Data processing after termination of a data transfer agreement is one of the most important issues directly affecting the rights and interests of the parties to the agreement. The following article sets out legal regulations on such data processing and addresses several related issues in order to assist individuals and organizations in protecting their lawful rights and interests.
Data processing after termination of a data transfer agreement is one of the most important issues directly affecting the rights and interests of the parties to the agreement. The following article sets out legal regulations on such data processing and addresses several related issues in order to assist individuals and organizations in protecting their lawful rights and interests.
I. Current situation of data processing after termination of data transfer agreements
The current practice of data processing after the termination of data transfer agreements in Vietnam is being actively implemented and enforced in accordance with the Law on Personal Data Protection 2025, effective from January 1, 2026. Under legal regulations governing data processing and protection in transactions, enterprises are required to establish measures or procedures for processing the personal data of individuals and organizations after the termination of agreements, except in cases where data retention is required by law (such as for tax or dispute resolution purposes) or otherwise agreed by the parties.
Accordingly, enterprises are required to invest in technical systems and implement strict data processing procedures to ensure compliance and avoid legal risks, although practical implementation still requires time for enterprises to adapt to professional data governance requirements.
II. Understanding of data processing after termination of data transfer agreements
1. What is data processing after termination of a data transfer agreement?
Pursuant to Clause 6, Article 2 of the Law on Personal Data Protection 2025, personal data processing means any activity impacting personal data, including one or more of the following activities: Collection, analysis, consolidation, encryption, decryption, modification, deletion, destruction, de-identification, provision, disclosure, transfer of personal data, and other activities affecting personal data.
Accordingly, the processing of data following the termination of a data transfer agreement may be understood as the performance by the data controller or data processor of activities such as collection, analysis, consolidation, encryption, decryption, modification, deletion, destruction, de-identification, provision, disclosure, transfer of personal data, and other activities relating to the personal data of customers, partners, or employees after the termination of the agreement.
2. Important notes regarding data processing after termination of data transfer agreements
Pursuant to Article 17 of the Law on Personal Data Protection 2025, as guided by Article 7 of Decree No. 356/2025/ND-CP, regulations on data transfer are as follows:
- The transfer of personal data shall be conducted in the following cases:
- Transfer of personal data with the consent of the personal data subject;
- Sharing of personal data among departments within the same agency or organization for personal data processing consistent with the established processing purposes;
- Transfer of personal data for continued processing in cases of division, separation, merger of agencies, organizations, administrative units, restructuring, conversion of ownership forms of state-owned enterprises; division, separation, merger, consolidation, or termination of operations of units or organizations; and establishment of units or organizations based on the termination of operations of other units or organizations;
- Transfer of personal data by the personal data controller or the personal data controller and processor to a personal data processor or third party for personal data processing in accordance with regulations;
- Transfer of personal data at the request of competent state authorities;
- Transfer of personal data in cases not requiring the consent of the data subject as prescribed in Clause 1, Article 19 of this Law.
Pursuant to Clauses 2, 4, and 5 Article 7 of Decree No. 356/2025/ND-CP:
- The transfer of sensitive personal data must be accompanied by physical security measures for storage and transmission devices, encryption measures, anonymization of personal data, and other security measures during the transfer process.
- In cases where personal data is shared among departments within the same agency or organization for personal data processing consistent with the established processing purposes, the agency or organization must establish procedures to control the sharing and use of personal data in accordance with regulations and implement measures to prevent internal personnel from unlawfully sharing personal data with third parties.
- Personal data must be de-identified before being traded on data exchange platforms.
III. Legal regulations relating to data processing after termination of data transfer agreements
1. Important regulations relating to data processing after termination of data transfer agreements
- Pursuant to Clauses 1 and 2, Article 4 of the Law on Personal Data Protection 2025, as guided by Article 5 of Decree No. 356/2025/ND-CP, the rights and obligations of data subjects are as follows:
- To be informed about personal data processing activities;
- To consent or refuse consent, and request withdrawal of consent for personal data processing;
- To access, amend, or request amendment of personal data;
- To request provision, deletion, or restriction of personal data processing; and to object to personal data processing;
- To file complaints, denunciations, lawsuits, and claims for compensation for damages in accordance with law;
- To request competent authorities or agencies, organizations, or individuals involved in personal data processing to implement measures and solutions for protecting their personal data in accordance with law;
- To protect their own personal data;
- To respect and protect the personal data of others;
- To provide complete and accurate personal data in accordance with law, agreements, or upon consenting to personal data processing;
- To comply with laws on personal data protection and participate in preventing and combating acts infringing upon personal data.
- Pursuant to Point c, Clauses 1 and 2, Article 25 of the Law on Personal Data Protection 2025, the responsibility for protecting personal data of agencies, organizations, and individuals in recruitment, labor management, and employment is prescribed as follows:
- Information provided by job applicants must be deleted or destroyed in cases where such applicants are not recruited, unless otherwise agreed with the applicants;
- Personal data of employees must be deleted or destroyed upon termination of employment agreements, unless otherwise agreed or prescribed by law.
- Pursuant to Clauses 1 and 5, Article 5 of Decree No. 356/2025/ND-CP, personal data controllers and personal data controllers/processors must establish clear procedures, processes, and forms for exercising the rights of personal data subjects in accordance with personal data processing activities and the responsibilities of relevant departments; and ensure that personal data subjects are informed of procedures for exercising the rights prescribed in Clause 1, Article 4 of the Law on Personal Data Protection.
Upon receiving a request from a personal data subject for implementation of measures and solutions to protect their personal data in accordance with proper procedures, competent authorities or agencies, organizations, or individuals involved in personal data processing must respond within 02 working days, provide complete information to the personal data subject regarding procedures, and complete implementation within 15 days.
Depending on the nature and complexity of the request, where an extension is necessary, only one extension of no more than 15 additional days shall be permitted. The personal data controller or the personal data controller and processor must notify the personal data subject of the reason for the extension and bear responsibility for proving that such extension is necessary and reasonable.
2. Violations relating to data processing after termination of data transfer agreements
- Failure to comply with requests from data subjects regarding deletion or destruction of data after termination of data transfer agreements in accordance with legal regulations or contractual agreements.
- Failure to implement, or improper implementation of, security measures to prevent unauthorized access to and unlawful restoration of deleted or destroyed personal data; or intentional unlawful restoration of deleted or destroyed personal data.
- Transfer of data to third parties without the consent of the data subject after termination of data transfer agreements.
- Continued use of data obtained from terminated agreements for commercial, advertising, or research purposes without the consent of the data subject.
IV. Questions regarding data processing after termination of data transfer agreements
1. What are the consequences if the service provider fails to comply with proper data processing procedures after termination of a data transfer agreement?
Pursuant to Article 85 of Decree No. 15/2020/ND-CP, the following administrative sanctions are prescribed:
- A fine ranging from 10,000,000 VND to 20,000,000 VND shall be imposed for failure to notify the owner of personal information after deletion of stored personal information or failure to implement appropriate measures to protect personal information due to technical factors.
- A fine ranging from VND 20,000,000 to VND 30,000,000 shall be imposed for one of the following acts, such as failure to update, amend, or delete stored personal information at the request of the personal information owner; failure to provide the personal information owner with access rights to independently update, amend, or delete their personal information; or failure to delete stored personal information after the purpose of use has been fulfilled or upon expiration of the storage period.
- A fine ranging from 30,000,000 VND to 50,000,000 VND shall be imposed for failure to apply management or technical measures prescribed by law to protect personal information.
- Compensation for damages: Service providers may be liable for compensation arising from breaches of contractual obligations relating to data protection. Pursuant to Article 13, Article 360, and Clause 1, Article 419 of the Civil Code 2015, individuals and juridical persons whose civil rights are infringed are entitled to full compensation for damages, unless otherwise agreed by the parties or otherwise prescribed by law.
- Criminal liability: Service providers may be subject to criminal liability in cases of serious violations directly affecting the rights and interests of data subjects and satisfying all constituent elements of a criminal offence.
2. What customer rights and interests must be protected during the process of data processing after termination of a data transfer agreement?
Pursuant to Clause 1, Article 4 of the Law on Personal Data Protection 2025, as guided by Article 5 of Decree No. 356/2025/ND-CP, the rights of personal data subjects include:
- The right to be informed about personal data processing activities;
- The right to consent or refuse consent, and to request withdrawal of consent for personal data processing;
- The right to access, amend, or request amendment of personal data;
- The right to request provision, deletion, or restriction of personal data processing, and to object to personal data processing;
- The right to file complaints, denunciations, lawsuits, and claims for compensation for damages in accordance with law;
- The right to request competent authorities or agencies, organizations, or individuals involved in personal data processing to implement measures and solutions for protecting their personal data in accordance with law.
3. What types of data are prohibited from being processed after termination of data transfer agreements?
Pursuant to Clauses 1, 2, and 4, Article 14 of the Law on Personal Data Protection 2025, deletion and destruction of personal data shall be conducted in the following cases:
- Where requested by the personal data subject, who accepts all risks and damages that may arise therefrom. Requests made by personal data subjects in such cases must fully comply with the principles prescribed in Clause 3, Article 4 of this Law;
- Where the purposes of personal data processing have been fulfilled;
- Upon expiration of the statutory data retention period;
- Under decisions of competent State authorities;
- Under agreements between the parties;
- Other cases as prescribed by law.
Personal data controllers and personal data controllers/processors shall delete or destroy personal data in the cases prescribed in Clause 1 of this Article or request personal data processors or third parties to delete or destroy the personal data of personal data subjects. The deletion or destruction of personal data must be conducted using appropriate measures.
Agencies, organizations, and individuals are prohibited from intentionally and unlawfully restoring deleted or destroyed personal data.
4. What risks may arise during the process of data processing after termination of data transfer agreements?
- Security and information leakage risks: Customer data, financial information, and business strategies may be unlawfully accessed or disclosed, resulting in financial losses and reputational damage.
- Loss of control over data: Data not properly deleted or destroyed may be misused by recipients or accessed by unauthorized third parties.
- Breach of contractual agreements: Failure to comply with contractual provisions relating to data processing, confidentiality, and deletion after termination may lead to disputes.
5. Who is responsible for supervising data processing after termination of data transfer agreements?
Pursuant to Points g and i, Clause 1, Article 37 of the Law on Personal Data Protection 2025, the responsibilities of personal data controllers include:
- Being liable to personal data subjects for damages caused during personal data processing activities;
- Coordinating with the Ministry of Public Security and competent state authorities in personal data protection activities, and providing information serving investigation and handling of violations of personal data protection laws.
V. Do you need legal experts to assist with data processing after termination of data transfer agreements?
The above information provides answers to legal issues concerning data processing after termination of data transfer agreements as presented by NPLaw to our valued readers. With a team of experienced lawyers and legal professionals, NPLaw provides reputable and professional legal services to best protect the lawful rights and interests of clients. If you require assistance with legal matters, you may contact NPLaw for consultation and support.
The above information is for reference purposes only. Should clients require detailed advice regarding specific cases, please contact NPLaw Firm for immediate consultation.
