Is it compulsory to obtain consent from parents when processing children's personal data in Vietnam?

Is it compulsory to obtain consent from parents when processing children's personal data in Vietnam?

Pursuant to Clause 3 Article 20 of the Decree 13/2023/NĐ-CP stipulating processing of children's personal data as follows:

Processing of children's personal data

1. The children’s personal data shall be processed in the manner that the rights and the best interests of the children are protected.

2. The processing of personal data of a child is subject to his/her consent if he/she is seven years old or above and the consent of his/her parents or guardian(s), except for cases specified in Article 17 of this Decree. The Personal Data Controller, Personal Data Processor, Personal Data Controller-cum-Processor and the Third Party shall verify the age of the child before processing his/her personal data.

3. The processing of the child’s personal data shall be stopped and the personal data shall be permanently deleted or destroyed in the following cases:

a) The personal data is processed for unintended purposes or the processing purposes have been accomplished under the consent of the data subject, unless otherwise provided for by law;

b) The child’s parent or guardian withdraws the consent to the processing of the child’s personal data, unless otherwise provided for by law;

c) There are sufficient grounds to prove that the processing of the child’s personal data affects legitimate rights and interests of the child at the request of the competent authority, unless otherwise provided for by law;

As regulations above, the processing of personal data of a child is subject to his/her consent if he/she is seven years old or above and the consent of his/her parents or guardian(s), except for cases in which the processing of personal data doesn't require consent from data subjects.

The Personal Data Controller, Personal Data Processor, Personal Data Controller-cum-Processor and the Third Party shall verify the age of the child before processing his/her personal data.

In Vietnam: In which cases shall the processing of personal data not require consent from children and their parents?

Pursuant to Article 17 of the Decree 13/2023/NĐ-CP stipulating cases in which the processing of personal data shall not require consent from children and their parents as follows:

- The personal data shall be processed to protect the life and health of the data subject or others in an emergency situation. The Personal Data Controller, the Personal Data Controller-cum-Processor, the Personal Data Processor and the Third Party shall be responsible for proving such situation.

- Disclosure of personal data in accordance with the law;

- Processing of personal data by competent regulatory authorities in the event of a state of emergency regarding national defense, security, social order and safety, major disasters, or dangerous epidemics; when there is a threat to security and national defense but not to the extent of declaring a state of emergency; to prevent and fight riots and terrorism, crimes and law violations according to the provisions of law;

- The personal data shall be processed to fulfill obligations under contracts the data subjects with relevant agencies, organizations and individuals as prescribed by law;

- The personal data shall be processed to serve operations by regulatory authorities as prescribed by relevant laws.

What are personal data protection measures in Vietnam?

Pursuant to Clause 2 Article 26 of the Decree 13/2023/NĐ-CP stipulating personal data protection measures in Vietnam as follows:

Personal data protection measures

1. Measures for protecting personal data shall be adopted from the beginning of and throughout the processing of personal data.

2. Measures for protecting personal data include:

a) Management measure adopted by an organization or individual related to processing of personal data;

b) Technical measure adopted by an organization or individual related to processing of personal data;

c) Measure adopted by a competent authority according to regulations in this Decree and relevant law;

d) Investigation and procedure measures adopted by a competent authority;

dd) Other measures as prescribed by law.

As regulations above, measures for protecting personal data include:

- Management measure adopted by an organization or individual related to processing of personal data;

- Technical measure adopted by an organization or individual related to processing of personal data;

- Measure adopted by a competent authority according to regulations in this Decree and relevant law;

- Investigation and procedure measures adopted by a competent authority;

- Other measures as prescribed by law. 

Note: Decree 13/2023/NĐ-CP is effective from 01/07/2023.

Best regards!