Must a business obtain both the child's consent and the consent of the child's legal representative, a parent or guardian (dual consent), whenever it processes the personal data of a child aged 7 or over? Under the Personal Data Protection Law (PDPL), the answer is no. Dual consent is required only for processing that would disclose the child's private life or personal secrets. For other processing, the legal representative consents on the child's behalf, and the child's own consent is not required (Article 24.2 of the PDPL). However, Decree 330/2026 of the Government on administrative penalties for violations in the fields of cybersecurity and personal data protection (Decree 330/2026) seems to apply dual consent to a broader set of circumstances. Article 60.1(c) of Decree 330/2026 fines processing of the data of a child aged 7 or over without dual consent. That rule was taken from Decree 13/2023, which ceased to have effect on 1 January 2026.

On 16 March 2026, the Ministry of Public Security (MPS) issued the draft decree on administrative sanctions in the fields of cybersecurity and personal data protection (the Draft Decree) for public consultation. It is the first step to put concrete penalties behind the PDPL 2025, which took effect on 1 January 2026 but left the enforcement details to the Government. The Draft covers a wide range of sectors, such as cybersecurity, personal data, AI, telecommunications, and digital signatures. This post focuses on the personal data provisions (Articles 57 to 69 of the Draft Decree), which raise potential concerns for businesses.

When companies think about data protection, they usually focus on “visible” data like names, email addresses, or bank details. However, there is a hidden layer called metadata - essentially “data about data” - that often gets ignored.

Under Vietnam’s new personal data protection rules, overlooking metadata is a major risk. If metadata can be used to identify a specific person, it falls under the same strict rules as regular personal data.

What is Metadata? The “Digital Footprint”

Metadata is information that describes the context of a file or a message rather than the content itself. Even if you remove a person’s name from a file, the metadata can still point directly to them.

On 31 December 2025, the Government issued Decree 356/2025 guiding the implementation of the PDPL 2025, which took effect on 1 January 2026. Decree 356/2025 provides critical detailed guidance and, notably, resolves several ambiguities under the PDPL 2025 framework. This post highlights the key takeaways from this new regulation.

1.         Expansion of "sensitive personal data": ID Cards and login credentials

As compared to the Draft PDPL Decree, Decree 356/2025 expands the scope of sensitive personal data to explicitly include: