Children's personal data in Vietnam: protection under Article 24 of the PDPL (Law No. 91/2025/QH15)

Protecting children's personal data in Vietnam: core principles under Article 24 of the PDPL

Children's personal data is a specially protected category in privacy law. The boom in the digital space, online education platforms (EdTech), entertainment apps, social networks and online games has opened up limitless room for young people to learn and create. It has also brought serious information security dangers: children are the most vulnerable group when it comes to cyberattacks, identity theft, cyberbullying, online sexual abuse and unethical commercial exploitation through behaviour-steering algorithms.

Recognising how sensitive this is, the Vietnamese State has devoted Section 2 of Chapter II, with Article 24 of the Personal Data Protection Law No. 91/2025/QH15, together with the child-rights principles in the Law on Children No. 102/2016/QH13, to building a 'comprehensive legal shield' for children's personal data in Vietnam, online and in everyday life.

1. The age of a child under Vietnamese law and how it differs from international standards

A key point that digital businesses, especially multinational groups launching products in Vietnam, often get wrong is the age definition of a child:

• Under Vietnamese law (Article 1 of the 2016 Law on Children): a child is a person under 16. This definition applies throughout every rule in Article 24 of Law 91/2025/QH15.
• International comparison: the European Union's General Data Protection Regulation (GDPR) sets the age threshold at under 16 (member states may lower it to no less than 13), while the US Children's Online Privacy Protection Act (COPPA) uses under 13.

So if an international platform launching a game or social network in Vietnam applies its verification mechanism only to users under 13, it is breaching Vietnamese law in respect of users aged 13 to under 16.

2. Consent for children's personal data in Vietnam by age group under Clause 2, Article 24

Under Clause 2, Article 24 of Law 91/2025/QH15, the law divides a child's capacity to express their will into strict tiers (for the general principles of consent, see the handbook entry What is consent):

1. Children under 7: because they are not yet fully aware of privacy, all of the data subject's rights (including giving consent and requesting correction or deletion of data) are exercised on their behalf by the father, mother or legal representative.

2. Children aged from 7 to under 16 (double consent rule): the law recognises that the child's awareness is starting to form. The law states:

   "Processing the personal data of a child to publish or disclose information about the private life or personal secrets of a child aged 7 or over requires the consent of the child and of the legal representative."

   This rule commonly applies when schools, clubs, publishers or websites want to post a student's facial images, interview clips, academic results or family information on social media or in public media. Without the consent of either party (the parent agrees but the child objects, or the child agrees but the parent does not allow it), publication is unlawful.

   Beyond publication and disclosure, Point c, Clause 1, Article 60 of Decree 330/2026/ND-CP also penalises processing the personal data of a child aged 7 or over without the simultaneous consent of the child and the legal representative (except in the cases under Clause 1, Article 19 of Law 91/2025/QH15). Businesses should therefore apply double consent to all processing of this age group's data, not only to publication.

3. Individuals aged 16 and over: no longer children under the Law on Children and therefore outside Article 24, they exercise the data subject's rights personally under the general rules of Law 91. Note: persons aged 16 to under 18 are still minors under Article 21 of the 2015 Civil Code (an adult is a person aged 18 or over under Article 20).

3. The obligation to stop processing and delete children's data under Clause 3, Article 24

Under Clause 3, Article 24, controllers and processors must stop processing the child's personal data in the following two cases, unless the law provides otherwise. Clause 3, Article 60 of Decree 330/2026/ND-CP also penalises failing to delete or destroy the child's data in these same two cases, so the business needs to stop processing and delete or destroy the data:

• When the person who gave consent withdraws it: when the father, mother or child (in double consent cases) withdraws consent to processing, the organisation should deactivate the account, take down images/content already posted and delete the data from its storage systems. The law sets no specific number of hours, but good practice is to act as soon as the request is received.
• At the request of a competent authority: when a competent authority has sufficient grounds to show that the processing may infringe the lawful rights and interests of the child and requests that processing stop, the organisation must comply with that request.

4. Five golden rules for EdTech platforms, online games and schools

Organisations providing services aimed directly or indirectly at child users should apply the following 5 principles. These are LexData's practical recommendations; where there is a direct legal basis, it is cited:

Principle 1: Set up a reliable age verification gate

Point a, Clause 1, Article 60 of Decree 330/2026/ND-CP penalises failing to carry out an age verification process before processing a child's personal data. Businesses should not rely only on a simple self-declaration checkbox (such as 'I confirm that I am 18 or over'). Design a screen that asks for a specific date of birth right at the first step of account registration. If the user is under 16, the system must automatically trigger a dedicated child user flow.

