Vietnamese law does not set a single fixed maximum for how long personal data may be retained. The Personal Data Protection Law 91/2025/QH15 (the current framework, replacing Decree 13/2023/ND-CP which expired on 1 January 2026) applies a purpose-based principle: data may be stored only for a period appropriate to the purpose of processing, unless sector-specific law provides otherwise.
Short answer
- General rule: retention “for a period appropriate to the purpose of personal data processing, unless otherwise provided by law” (Article 3.3, Law 91/2025).
- When the purpose ends → delete: once the processing purpose is fulfilled or the statutory retention period expires, the data processor must erase and destroy the data (Article 14.1.b, 14.1.c).
- Penalty: retaining employees’ personal data beyond the necessary period can trigger a fine of VND 50–70 million (Article 61.2, Decree 330/2026/ND-CP).
What “no fixed maximum” means in practice
Unlike rules that impose a flat ceiling in years, Law 91/2025 ties retention to the processing purpose communicated to the data subject. A company that collects data for recruitment, contract performance, or customer care may keep it only as long as appropriate for that stated purpose.
When the purpose is fulfilled — for example, an unsuccessful candidate’s file after the announced retention window, or a fully settled contract — continued storage loses its lawful basis.
Duty to erase and destroy data
Article 14.1 of Law 91/2025 imposes a clear obligation on data processors:
- Article 14.1.b: when the purpose of personal data processing is fulfilled → erase and destroy the data.
- Article 14.1.c: when the statutory retention period expires → erase and destroy the data.
Erasure here means more than hiding records from a dashboard: data must be unrecoverable by ordinary means. Businesses should maintain technical procedures and written records of deletion to demonstrate compliance during inspections.
Sector-specific retention periods
Article 3.3 anticipates cases “otherwise provided by law” — many sectors have their own retention rules, for example:
- Employee records: retention tied to the employment relationship and post-termination obligations (social insurance, personal income tax) under labour, social insurance, and tax law.
- Accounting documents: minimum retention of 5 years, 10 years, or permanent depending on type, under the Accounting Law.
- Banking, telecom, healthcare data: sector laws may impose longer retention for anti-money-laundering, complaint handling, and traceability purposes.
Application rule: where sector law sets a specific period, follow it; where it does not, apply the purpose-based principle of Article 3.3.
Consequences of over-retention
Article 61.2 of Decree 330/2026/ND-CP sets a fine of VND 50–70 million for retaining employees’ personal data beyond the necessary period. To manage this risk, businesses should:
- Review periodically: maintain an inventory of stored personal data and match it against processing purposes and sector-specific deadlines.
- Deletion procedures: adopt internal rules on when each data group is erased, assign responsibilities, and keep execution logs.
- Contracts with processors: require third parties (HR vendors, marketing agencies) to commit to deleting data once the purpose ends and to report compliance.
FAQ
May a company keep unsuccessful candidates’ files “just in case”? Only for the period appropriate to the announced purpose (e.g., consideration for future openings within a defined window, with the candidate’s consent). Indefinite “reserve” storage is over-retention and may be penalised.
What if expired data is evidence in an ongoing dispute? Continued retention is lawful where the data is needed for pending disputes, complaints, or proceedings — a new processing purpose arises. Document the reason and the planned deletion date after the matter closes.
Is Decree 13/2023 still applicable? No. Decree 13/2023/ND-CP expired on 1 January 2026; the current framework is the Personal Data Protection Law 91/2025/QH15.
Sources
- Personal Data Protection Law 91/2025/QH15: Article 3.3, Article 14.1.b and 14.1.c; in force (current framework since 1 January 2026).
- Decree 330/2026/ND-CP, Article 61.2 — penalty for retaining employees’ personal data beyond the necessary period.
- Decree 13/2023/ND-CP — expired 1 January 2026, historical reference only.
Need a personal data compliance review? FLAT Law Firm advises on data protection policies, retention schedules, and deletion procedures under Law 91/2025. Contact us at https://flaw.vn/en/contact/.
This article is for general reference under current law as of 14 October 2026 and does not constitute legal advice for any specific matter. Consult a lawyer before acting.
Transparency note: This article was produced by FLAT Law Firm’s AI content production system and is going through internal review before publication. It has not been reviewed by a human lawyer.
