Right to erasure in Vietnam: when personal data must be deleted or destroyed under Article 14 of the PDPL
The right to erasure in Vietnam is the data subject's right to ask the controller to delete their personal data (Point d, Clause 1, Article 4 of the Personal Data Protection Law No. 91/2025/QH15). Article 14 of the PDPL sets out six cases in which personal data must be deleted or destroyed, when a request may be refused, and a duty to delete securely so the data cannot be restored without authorisation. Under Article 5 of Decree 356/2025/ND-CP, the business must act within 20 days.
Personal Data Protection Law No. 91/2025/QH15 & Decree 356/2025/ND-CP
Official legal texts
Key takeaways for businesses
- Personal data must be deleted or destroyed in six cases under Clause 1, Article 14 of Law 91/2025/QH15. A data subject's request is only one of them; achieving the processing purpose and the end of a statutory retention period also require deletion.
- A business may refuse an erasure request in the cases in Article 19 of the PDPL, or where the request breaches Clause 3, Article 4, but must tell the data subject (Clauses 2 and 5, Article 14).
- Deadlines: respond within 2 working days and complete the deletion within 20 days, or 30 days where a processor or third party must also delete. One extension of up to 20 days is allowed (Clause 4, Article 5 of Decree 356/2025/ND-CP).
What is the right to erasure in Vietnam?
The right to erasure is one of the data subject rights in Point d, Clause 1, Article 4 of the Personal Data Protection Law No. 91/2025/QH15: the data subject may "request the provision, deletion or restriction of processing of personal data". It is close to the GDPR's right to erasure, but Vietnam's approach differs in one important way. Article 14 covers deletion on request and also the cases in which a business must delete or destroy data on its own initiative, even if nobody asks.
The PDPL uses the phrase "delete or destroy" without defining each term. In practice, LexData reads them as follows:
- Deletion removes data from live systems such as a CRM, database or email marketing tool.
- Destruction makes the data unrecoverable, for example by destroying paper files or wiping or destroying storage media.
- De-identification is different: the data remains, but it can no longer identify a specific person. See de-identification.
The right to erasure in Vietnam sits within the wider set of rights covered in data subject rights.
Six cases where personal data must be deleted under Article 14
Cases for deleting or destroying personal data under Clause 1, Article 14 of Law 91/2025
| Point | Case | Triggered by | Example |
|---|---|---|---|
| a | The data subject requests it and accepts the possible risks and damage | Data subject | A customer asks to close their app account and delete their purchase history |
| b | The processing purpose has been achieved | The business | Applicant files after a recruitment round closes |
| c | The retention period required by law has ended | The business | Records past their mandatory retention period |
| d | A decision of a competent state authority | State authority | An order to delete unlawfully collected data |
| dd | By agreement | The parties | A service contract requiring deletion when it ends |
| e | Other cases provided by law | Depends on the law | Sector rules on destroying records |
For Point a, the data subject's request must follow the principles in Clause 3, Article 4. It must aim to protect the data subject's own lawful rights and interests, must not obstruct the business's legal obligations, and must not infringe the rights of others.
Refusing the right to erasure in Vietnam: when is it allowed?
Clause 2, Article 14 allows a business not to act on an erasure request in two groups of cases:
- The cases in Article 19 of Law 91/2025/QH15 (processing without consent). Examples are data needed to perform a contract that is still in force (Point d, Clause 1, Article 19) and data other laws require you to keep, such as accounting and tax records (Point dd). See processing without consent.
- Requests that breach Clause 3, Article 4. An example is an employee asking to erase a disciplinary record to avoid liability in an ongoing dispute.
Even when refusing for a legitimate reason, the business must notify the data subject (Clause 5, Article 14). The most common mistake LexData sees is a generic reply such as "we cannot delete this under company policy". The reply should state which data is kept, the legal basis, how long it will be kept, and what has been deleted.
