Personal data protection in education: schools, training centres and EdTech platforms
Data protection in education is mostly about student data protection. Most learners in kindergartens, schools and language centres are children under 16. Education providers must therefore apply Article 24 of Law No. 91/2025/QH15: parents exercise rights on the child's behalf, children aged 7 or over must also consent before their private information is published, and age must be verified under Decree 330/2026/ND-CP. Student health records, classroom cameras and facial recognition attendance add sensitive data on top.
Personal Data Protection Law No. 91/2025/QH15 (Articles 24, 31, 32); Decree 356/2025/ND-CP; Decree 330/2026/ND-CP (Article 60); Law on Children No. 102/2016/QH13 (Articles 6, 21, 54); Decree 56/2017/ND-CP (Articles 33, 36); Circular 70/2026/TT-BGDDT on digital school records
Official legal texts
- Law 91/2025/QH15 — Government e-portal (official Vietnamese text)
- Decree 356/2025/ND-CP — Government e-portal (official Vietnamese text)
- Decree 330/2026/ND-CP — Government e-portal (official Vietnamese text)
- Law on Children 2016 — Consolidated text 108/VBHN-VPQH, Government e-portal (official Vietnamese text)
Key takeaways on data protection in education
- Children's data is at the heart of data protection in education. A child is a person under 16 (Article 1 of the 2016 Law on Children). The legal representative exercises the data subject's rights on the child's behalf; publishing or disclosing private information of a child aged 7 or over requires the consent of both the child and the representative (Clause 2, Article 24 of Law 91/2025/QH15).
- Article 60 of Decree 330/2026/ND-CP fines organisations VND 30 to 50 million for failing to verify age before processing children's data, or for processing the data of a child aged 7 or over without the consent of both the child and the representative (except in the cases under Clause 1, Article 19 of Law 91/2025/QH15).
- Stop processing and delete a child's data when the parent withdraws consent or a competent authority so requests (Clause 3, Article 24); failing to delete or destroy it in these cases is fined VND 100 to 200 million (Clause 3, Article 60 of Decree 330/2026/ND-CP).
Personal data processed in education
| Data group | Examples | Classification |
|---|---|---|
| Student and learner records | Name, date of birth, class, student ID, personal identification number, portrait photo on file | Basic |
| Parent and guardian details | Name, phone number, email, occupation, emergency contact | Basic |
| Academic results and assessments | Grades, teacher comments, school reports, placement test results, conduct ratings | Basic |
| Health data | Routine health check results, allergies, chronic conditions, special support needs, counselling records | Sensitive |
| Biometric data | Faces or fingerprints used for attendance, pick-up and teacher timekeeping | Sensitive |
| Location data | School bus tracking, GPS watches, apps tracking students' journeys | Sensitive |
| Behavioural data on online learning platforms | Learning history, access times and lesson views used to personalise content and recommend courses | Sensitive |
Classified under the lists in Articles 3 and 4 of Decree 356/2025/ND-CP. The same information may be classified differently depending on the context of processing.
1. Who must comply with data protection in education?
Data protection in education applies to every institution processing student and learner data. Personal Data Protection Law No. 91/2025/QH15 makes no distinction between public and private, domestic and foreign-invested: every organisation processing personal data in Vietnam must comply (Clause 2, Article 1). The most affected groups are:
- Kindergartens, schools, international and bilingual schools: student and parent records, school health, transport, boarding, classroom cameras.
- Language, skills and exam preparation centres: learners who may be children or adults, placement test data, recorded lessons.
- EdTech and online learning platforms: learner accounts, learning behaviour data, audio and webcam recordings, AI grading.
- Universities, colleges and study abroad consultancies: admissions files, scholarships, transcripts, passports, data sent to partner institutions abroad.
2. Children's data and student data protection: three core rules
Under Article 1 of the Law on Children No. 102/2016/QH13, a child is a person under 16. Article 24 of Law 91/2025/QH15 and Article 60 of Decree 330/2026/ND-CP set three rules for every education provider with child learners:
- Verify age before processing. Failing to verify a child's age before processing their data is fined VND 30 to 50 million (Point a, Clause 1, Article 60 of Decree 330/2026/ND-CP).
- Consent by age. For children under 7, the parent or guardian consents on their behalf. For children aged 7 or over, both the child and the legal representative must consent, except in the cases under Clause 1, Article 19 of Law 91/2025/QH15 (Points b and c, Clause 1, Article 60 of Decree 330/2026/ND-CP). Publishing or disclosing the private information of a child aged 7 or over without both consents is fined VND 50 to 100 million.
