The Personal Data Protection Law (PDPL) lists providing (cung cấp) and transferring (chuyển giao) as two forms of processing personal data, but defines neither.

Based on the ordinary meaning of those two terms, they mean much the same thing, and either can describe the same act: a business handing a data subject's personal data to another party. The context in which the PDPL uses those two terms does not help separate them either. Article 15.2(b) of the PDPL allows a business to provide data to another organization "when the data subject consents", and Article 17.1(a) of the PDPL also allows a transfer "when the data subject consents".

Must a business obtain both the child's consent and the consent of the child's legal representative, a parent or guardian (dual consent), whenever it processes the personal data of a child aged 7 or over? Under the Personal Data Protection Law (PDPL), the answer is no. Dual consent is required only for processing that would disclose the child's private life or personal secrets. For other processing, the legal representative consents on the child's behalf, and the child's own consent is not required (Article 24.2 of the PDPL). However, Decree 330/2026 of the Government on administrative penalties for violations in the fields of cybersecurity and personal data protection (Decree 330/2026) seems to apply dual consent to a broader set of circumstances. Article 60.1(c) of Decree 330/2026 fines processing of the data of a child aged 7 or over without dual consent. That rule was taken from Decree 13/2023, which ceased to have effect on 1 January 2026.