Closing a data center is harder than opening one at exactly one point: the customers’ data. The operator is a data processor — it does not own the data — so when the facility closes, every drive leaving the building must pass through an evidenced return-or-erasure process, and the hardware then becomes e-waste in the hazardous-waste group that must go to a licensed treatment operator.
Deleting customer data on closure: the processor’s principles
Under Personal Data Protection Law No. 91/2025/QH15, a data center operator, in relation to colocation and hosting customers’ data, acts as a personal data processor: it processes only on the instructions of the customer as controller, and when the processing relationship ends it must return all data or erase it as the controller directs. Closing the facility gives the operator no right whatsoever over data still sitting in customers’ servers — even where a customer still owes fees.
A lawful erasure process has four evidenced steps: one, inventory every storage medium holding customer data by customer and by device; two, execute the customer’s instruction — return data and equipment, or erase on site under the customer’s witnessing or confirmation; three, apply an irreversible erasure method proportionate to the data’s sensitivity — overwriting, degaussing or physical destruction of the storage medium to recognised technical standards such as NIST 800-88; four, draw up an erasure and destruction record for each equipment lot and retain that file even after the operator has wound down operations at the facility.
Liquidating old servers: is “certified data erasure” mandatory?
Vietnamese law issues no State “data erasure certificate” and does not require liquidated servers to carry one. But the practical conclusion is no lighter: the personal data protection duties of controller and processor last until the data is fully erased, so if a liquidated drive is found still holding users’ personal data, both the customer as controller and the operator as processor face liability and sanctions under Personal Data Protection Law No. 91/2025/QH15 and Decree 330/2026/ND-CP.
Because there is no State certificate, the market substitutes contractual evidence: a data destruction record signed by the parties, and a data erasure certificate from a professional processing firm stating the erasure method to technical standards and the serial number of each drive, plus clauses in the liquidation contract binding the buyer of old equipment. For drives holding sensitive data — financial, medical — the prudent practice is physical destruction rather than logical erasure and resale, because destruction costs far less than the legal risk of residual data.
Where must a data center’s e-waste go?
Discarded servers, boards, backup batteries, accumulators and electronic components of a data center fall into the hazardous waste group under the Law on Environmental Protection No. 72/2020/QH14 and Decree 08/2022/ND-CP because they contain heavy metals and toxic chemicals. The waste source owner — the operating enterprise — must identify, classify, label and store hazardous waste as prescribed, prepare hazardous waste documentation and hand it over to an operator holding an environmental licence with the corresponding hazardous waste treatment function.
Selling intact old equipment to a buyer for reuse is an ordinary asset transaction if the data has been handled by the process above; but damaged components, swollen batteries and burnt boards may not be sold to unlicensed scrap collectors or buried privately — transferring hazardous waste to an unlicensed organisation draws environmental administrative sanctions under Decree 45/2022/ND-CP and can attract criminal liability for serious consequences. When an entire facility closes, the project’s environmental file must also be closed correspondingly, including confirmation that all waste generated during dismantling has been handed over.
Customer notification and a safe closure sequence
There is no single statutory notice period for closing a data center; the notice period follows each customer’s rental contract — long-term colocation contracts usually carry notice and migration-support clauses. As risk management, the operator should notify far earlier than the contractual minimum: customers need time to procure a new facility, move equipment and synchronise data, and an overly abrupt notice can be treated as a breach of the duty to cooperate, causing customer loss and compensation claims.
A safe closure sequence: formal notice to all customers with a migration roadmap; a freeze on new customers and infrastructure changes; support for customers to withdraw equipment and data on the agreed schedule; erasure of data on shared infrastructure and operator-owned equipment holding customer data; e-waste treatment through a licensed operator; and finally closing the legal file — terminating the data center service provision registration, finalising tax and duties toward regulators. This order ensures data duties are performed while the operator still has staff and budget, rather than leaving customer data to the final liquidation phase.
Frequently asked questions
When closing a data center, how must customer data be deleted to comply with the law?
Under the processor role in Personal Data Protection Law No. 91/2025/QH15: the operator may not keep or use customer data on its own initiative; on closure it must return all data and equipment to the customer, or erase the data as the customer directs by an irreversible method — overwriting, degaussing or physical destruction of the storage medium to technical standards such as NIST 800-88 — and draw up an erasure and destruction record for each equipment lot. Every step must be evidenced in writing, because the data protection duty ends only when the data has actually been erased or returned.
Must decommissioned servers have certified data erasure before liquidation?
There is no State-issued “data erasure certificate” and the law does not require one on liquidation. Instead, the market and contracts require equivalent evidence: a data destruction record between the parties and a data erasure certificate from a professional processing firm, stating the erasure method to technical standards and each drive’s serial number. Liability is no different: if liquidated equipment still holds personal data, the controller and the processor are still sanctioned under Personal Data Protection Law No. 91/2025/QH15 and Decree 330/2026/ND-CP — so for drives holding sensitive data, physical destruction is the recommended safe option.
Where is e-waste from a data center disposed of?
A data center’s e-waste — failed servers, boards, batteries and accumulators — belongs to the hazardous waste group and must be handed to an operator holding an environmental licence for hazardous waste treatment under the Law on Environmental Protection No. 72/2020/QH14 and Decree 08/2022/ND-CP, accompanied by hazardous waste documentation. The enterprise may not bury it privately or sell it to unlicensed scrap collectors; transferring hazardous waste to an unlicensed unit is sanctioned under Decree 45/2022/ND-CP. Equipment still usable, once its data has been erased by due process, may be sold as an ordinary asset.
How far in advance must customers be notified?
It follows the customer’s rental contract — the law sets no single number of days for closing a data center. Long-term colocation contracts usually carry a notice period and migration-support clause; good management practice is notice around 90 to 180 days ahead, or earlier for large customers, because customers need time to select a new facility and migrate systems. Notice more abrupt than the contractual commitment exposes the operator to liability for the losses customers incur.
This article has been quality-reviewed by the FLAW AI Legal Council