- Stop and delete on request. When a parent withdraws consent or a competent authority so requests, the provider must stop processing (Clause 3, Article 24) and delete or destroy the data; failing to do so is fined VND 100 to 200 million (Clause 3, Article 60 of Decree 330/2026/ND-CP).
See each age band in detail in the handbook entry on children's personal data.
3. Sector rules on school data protection: the Law on Children and digital records
Besides Law 91/2025/QH15, education providers must apply the sector rules below. Under Clause 2, Article 5 of Law 91, specific data protection rules in laws passed before 1 January 2026, such as the Law on Children, still apply as long as they do not conflict with the principles of Law 91.
- Prohibited act: publishing or disclosing information about the private life or personal secrets of a child without the consent of the child (if aged 7 or over) and of the parent or guardian (Clause 11, Article 6 of the Law on Children No. 102/2016/QH13).
- Right to privacy: children have an inviolable right to private life, personal secrets and family secrets in their best interests (Clause 1, Article 21 of the Law on Children). Online service providers must keep children safe and protect their privacy (Clause 2, Article 54).
- What counts as a child's private information: Article 33 of Decree 56/2017/ND-CP lists personal images, school, class and academic results, and health information in medical records. Student photos and grade sheets must therefore be protected as private information, even though most of them are not sensitive data under Decree 356/2025/ND-CP. Article 36 of the Decree also requires the consent of the parent and of children aged 7 or over before such information is posted online.
- Digital school records: Circular 70/2026/TT-BGDDT on managing and using digital school records in general and continuing education institutions takes effect on 8 October 2026. Digital records have the same legal value as paper ones, and must be managed with information security and personal data protection. Schools should review access rights in the digital records system and their contracts with software providers before that date.
4. Five common risks for data protection in education
The five risks below are the situations LexData meets most often when advising on data protection in education. Each comes with its legal basis and the fine that applies.
Posting student photos and videos on social media
Opening ceremony photos, performance clips and honour rolls are familiar school content. They make a child's personal data public and need a separate media consent form signed by the parent and confirmed by students aged 7 or over. The form should name the channels used, and the school must take photos down when a parent withdraws consent.
Publishing grades and fees in chat groups
Posting the whole class's grades, or a list of parents who have not paid fees, in a shared class chat discloses personal data to people who do not need it. Decree 56/2017/ND-CP also treats academic results as a child's private information. Good practice is to send it to each parent individually through the school management app or a private message.
Classroom cameras and facial recognition attendance
Classroom cameras used for safety or live viewing by parents need clear notice and limits on who can watch. If the system recognises faces for attendance, the data becomes children's biometric data: it needs parental consent, the safeguards in Clause 4, Article 31 of Law 91/2025/QH15, and an alternative attendance method for families who do not consent.
Student health and counselling records
Within student data protection, health check results, medical history and counselling records are health data, a sensitive category under Article 4 of Decree 356/2025/ND-CP. Only the school nurse and counsellors who need them should have access. When providing data to a student insurance company, schools should also note Clause 2, Article 26 of Law 91/2025/QH15 on providing health data to insurers.
Online learning platforms and behavioural data
EdTech platforms record study time, lessons viewed and wrong answers to personalise learning paths. Data tracking online service use is sensitive data (Article 4 of Decree 356/2025/ND-CP). Using it to advertise new courses needs separate consent under Article 28 of Law 91/2025/QH15. Where a platform uses AI to grade work or assess ability, processing must also comply with Article 30 on personal data in artificial intelligence.
5. Data protection in education: key obligations and legal bases
The table below summarises the main obligations. Each row is an item your plan for data protection in education should cover.
Obligations table: data protection in education in Vietnam
| Obligation | Legal basis | How it applies in education |
|---|---|---|
| Verify age before processing children's data | Point a, Clause 1, Article 60, Decree 330/2026 | Admissions, course sign-up, online learning accounts |
| Parental consent, plus the child's from age 7 | Clause 2, Article 24, Law 91/2025; Clause 1, Article 60, Decree 330/2026 | Enrolment files, media consent forms, learning apps |
| Stop processing and delete on withdrawal | Clause 3, Article 24, Law 91/2025; Clause 3, Article 60, Decree 330/2026 | Taking down photos, closing accounts, deleting face data |
| Protect biometric data | Clause 4, Article 31, Law 91/2025 | Facial recognition attendance, teacher fingerprint timekeeping |
| Give notice of recording | Article 32, Law 91/2025; Article 71, Decree 330/2026 | Cameras at gates, corridors and classrooms |
| DPIA dossier filed with A05 within 60 days | Article 21, Law 91/2025; Form No. 10, Decree 356/2025 | Private schools, centres and EdTech processing sensitive data |
| Cross-border transfer dossier | Article 20, Law 91/2025; Form No. 09, Decree 356/2025 | LMS, email and cloud storage abroad; study abroad applications |
| Do not publish children's private information without consent | Clause 11, Article 6, Law on Children 2016; Article 36, Decree 56/2017 | Photos, academic results, family information of students |
| Secure digital school records | Circular 70/2026/TT-BGDDT (effective 8 October 2026) | Access rights in the digital records system, vendor contracts |
| Teachers' employee data | Article 25, Law 91/2025; Article 61, Decree 330/2026 | Recruitment, timekeeping, cameras monitoring staff |
6. Data protection in education for foreign-invested companies
For international schools and foreign-invested platforms, data protection in education usually gets difficult where data leaves Vietnam. Many international schools use group student information systems, LMS and email hosted abroad, or send student files to exam boards and partner institutions. Each of these flows is a cross-border transfer under Clause 1, Article 20 of Law 91/2025/QH15 and needs an impact assessment dossier filed with the A05 Department. Children's data policies written to international standards also need review: Vietnam draws the line at under 16, whereas the US COPPA uses under 13, so a process that only covers users under 13 is not enough in Vietnam.
