Can Companies Refuse to Disclose Data to State Authorities?

The police send a written request for all of your customer data. The tax authority demands transaction statements. Inspectors ask for access to internal systems. In these situations, can a company refuse?

The short answer: no — a company may not refuse a lawful request — but it may verify the requests legality, and it may refuse requests lacking legal grounds. This article analyzes the current legal framework and gives companies a four-point checklist for every data request received.

1. Four cases where disclosure is mandatory

Under Article 18.2, Data Law 60/2024/QH15 (promulgated 30 November 2024, effective 1 July 2025), disclosure is mandatory upon a competent authoritys request in four cases — without the data subjects consent:

State of emergency;
Threats to national security;
Disasters (natural disasters, epidemics);
Anti-riot and anti-terrorism operations.

Watch the statute number: the Data Law is 60/2024/QH15 (effective 1/7/2025) — some materials wrongly cite “60/2025/QH15”; use the correct number.

2. Beyond the four cases: duties under specialized laws

Even outside the four emergency cases, companies must still disclose data and documents under specialized laws, for example:

Proceedings: providing evidence and documents at the request of procedural authorities;
Inspection: providing dossiers and books to competent inspection teams;
Tax: providing information and documents for tax administration;
Cybersecurity: cooperation duties under the Cybersecurity Law 116/2025/QH15 (effective 1/7/2026) and Decree 333/2026/ND-CP.

The personal-data framework is now the Personal Data Protection Law 91/2025/QH15 (effective 1/1/2026) — Decree 13/2023/ND-CP is no longer cited as current authority.

3. What form must a lawful data request take?

Under Article 8.2, Decree 165/2025/ND-CP, a state authoritys data request must be in writing, specifying:

The type, level, volume, and frequency of data;
The method of provision;
The legal grounds and purpose of the request;
The deadline;
Notice of sanctions for non-provision.

Oral requests, informal messages, or letters stating no legal basis do not meet the statutory form — this is the first thing a company should check.

4. Four rights of the company upon receiving a request

Right 1: Demand the written request and proof of authority

The company may require the authority to produce a properly formed written request stating the legal grounds and competence of the requesting person/authority. Without a valid document, the company has grounds to withhold provision.

Right 2: Demand confidentiality and purpose limitation

Under Article 18.3, Data Law 60/2024/QH15, the state authority must: use the data for the stated purpose only; ensure data security and safety; and destroy the data when no longer needed, notifying the provider. Companies should record these commitments in writing (a data handover record).

Right 3: Limit the scope of disclosure

Disclose only the type and volume stated in the written request. Over-disclosure — e.g., handing over the entire customer database when only 10 records were requested — breaches personal-data protection duties and creates risk for the company itself.

Right 4: Refuse requests lacking legal grounds

For requests with no written document, no legal basis, or beyond the authoritys competence, the company may refuse — preferably in writing, stating the reasons and inviting the authority to complete the statutory procedure, rather than silently stonewalling.

5. Four-point checklist for every data request

☐ 1. Who is asking? — Is the requesting authority/person legally competent?
☐ 2. Where is the document? — Does the written request cover type/level/volume/method/grounds/purpose/deadline + sanction notice?
☐ 3. What scope? — Is the requested data limited to what is necessary, excluding irrelevant data?
☐ 4. What safeguards? — Has a handover record been made, noting confidentiality, purpose limitation, and destruction duties?

6. Internal procedures companies should build

Single intake point: all state-authority requests go to legal/compliance; no department discloses on its own;
24–48 hour assessment: run the four-point checklist, consult counsel for broad or sensitive requests;
Recorded handover: document the data provided, its purpose, retention period, and the recipients destruction duty;
File retention: keep all request documents, handover records, and correspondence to evidence compliance.

7. Three scenarios companies commonly face

Scenario A — Police request for customer data in a fraud investigation. This typically falls under procedural law duties, not the four emergency cases. Check: written request with legal basis (Criminal Procedure Code provisions), scope limited to the suspects transactions, handover record made. Provide what is requested — no more.

Scenario B — Tax authority requests three years of transaction data. A routine tax administration request. Verify the decisions legal basis, confirm the data range matches the inspection decision, and deliver through the official channel with a receipt.

Scenario C — An official calls asking for an employee’s personal file “urgently” by phone. No written request, no stated legal basis — this fails the Article 8.2 form requirement. Politely decline by phone, ask for the written request, and route it to legal/compliance. Most improper disclosures start with exactly this kind of informal pressure.

8. FAQ

Q: If the customer does not consent, may the company still disclose their data?
A: In the four mandatory cases (Art. 18.2, Data Law), yes — without the data subjects consent. Outside those cases, the specialized laws and the Personal Data Protection Law 91/2025/QH15 apply.

Q: What happens if we refuse a lawful request?
A: Depending on severity: administrative penalties, and where proceedings are obstructed or serious consequences follow, criminal liability for the individuals involved.

Q: Can the authority share our data with third parties?
A: No — Article 18.3 limits use to the stated purpose. Onward sharing beyond that purpose would breach the authoritys own duties; if you learn of it, raise it in writing with the authority and seek counsel.

Q: The request is in Vietnamese only and our management does not read Vietnamese. Can we ask for more time?
A: Yes — acknowledge receipt promptly, explain the need for translation and legal review, and propose a reasonable response timeline. Authorities generally accept short, reasoned extensions when the company shows good-faith engagement.

9. Legal bases

Data Law 60/2024/QH15 (effective 1/7/2025): Art. 18 (18.2, 18.3)
Decree 165/2025/ND-CP: Art. 8.2
Personal Data Protection Law 91/2025/QH15 (effective 1/1/2026)
Cybersecurity Law 116/2025/QH15 (effective 1/7/2026); Decree 333/2026/ND-CP

Note: General legal information as of 14 October 2026; specific data requests must be assessed against the actual request document.

Transparency note: This article was prepared by the FLAW AI Legal Council; its legal content is awaiting review by the QA Council before approval. This is general legal information, not a substitute for legal advice on a specific matter.

For advice on a specific case, please contact FLAT Law Firm.