When a data subject submits a deletion request, the data controller/processor cannot sit on it indefinitely. Decree 356/2025/ND-CP sets a specific processing timeline: acknowledge within 2 working days, execute deletion within 20 days (30 days if third parties are involved), with only one permitted extension.
Short answer
- Acknowledge the request: within 2 working days of receipt (Article 5.4, Decree 356/2025/ND-CP).
- Execute deletion: within 20 days; where a data processor or third party is involved: 30 days.
- Extension: permitted once, for no more than 20 additional days.
- Note: the “72-hour” rule of Decree 13/2023/ND-CP is historical only — no longer the current basis.
The deletion-request timeline under Decree 356/2025
Step 1 — Receipt and acknowledgement (2 working days)
Article 5.4 of Decree 356/2025 requires the data controller to respond to the request within 2 working days of receiving a valid request from the data subject. The response confirms receipt and states how the request will be handled and the expected completion time.
Businesses need a clear intake point (email, form, hotline) and a procedure for recording the time of receipt — the 2-working-day clock starts there.
Step 2 — Execute the deletion (20 days / 30 days)
After acknowledgement, the controller/processor must carry out the deletion:
- 20 days — standard cases, where the data is managed by the controller itself.
- 30 days — where deletion involves a data processor (engaged to process data) or a third party (a partner that received transferred data), because coordination across parties takes longer.
“Execution” means the data must be deleted from the controller’s own systems and the related parties must be instructed to delete the data they received — “the third party hasn’t deleted yet” is not an excuse to exceed the 30-day mark.
Step 3 — Extension (if needed): once, max 20 days
Where there are legitimate grounds (large data volumes, complex technical systems, coordination with multiple third parties), the controller may extend the deadline once, by no more than 20 days. The data subject must be notified of the extension with reasons.
Data subjects’ rights when requests stall
If the deadlines pass without execution, the data subject may:
- Complain to the data controller and demand a written explanation.
- Report to the competent state authority on personal data protection.
- Sue for damages if the delay caused harm (e.g., the data was leaked or misused during the delay).
For businesses, failing to execute a deletion request on time is grounds for administrative penalties under Decree 330/2026/ND-CP.
Distinguishing the old “72-hour” rule of Decree 13/2023
Many older documents still cite a 72-hour deadline for handling data-subject requests under Decree 13/2023/ND-CP. That decree expired on 1 January 2026; the current framework is the Personal Data Protection Law 91/2025/QH15 and Decree 356/2025/ND-CP. Internal procedures and privacy policies still referencing “72 hours” under Decree 13/2023 should be updated to the current 2-working-day / 20-day / 30-day timeline.
What businesses should prepare
- Internal procedures: adopt an SOP for data-subject requests built around the 2-working-day – 20/30-day – one-extension milestones.
- Request log: record receipt time, handler, and progress at each step to prove compliance during inspections.
- Processor/third-party contracts: clauses obliging them to cooperate with deletion within the deadlines, avoiding a bottleneck at the 30-day mark.
- Update privacy policies: replace old timelines (72 hours under Decree 13/2023) with the current ones.
FAQ
Do the 2 working days include Saturdays and Sundays? No. “Working days” exclude weekly rest days and public holidays — factor this in when counting the acknowledgement deadline.
Does a request sent to a personal email count as “received”? Yes, if that channel is one the business has published for receiving data-related requests. Businesses should publish a clear official intake channel and monitor it regularly.
If backups still contain the data after deletion, is that a violation? Deletion must ensure the data is no longer used for processing; for backups, businesses need a mechanism to exclude deleted data from restores (e.g., a blocklist applied on recovery) and document it in procedures.
Sources
- Decree 356/2025/ND-CP: Article 5.4 (2-working-day acknowledgement), 20-day / 30-day execution rule, one extension of max 20 days; in force.
- Personal Data Protection Law 91/2025/QH15 — current framework since 1 January 2026.
- Decree 13/2023/ND-CP — expired 1 January 2026; the “72-hour” rule is historical only.
Need a data-request handling procedure? FLAT Law Firm advises on SOPs for receiving, acknowledging, and executing data-subject requests, and on updating privacy policies under Decree 356/2025. Contact us at https://flaw.vn/en/contact/.
This article is for general reference under current law as of 14 October 2026 and does not constitute legal advice for any specific matter. Consult a lawyer before acting.
Transparency note: This article was produced by FLAT Law Firm’s AI content production system and is going through internal review before publication. It has not been reviewed by a human lawyer.
