (Clause 4, Article 51; Clause 4, Article 61). For the wider picture see PDPL penalties.
Checklist for setting a personal data retention period
- A retention schedule exists for each type of data, recording the basis (law, agreement or purpose).
- Statutory periods for your sector (accounting, healthcare, anti-money laundering and so on) have been checked.
- The period is stated in the privacy notice and consent forms.
- Deletion, destruction or de-identification runs on a schedule, including for backups.
- Contracts with processors require deletion or return of data at the end.
- There is a procedure for erasure requests that conflict with a retention duty, including a template explaining the reason.
- Deletion logs are kept as evidence for inspections.
Insight from lawyer Ho Thi Ha Nhi
"Businesses often ask how many years they must keep data, when the right question is which data must be kept under which law. Accounting records have clear periods; most other data, such as old customer lists or CVs, has none, and the business must set a period and be able to explain it. The common mistake is to take the longest period for one type of record and apply it to all data."
Frequently asked questions
What is the maximum period for keeping personal data under Law 91/2025?
There is no general maximum. Clause 3, Article 3 of Law 91/2025/QH15 requires data to be kept for a period appropriate to the processing purpose, unless the law provides otherwise. A business must set a period for each type of data and purpose, based on sector-law retention duties, agreements with data subjects and real need, then record it in its policy and privacy notice.
A customer asks for deletion, but the law requires us to keep accounting records. What do we do?
You need not act on an erasure request in the cases in Article 19 of Law 91/2025/QH15, which include cases where other laws provide otherwise (Clause 2, Article 14; Point dd, Clause 1, Article 19). The data inside vouchers and accounting books is kept for the period in the Accounting Law, and you must tell the customer why it cannot yet be deleted (Clause 5, Article 14). Data outside the retention duty, such as marketing data, must still be deleted.
After an employment contract ends, may the company keep the personnel file?
Only what the law allows or the parties agreed. Points b and c, Clause 2, Article 25 of Law 91/2025/QH15 provide that employee data is kept for the period set by law or agreement and must be deleted or destroyed when the contract ends, unless agreed otherwise or another law provides. Payroll, tax and insurance vouchers that fall under accounting duties are still kept under the Accounting Law. The rest, such as photos or attendance records no longer needed, should be deleted on a schedule.
How long can we keep the CVs of unsuccessful candidates?
The law gives no number of days. Point c, Clause 1, Article 25 of Law 91/2025/QH15 requires the information provided by a candidate to be deleted or destroyed if they are not hired, unless otherwise agreed with the candidate. A business that wants to keep CVs for future roles should obtain separate consent stating how long, and delete them if the candidate declines. Failing to delete is fined VND 20–50 million (Point d, Clause 1, Article 61 of Decree 330/2026/ND-CP).
How many days may CCTV footage be kept?
The law fixes no number of days. Clause 4, Article 32 of Law 91/2025/QH15 allows footage to be kept only for the time needed for the purpose of collection, unless the law provides otherwise, and it must then be deleted or destroyed. Set the period in your internal policy and be able to explain why it is necessary; see the handbook entry on CCTV.
The Vietnamese original of this entry has been reviewed for legal accuracy against the Personal Data Protection Law No. 91/2025/QH15 and current implementing legislation. This English edition is an unofficial translation for reference; the official legal texts are in Vietnamese.
Meet the LexData teamGo further with LexData
PDPL Compliance Consulting for Businesses
Work with our lawyers on the filings and documents, end to end.
Learn about the service