Deadlines for the right to erasure in Vietnam
Clause 4, Article 5 of Decree 356/2025/ND-CP sets the following deadlines:
Deadlines for erasure requests under Clause 4, Article 5 of Decree 356/2025
| Step | Deadline |
|---|---|
| Respond and explain the procedure to the data subject | 2 working days |
| Complete the deletion | 20 days |
| Complete it where a processor or third party must also delete | 30 days |
| Extension (complex requests) | Once only, up to 20 days, with reasons given and the business able to show it was necessary |
These deadlines are shorter than the GDPR's one month (extendable by two more months), and a processor's share of the work is built into the 30-day limit. According to LexData's summary of Decree 330/2026/ND-CP, Article 44 of that decree fines a controller VND 30–40 million for missing the erasure deadline. It fines VND 10–20 million for having no procedure or form for receiving requests, or for not responding within 2 working days.
How to honour the right to erasure lawfully
Clauses 3 and 4 of Article 14 set three requirements:
- Delete or destroy securely, preventing intrusion into and unauthorised restoration of deleted data.
- Pass the request on. The controller must ask processors and third parties holding the data to delete it too, so your data processing agreement should include deletion and confirmation clauses.
- Never deliberately restore deleted or destroyed data without authorisation.
In LexData's reviews, "deleted" data often survives in: spreadsheets exported from the CRM and emailed internally; email and SMS marketing platforms; sales staff chat groups; backups; and courier or call-centre systems. Mapping your data flows first, as in a record of processing activities, is the fastest way to know where to delete.
Checklist for implementing the right to erasure in Vietnam
- Provide a channel and form for erasure requests, with a way to verify that the requester is the data subject.
- Assign an owner and track the 2-working-day, 20-day and 30-day deadlines.
- List the systems and processors holding each type of data.
- Identify data other laws require you to keep (accounting, tax, labour) and for how long; see personal data retention periods.
- Set a retention period for each type of data and a schedule for deleting it when the purpose ends.
- Use a standard reply to the data subject: what was deleted, what was kept, and on what basis.
- Keep evidence of deletion (system logs, processor confirmations) for inspections.
Insight from lawyer Ho Thi Ha Nhi
"Many businesses prepare only for customers asking for deletion, and forget that Article 14 of Law 91/2025 also requires them to delete data themselves once the purpose has ended. Old data you no longer use is both an unmet obligation and the biggest liability if a breach occurs. Set retention periods at the point of collection."
Frequently asked questions
A customer asks us to delete their data, but we must keep invoices and accounting records. What should we do?
You may keep the data that other laws, such as accounting and tax law, require you to retain. The basis is Clause 2, Article 14 and Article 19 of Law 91/2025/QH15; Point dd, Clause 1, Article 19 covers other cases provided by law. The rest, such as marketing data and behavioural profiles, must still be deleted. You must tell the customer what cannot be deleted and why (Clause 5, Article 14).
Do we have to delete the data from backups too?
Law 91/2025/QH15 has no specific rule on backups. However, Clause 3, Article 14 requires deletion by secure means that prevent unauthorised restoration. LexData recommends flagging deleted records so they are not restored when a backup is used, letting backups expire on a published schedule, and explaining this in the reply to the customer.
Must we delete data on our own initiative when nobody asks?
Yes. Points b and c, Clause 1, Article 14 of Law 91/2025/QH15 require deletion or destruction once the processing purpose is achieved or the retention period ends. Examples are files on unsuccessful job applicants and attendee data after an event. Set a retention period for each type of data and run scheduled deletion reviews.
Can we de-identify data instead of deleting it?
Properly de-identified data is no longer personal data (Clause 1, Article 2 of Law 91/2025/QH15), so de-identification is a common way to keep statistics. When a data subject asks for erasure, however, the safer approach is to delete the original records and keep only aggregated figures that cannot be re-identified. Re-identification is prohibited (Point b, Clause 6, Article 14).
The Vietnamese original of this entry has been reviewed for legal accuracy against the Personal Data Protection Law No. 91/2025/QH15 and current implementing legislation. This English edition is an unofficial translation for reference; the official legal texts are in Vietnamese.
Meet the LexData teamGo further with LexData
PDPL Compliance Consulting for Businesses
Work with our lawyers on the filings and documents, end to end.
Learn about the service