Withdrawal of consent in Vietnam and restriction of processing: what businesses must do under Article 10 of Law 91/2025

What is withdrawal of consent in Vietnam?

Withdrawal of consent in Vietnam is a data subject's request that a business stop processing personal data they had previously allowed. It is a right under Point b, Clause 1, Article 4 of the Personal Data Protection Law No. 91/2025/QH15 (PDPL), and follows from Point c, Clause 4, Article 9: consent is valid only until the data subject changes it. How to obtain valid consent is covered in what is consent.

Article 10 of the PDPL deals with two requests together: withdrawing consent and restricting processing. Clause 1 links them to cases where the data subject "doubts the scope or purpose of processing or the accuracy of the personal data". In LexData's reading, this condition mainly applies to restriction requests. Withdrawal of consent in Vietnam is a general right under Articles 4 and 9, so a business should not ask the data subject to justify a withdrawal.

For readers used to the GDPR: the right to withdraw consent at any time is familiar, but Vietnam adds fixed deadlines in days and a written or verifiable format for the request. There is also no general "legitimate interests" basis like the one in the GDPR; Article 19 lists narrower cases. So when consent is withdrawn, the processing usually has to stop unless Article 19 or another law applies.

What is restriction of processing?

Restriction means limiting how personal data is processed, rather than stopping entirely or deleting it. The PDPL does not define it in detail. In practice, restriction usually means the business keeps the data but pauses its use for some or all purposes while the data subject's doubts are resolved. For example, a customer believes their internal credit score is based on wrong data and asks the bank not to use it for a loan decision until the data is corrected.

For erasure, see right to erasure; for an overview of all rights, see data subject rights.

How must a withdrawal request be made?

Under Clause 2, Article 10 of the PDPL, both types of request must be in writing, including electronic or other verifiable formats, and are sent to the controller or controller-processor. They are handled in line with the law and the agreement between the parties.

Clause 1, Article 5 of Decree 356/2025/ND-CP requires the business to set up clear procedures and forms for data subject requests and to make sure data subjects know about them. A practical rule: withdrawing consent should be as easy as giving it. If a customer consented with one tap in an app, let them withdraw with one tap, not by posting a letter. Deliberately hiding, blocking or obstructing withdrawal of consent is fined VND 20 to 30 million (Point a, Clause 1, Article 45 of Decree 330/2026/ND-CP).

Deadlines for withdrawal of consent in Vietnam

Clause 2, Article 5 of Decree 356/2025/ND-CP provides:

1. Respond within 2 working days, with full information on the procedure for stopping the processing.
2. Act within 15 days. If processors or third parties must also stop, the deadline is 20 days.
3. For complex requests, one extension of up to 15 days is allowed. The business must tell the data subject why and bear the burden of showing the extension is necessary and reasonable.

Article 10 also requires the controller to instruct its processors to act on the request (Clause 3). This step is often missed: the customer has unsubscribed on the website, but the list still sits in the email platform, call centre or a third party's advertising account. Every processor contract should set a deadline for this, see the data processing agreement.

When does processing not have to stop?

There are two key limits:

• No retroactive effect. Clause 4, Article 10 of the PDPL provides that these requests do not apply to processing carried out before the request. Processing that was lawful at the time does not become unlawful.
• Article 19 and other laws. Clause 1, Article 10 excludes the cases of processing without consent in Article 19 and cases where another law provides otherwise. For example, a bank must still keep transaction records under anti-money laundering law, and any business must keep accounting records for the statutory period.

If the business refuses or only partly fulfils a request, it must tell the data subject the legitimate reason. Failing to do so is fined VND 10 to 20 million (Point dd, Clause 1, Article 44 of Decree 330/2026/ND-CP).

Fines for ignoring withdrawal of consent in Vietnam

Decree 330/2026/ND-CP sets these fines for organisations (individuals pay half):

• VND 10 to 20 million: no procedure or forms for data subject requests; no response within 2 working days; no reasons given for a refusal or extension (Clause 1, Article 44).
• VND 20 to 30 million: a processor or third party that does not stop processing within the deadline set by the controller (Clause 2, Article 44); obstructing withdrawal, not stopping processing after withdrawal, or not instructing processors and third parties to stop (Clause 1, Article 45).
• VND 30 to 40 million: not acting on a withdrawal, restriction or objection within 15 days, 20 days or the extended period (Point a, Clause 3, Article 44).
• VND 50 to 70 million: deliberately continuing to process personal data after the data subject has asked to stop or restrict it (Point a, Clause 2, Article 43).

Remedial measures include deleting the data processed after the withdrawal, handing over any revenue earned from continued use, and building a clear, accessible technical mechanism for withdrawing consent (Clause 2, Article 45). For other penalties, see PDPL penalties.

Checklist for handling withdrawal of consent in Vietnam

1. Offer a way to withdraw at every point where consent is collected: app, website, text message, email, service counter.
2. Log the time each request arrives to track the 2-working-day and 15-day deadlines.
3. Identify which processing relies on consent and which has another basis (Article 19 or a legal duty).
4. Stop consent-based processing in internal systems and instruct every processor and third party involved to stop.
5. For restriction requests, flag the data, block the restricted purposes and resolve the data subject's doubts.
6. Tell the data subject the outcome, or the reason for any refusal or extension, in a format that can be kept.
7. Consider deleting data with no remaining basis, and keep records of the whole process for inspections.