How does Vietnam regulate the protection of student data in schools?

Schools around the world as well as in Vietnam are using more and more technology in teaching and learning. Creating conditions for educational technology (EdTech) companies to take advantage of and fully exploit the "data gold mine" of students. This forces countries, including Vietnam, to take action to strictly protect student data in an increasingly digital educational environment.

The Law on PDP 2025, which came into effect on January 1, 2026, considers the data of all students under the age of 16 to be personal data of special subjects with the most stringent principles and requirements when collecting and processing data

Risks when EdTech collects and processes student data

In mid-2024, a group of parents in the US filed a class-action lawsuit against PowerSchool, a company that provides school management software, allegedly collecting, analyzing, and sharing students' personal information without parental consent. The indictment states PowerSchool took advantage of its position as a leading provider of student management systems (SIS) to gain "almost limitless" access to student data. The lawsuit described the company collecting all sorts of information from grades, academic history, and online habits to biometric identities, forming "extremely sensitive" records of data about individual students and selling them to third parties without asking users for permission[1].

The U.S. parents filed a lawsuit arguing that under the law protecting children's privacy, the processing of their personal data requires parental consent. However, PowerSchool is said to "push" the responsibility of obtaining this permission to schools, while schools also do not have the legal right to agree to collect students' data for commercial purposes. The incident has set any limits for EdTech companies to mine student data in the process of providing services to schools.

Vietnamese laws on student data protection in schools

Although Vietnam's new legal framework for personal data protection does not specifically define the terms "children's personal data" or "student personal data", it can be considered that the personal data of a child student is information that identifies or accurately identifies any student under the age of 16[2].

The Law on Personal Data Protection (Law on PDP) 2025, which came into effect on January 1, 2026, considers the data of all students under the age of 16 to be personal data of special subjects with the most stringent principles and requirements when collecting and processing data[3].

From requirements for schools and stakeholders to collect and process student data...

According to Article 24 of the Law on PDP 2025, the collection or disclosure of private information of students aged 7 years and older requires the consent of both the child himself or herself and the legal representative (usually the parent). For students under 7 years old, the representative will agree on their behalf. Whenever a student or parent withdraws consent, the school/organization concerned must immediately cease processing the child's personal data. These principles are equivalent to the "explicit consent" requirement in international standards that the world is applying.

Schools and management units must fully comply with the Law on PDP, from verifying the age of students before processing data, to ensuring that only information necessary for educational purposes is collected. Educational software and applications with monitoring elements such as electronic attendance, classroom cameras, behavior assessment systems, etc. must be designed according to the principle of "security and safety from the beginning". Data processors and controllers, including schools, software providers, and relevant third parties (if applicable) are responsible for information security, signing data processing agreements, and clearly stating each party's responsibilities for protecting student data during and after data transfer.

In addition, the Law on PDP 2025 allows small and medium-sized enterprises or startups to enjoy the incentive of "deferment" for 05 years without having to appoint data protection personnel. However, this incentive is "deprived" if the business provides services that process sensitive personal data of students. This means that EdTech companies or platforms for young students must have dedicated personnel to protect data from the very beginning of operations.

… to request for emergency notification of data breaches

When breaches of sensitive student data such as location data, biometric data, health data occur, the school or relevant enterprise must notify the Ministry of Public Security within 72 hours and the data subject (pupils and legal representatives) of the nature of the violation and remedial measures.

Protecting student data is like building a "multi-layered security fence" for schools: the usual identification data is an external gate layer, but when it comes to academic, health, or behavioral activities, the legal surveillance camera system will work 24/7.  requires personal data managers to be highly qualified and any incident, even the smallest, must be immediately alerted to the authorities and relevant persons.

Source: Thanh nien Newspaper

Risk of student data being exposed and some recommended solutions

The disclosure or misuse of student personal data can have serious consequences. According to the GAO report, [4] there were thousands of school-related security incidents from 2016–2020[5]. Many cases of leaking grades, reports of school violence, and even student health checks have left them "vulnerable to emotional, physical and mental harm". Besides, leaked personal identification data can lead to children having their identities stolen and becoming targets for bad actors. Or the fact that EdTech companies can use student data for targeted marketing, creating learning pressure for students. All of the above risks threaten the psychology and privacy of students, who are very vulnerable in cyberspace today.

The PowerSchool case forecasts that disputes between parents and schools or parents and EdTechs over the infringement of student data will occur frequently in the near future in Vietnam. Therefore, it is urgent to carefully prepare measures to prevent and handle data leaks or measures to ensure data security for students.

Finalize legal policies. The State needs to issue detailed guidelines on the application of the Law on PDP to schools and EdTechs currently in Vietnam. The development of security standards for EdTech platforms, mandatory parental permission before integrating new tools, and clearly stipulating how to handle violations are necessary in the implementation of this new legal framework. In addition, strengthening the inspection and evaluation of the practical implementation of occupational protection in the field should be a priority.

Build capacity and processes. Schools need to appoint officials in charge of data security or internal monitoring mechanisms, periodically evaluate and update technical measures to protect student information. Units such as school administrators and informatics teachers must be trained in awareness of information security and data security. The organization of seminars and training sessions on privacy knowledge for teachers, parents, and even students should be implemented as soon as possible.

EdTechs and other parties collect and process student data. Both technical and legal reviews of compliance requirements should be conducted to develop tools and regulations that comply with the construction of safe, student-friendly learning platforms as much as possible. The collection and processing of data must be done by the right people for the right purposes with the principle of data minimization.

The PowerSchool lawsuit in the US is an important warning to Vietnamese schools and EdTechs about the risks in collecting student data. Especially, when Vietnam has started a new legal framework to protect this data. Data breach disputes between stakeholders in the coming time are inevitable. However, preventing the risk of data leakage as well as finding effective plans to ensure data security and avoid disputes is the highest priority at this time. In particular, the companionship of businesses in the field of education with schools and parents is key to protecting the safety of students in today's digital education environment.

Lawyer Nguyen Van Phuc

HM&P Law Firm