The problem: schools hold the most sensitive “data vault”: children’s personal information — names, birth dates, addresses, health, images, classroom CCTV. Quick answer: from 1 January 2026, the governing framework is Law 91/2025/QH15 and Decree 356/2025/ND-CP — Decree 13/2023/ND-CP was repealed (Article 42.2, Decree 356/2025). Schools as data controllers/processors must fully comply, with fines up to 5% of revenue.
Legal transition note (important)
Many old documents and contracts still cite Decree 13/2023/ND-CP on personal data protection. Note: it was repealed by Decree 356/2025/ND-CP (issued 31 December 2025, effective 1 January 2026) — the guiding text for Law 91/2025/QH15 on personal data protection. All school privacy policies, contract clauses, and compliance files citing Decree 13/2023 need review and updating to the new framework.
Which student data is protected?
- Basic personal data: names, birth dates, gender, addresses, parent phone numbers, emails.
- Sensitive data: student health and medical information; biometric data (fingerprint attendance, facial recognition) — protected at a higher level.
- Images, videos: portraits, classroom CCTV, activity videos — collection and posting need a legal basis (parent/guardian consent for children).
School duties
- Notice and consent: clearly state purposes, scope, and methods of processing; for child students, obtain parent/guardian consent.
- Security: apply technical and managerial safeguards; role-based access (not every teacher sees all student files).
- Retention and deletion: retain only as long as needed for stated purposes; delete when no longer needed or on lawful request.
- Incident response: on leaks or loss (e.g., disseminated student lists), assess, remediate, and notify as prescribed.
Penalties: up to 5% of revenue
Personal-data violations can draw fines up to 5% of revenue under the new framework — enough to make any private school take notice. Beyond fines: damage claims from parents/students and hard-to-measure reputational harm.
Frequently Asked Questions
1. Is Decree 13/2023 on personal data still in force?
No. Decree 13/2023/ND-CP was repealed by Article 42.2 of Decree 356/2025/ND-CP (effective 1 January 2026). The current framework is Law 91/2025/QH15 and Decree 356/2025.
2. Whose consent for student data collection?
For child students: parent/guardian consent. Schools must clearly state processing purposes and scope.
3. Do classroom cameras violate the rules?
Not automatically, but schools must disclose installation, image-use purposes, secure footage data, and use it only for stated purposes.
4. Penalties for leaking student lists?
Administrative fines up to 5% of revenue under the new framework, plus damage liability to affected persons.
5. What must schools update from Decree 13/2023 to 356/2025?
Review all privacy policies, contract clauses, consent forms, and incident-response procedures — update citations and duties to the new framework.
This article has been quality-reviewed by the FLAW AI Legal Council.