Insight from lawyer Ho Thi Ha Nhi
"In data protection in education, most violations in schools come not from technology but from everyday habits: a photo posted on the fanpage, a grade sheet sent to a class chat group. Schools should start with a well-designed start-of-year consent form split by purpose, and a short training session for homeroom teachers. Those two steps address most of the risk."
Data protection in education: implementation checklist
- Collect the date of birth at enrolment or sign-up, and automatically route learners under 16 to a parental consent flow.
- Draft start-of-year student data consent forms split by purpose: academic management, school health, transport, photos and media; for students aged 7 or over, include a place for the student to confirm.
- Send grades, fees and health information to each parent individually instead of posting them in class chat groups.
- Restrict access to student health and counselling records to the school nurse and counsellors who need it.
- For classroom cameras and facial recognition attendance: give clear notice, obtain parental consent for biometric data, offer an alternative way to take attendance, and set a retention period.
- Sign data processing agreements with LMS, school management software, school bus, catering and student insurance providers; share only the minimum data fields.
- Prepare a DPIA dossier and file it with the A05 Department within 60 days; if the LMS, Google Workspace, Microsoft 365 or AI tools are hosted abroad, also prepare a cross-border transfer dossier.
- Set up a process to stop processing and delete data when a parent withdraws consent, and a process to take down student photos and videos already posted.
FAQ: data protection in education in Vietnam
May a school post photos of students on its fanpage?
Yes, with the right consent. For students under 7, the parent or guardian must consent; for students from 7 to under 16, both the student and the parent must consent (Clause 2, Article 24 of Law 91/2025/QH15). Schools should use a separate media consent form rather than folding it into enrolment papers, and take photos down as soon as a parent withdraws consent.
How should a language centre teaching both children and adults verify age?
Ask for the exact date of birth at registration rather than a self-declaration tick box. Point a, Clause 1, Article 60 of Decree 330/2026/ND-CP penalises failing to verify a child's age before processing their data. Learners under 16 should be routed to a parental consent flow, confirmed through the parent's phone number or email.
Do public schools have to prepare a DPIA?
This is the most common school data protection question from public schools. Clause 6, Article 21 of Law 91/2025/QH15 exempts only competent state agencies from the DPIA. A public school is a public service unit, not a state agency, so the obligation should be assessed against its actual processing, especially where it processes students' health or biometric data. Private schools, training centres and EdTech companies are businesses and are fully subject to Article 21.
May an online learning platform use students' learning data to advertise courses?
Only with separate consent for advertising (Clause 3, Article 28 of Law 91/2025/QH15), and for child learners that consent must come from the parent (and from the child if aged 7 or over, under Article 60 of Decree 330/2026/ND-CP). Data tracking online service use is sensitive under Article 4 of Decree 356/2025/ND-CP, so good practice is to switch off targeted advertising for children's accounts.
When a student changes school, must the old school delete their data straight away?
Not all of it. Student records that education and archiving rules require the school to keep are retained for the statutory period (Point c, Clause 1, Article 14 of Law 91/2025/QH15). Data serving purposes that have ended, such as app accounts, facial recognition data and transport details, should be deleted once the purpose is fulfilled (Point b, Clause 1, Article 14).
Ho Thi Ha Nhi
Founding Lawyer, LexData Consulting · Ho Chi Minh City Bar Association
The Vietnamese original of this page has been reviewed against the Personal Data Protection Law No. 91/2025/QH15, its implementing decrees and the sector legislation cited. This English edition is an unofficial translation for reference; the official legal texts are in Vietnamese.