Principle 2: Verifiable parental consent

To make sure that parental consent is genuine, businesses should deploy reasonable verification measures suited to available technology:

• Send an OTP code together with the privacy notice to the parent's official phone number or email.
• Ask the parent to sign electronically or authenticate through their VNeID electronic identification account.
• Verify through a micro-transaction on the parent's bank card, in line with international practice.

Principle 3: Data minimisation and switching off background location tracking

Collect only the minimum data needed for learning or entertainment. Do not silently collect phone contacts or microphone/camera access on a child's device where this does not directly serve the feature in use. For location data specifically, Point a, Clause 3, Article 31 of Law 91/2025/QH15 does not allow location tracking through radio-frequency identification tags or other technologies without the data subject's consent, unless a competent authority so requests or the law provides otherwise.

Principle 4: Keep profiling and targeted advertising to a minimum

We recommend that the business's IT systems switch off online behavioural tracking (tracking cookies) by default for child accounts, and do not build consumer behaviour profiles of, or show targeted/behavioural advertising to, users under 16. Law 91/2025/QH15 has no specific prohibition, but this processing still requires the consent of the legal representative (and of the child if aged 7 or over, under Clause 1, Article 60 of Decree 330/2026/ND-CP), and data tracking behaviour in cyberspace is on the list of sensitive data (Point l, Clause 1, Article 4 of Decree 356/2025/ND-CP).

Principle 5: Set up an emergency support channel for parents

Provide a hotline or a dedicated in-app button that lets parents review all the information their child has posted, correct it, or trigger permanent account deletion. We recommend acting within 24 hours; the statutory time limit for carrying out a deletion request is 20 days (30 days where the processor or a third party must be asked; extendable once by no more than 20 days) under Clause 4, Article 5 of Decree 356/2025/ND-CP.

5. Penalties for breaching rules on children's personal data in Vietnam under Decree 330/2026/ND-CP

Violations of the rules on protecting the personal data of children (and of persons who have lost or have limited civil act capacity, or who have difficulty perceiving or controlling their behaviour) are penalised under Article 60 of Decree 330/2026/ND-CP, with fines from VND 30,000,000 to VND 200,000,000 for organisations (individuals are fined half that amount under Clause 1, Article 7), depending on the conduct:

• Failing to carry out an age verification process before processing a child's data; processing the data of a child under 7 without the consent of the legal representative; processing the data of a child aged 7 or over without the simultaneous consent of the child and the representative (except in the cases under Clause 1, Article 19 of Law 91/2025/QH15): a fine of VND 30,000,000 to VND 50,000,000 (Clause 1, Article 60).
• Disclosing or publishing information about the private life or personal secrets of a child aged 7 or over without the simultaneous consent of the child and the representative: a fine of VND 50,000,000 to VND 100,000,000 (Point a, Clause 2, Article 60), together with being forced to take down the published information.
• Failing to stop processing a child's data when the legal representative withdraws consent or a competent authority so requests: a fine of VND 50,000,000 to VND 100,000,000 (Points b and c, Clause 2, Article 60), together with suspension of the related data processing for 1 to 3 months.
• Failing to delete or destroy a child's data when it is processed for the wrong purpose or the purpose has been fulfilled, when the parent/guardian withdraws consent, or at the request of a competent authority: a fine of VND 100,000,000 to VND 200,000,000 (Clause 3, Article 60), together with suspension of the related data processing for 3 to 6 months.
• Commercial exploitation or unlawful buying and selling of personal data (including children's data): penalised under Article 53 of Decree 330/2026/ND-CP — a fine of 2–10 times the unlawful proceeds; where there are no proceeds (Clause 3, Article 53): VND 70–100 million (fewer than 1,000 data subjects of basic data or fewer than 200 data subjects of sensitive data), VND 100–300 million (1,000 to under 2,000 / 200 to under 400), VND 300–500 million (2,000 to under 10,000 / 400 to 2,000), VND 500 million–1 billion (10,000 or more data subjects of basic data or 2,000 or more data subjects of sensitive data), and VND 1–3 billion where national defence, security and public order, or the life, health, honour, dignity or property of data subjects are infringed.

Note: fines calculated as a percentage of revenue (1–5% of the previous year's revenue in the Vietnamese market) apply only to certain violations concerning cross-border transfers of personal data under Article 56 of Decree 330/2026/ND-CP. See also the handbook entry Penalties for personal data protection violations.