Children's Data Infographic

The issue in brief

Must a business obtain dual consent (the child's consent and the consent of the child's legal representative) whenever it processes the personal data of a child aged 7 or over?

Personal Data Protection Law (PDPL)

No, only for disclosure

Dual consent is required only for processing that would disclose the child's private life or personal secrets. For other processing, the legal representative consents on the child's behalf. (Art. 24.2 PDPL)

Decree 330/2026

Seems broader

Art. 60.1(c) fines processing the data of a child aged 7 or over without dual consent. That rule was taken from Decree 13/2023, which ceased to have effect on 1 January 2026.

How the rule changed

Decree 13/2023

Dual consent for processing a child's data from age 7 generally, not only for disclosure. (Art. 20.2)

1 Jan 2026

PDPL in force; dual consent kept only for disclosure. Decree 13/2023 ceases to have effect. (Art. 42.2 Decree 356/2025)

Decree 330/2026

Art. 60.1(c) fines processing a child's data (age 7+) without dual consent: the old rule as a penalty.

Decree 356/2025 guiding the PDPL contains no rule specific to children, such as an age threshold or a parental-consent rule.

Who consents under the PDPL

Where consent is the basis for processing:

Age	Ordinary processing	Processing to disclose private life or personal secrets
Under 7	Legal representative	Legal representative
7 to 15	Legal representative	Legal representative and child
16 and 17	The minor alone (not a "child")	The minor alone

No consent needed at all, not even the legal representative's, where a PDPL no-consent case applies, e.g. performing an agreement with the data subject or urgent protection of life or health. (Art. 19.1 PDPL)

Definitions. The post assumes "child" means a person under 16 (Art. 1 Law on Children 2016). A minor is a person under 18 (Art. 21.1 Civil Code 2015). Legal representative: parents, guardian or court-appointed person (Art. 136 Civil Code 2015).

Ordinary processing or disclosure?

Likely ordinary processing

Using a child's data to provide a service, such as registering the child for an offline class

Could be disclosure

Making it visible to others: a public profile, a leaderboard or a school website
Showing it to a limited group, such as classmates

The laws do not define "private life or personal secrets". The dividing line appears to be the purpose of the processing rather than the type of data.
Decree 56/2017 lists a child's name, age, image, school, results and friendships, among other things, as private information (Art. 33).

Penalties under Decree 330/2026

ART. 60.1(c)

VND 30–50 million

for an organisation

Processing the data of a child aged 7 or over without dual consent (the old rule).

ART. 60.2(a)

VND 50–100 million

for an organisation

Processing that discloses a child's private life without dual consent.

ART. 60.5(b): REMEDY

Deletion

for violations of Article 60

Deletion of all personal data processed unlawfully. How much depends on which data was processed unlawfully.

The fines are modest, but the remedies are not. For an education, games or family-app business whose consent flow was built on the PDPL alone, the exposure could be significant.

Two readings of Article 60.1(c)

Reading 1 · Literal

Dual consent for any processing

Required for any processing of the data of a child aged 7 or over, unless a PDPL no-consent case applies.
Art. 60.2(a) separately fines disclosure without dual consent. If 60.1(c) also covered only disclosure, the two would overlap, which points to 60.1(c) being wider.

Reading 2 · Confined to the PDPL

Dual consent only for disclosure

Each offence must involve a breach of an obligation, responsibility or prohibition under the law (Art. 4.1 Decree 118/2021, as amended).
Art. 24.2 PDPL makes a deliberate allocation; the same position appears in the Law on Children 2016 (Art. 6.11) and Decree 56/2017 (Art. 36.1).
A decree should not reinstate what a law has narrowed.

Authors' viewReading 2 is the more reasonable one: otherwise Art. 60.1(c) would impose a duty that the PDPL chose not to impose.

Enforcement riskReading 1. Until an authority confirms the narrower reading, businesses that process children's data should plan for the wider one.

Action checklist

Map children's data. Identify where you process the data of children aged 7 or over and rely on consent as the basis.

Check the no-consent cases. No consent is needed where a PDPL no-consent case applies, such as performing an agreement with the data subject or urgent protection of life or health.

Plan for the wider reading. Until an authority confirms the narrower reading, plan consent flows on the basis that Art. 60.1(c) requires dual consent for children aged 7 or over.

Flag possible disclosures. Treat public profiles, leaderboards, school websites and sharing with classmates as possible disclosure of private life.

Review PDPL-only consent flows. For an education, games or family-app business whose consent flow was built on the PDPL alone, exposure could be significant: the remedy is deletion of all personal data processed unlawfully.