Personal Data Protection Law 91/2025/QH15 turns data subject rights — to know, to consent, to withdraw consent, to access, to erase, to restrict processing — from statements of principle into an operating duty: the enterprise must run a real request-handling workflow with an owner, internal deadlines and proof of execution. This article builds that workflow for the two hardest requests: erasure and consent withdrawal.
Governing Instruments
The rights system and the enterprise’s matching duties
Personal Data Protection Law 91/2025/QH15 grants data subjects a complete set of rights: to be informed of processing; to consent and to withdraw consent; to access, view and obtain their data; to request rectification; to request erasure; to request restriction of processing; to object to processing; and to complain, denounce, sue and claim compensation. Consent under the Law must be clear and specific to each purpose — silence or a pre-ticked box is not consent — and withdrawing consent must be as easy as giving it. Every right in this list maps to an action duty on the controller: no right is real on paper unless the enterprise maintains an intake channel and an accountable handler.
On deadlines, the Law delegates the detailed procedure and time limits for receiving and handling data-subject requests to the Government — now specified in Decree 356/2025/ND-CP, which replaced Decree 13/2023 from 1 January 2026. That does not license silence pending guidance: a valid request must be logged, the requester’s identity verified, the request handled without delay, and any refusal or extension notified with reasons. The internal workflow should therefore set its own operating marks (recommended: acknowledge within 72 hours, complete within 30 days) as a service commitment — expressly an internal standard set under the legal framework, not a statutory figure that exists for every request type.
Application Analysis
Erasure requests are where subject rights collide hardest with retention duties. The enterprise may — and often must — refuse or defer erasure for: records that sector law requires to be retained (accounting documents under Accounting Law 88/2015/QH13, labour and social insurance files, tax records within the reassessment limitation period); data that is evidence in an ongoing dispute, inspection or proceeding; and data needed to establish, exercise or defend the enterprise’s legal claims. The correct handling is neither delete-everything nor refuse-everything: split the data into a retain part (access-locked, no processing beyond storage) and an erase part (actually deleted from live systems and from backups on the backup cycle), and answer the subject in writing identifying the retention basis.
System-wise, erasure and withdrawal rights are only enforceable if IT is designed for them: personal data must be locatable per subject (one identity key across the CRM, HR system, email marketing platform and data warehouse), deletion must propagate to satellite systems and processors, and consent withdrawal must take immediate effect on consent-based flows — above all marketing lists. Three features are commonly forgotten: a full log of every request and its outcome to prove compliance when the specialised authority inspects; a suppression list holding the minimum information needed to ensure a person who withdrew consent is not re-imported into processing lists; and identity verification robust enough to prevent fraudulent erasure of someone else’s data.
Recommended Actions
- Designate the data-subject request intake point (within the personal data protection function) and publish the channel in the privacy policy.
- Issue an internal procedure: intake → identity verification → classification → handling → written reply; set internal marks (72-hour acknowledgement, 30-day completion) with escalation on breach.
- Build a retention-basis matrix per data category (accounting, labour, tax, disputes) so erasure requests are answered part by part, on stated grounds.
- Upgrade systems: unified subject identity, propagating deletion to satellite systems and processors, a suppression list for withdrawn consents, and full request lifecycle logging.
- Train front-line staff (customer care, HR, marketing) to recognise requests and route them to the intake point the same day, never to improvise answers.
Frequently Asked Questions
What rights do data subjects have under Law 91/2025 — erasure, consent withdrawal, restriction?
Personal Data Protection Law 91/2025/QH15 grants a system of rights: to be informed about processing of their data; to consent and to withdraw consent; to access, view and obtain a copy of their data; to request rectification of inaccurate data; to request erasure; to request restriction of processing; to object to processing; and to complain, denounce, sue and claim damages. Withdrawal does not retroactively invalidate processing already performed, but the enterprise must stop consent-based processing as soon as a valid withdrawal is received. Restriction lets the subject require processing to pause in cases such as while data accuracy is being verified or an objection is being considered.
Within what time limit must an enterprise build its intake and handling workflow for data-subject requests?
Law 91/2025 delegates the detailed procedure and time limits to the Government — now specified in Decree 356/2025/ND-CP — so there is no single statutory SLA in the Law for every request type. The mandatory principles are: log the request, verify the requester’s identity, handle it without delay and notify the outcome; if refusing or needing more time, give the subject reasons. Operationally, enterprises should set internal marks — acknowledgement within 72 hours and completion within 30 days is a common operating standard — and tell subjects plainly that these are the enterprise’s own commitments. The one absolute to avoid is a request disappearing for want of an owner: that is an organisational violation, not a deadline one.
When may an enterprise refuse an erasure request?
Three main groups. First, records that sector law requires to be kept: accounting documents under Accounting Law 88/2015/QH13, labour and social insurance files, tax records while the tax authority’s reassessment window remains open. Second, data that is evidence or the subject of an unfinished dispute, complaint, inspection or proceeding. Third, data necessary to establish, exercise or defend the enterprise’s legal rights and interests. Refusal must be partial and reasoned in writing, ground by ground; the retained part must be processing-locked — stored only, used for nothing else — and erased as soon as the retention ground lapses.
What IT features does an enterprise need to execute erasure and consent-withdrawal rights?
Four foundation features: (1) a unified subject identity — one key linking the same person’s data across the CRM, HR system, marketing platform and warehouse, because data that cannot be located cannot be erased; (2) propagating deletion — a deletion at the core system must trigger deletion at satellite systems and processors and be handled on backups under the published backup cycle; (3) a suppression list holding the minimum information to keep a person who withdrew consent out of consent-based flows; (4) end-to-end logging — intake, verification, handling and reply for every request, as compliance evidence for inspections and as the record for answering complaints.
