The Personal Data Protection Law (PDPL) lists providing (cung cấp) and transferring (chuyển giao) as two forms of processing personal data, but defines neither.

Based on the ordinary meaning of those two terms, they mean much the same thing, and either can describe the same act: a business handing a data subject's personal data to another party. The context in which the PDPL uses those two terms does not help separate them either. Article 15.2(b) of the PDPL allows a business to provide data to another organization "when the data subject consents", and Article 17.1(a) of the PDPL also allows a transfer "when the data subject consents".

Must a business obtain both the child's consent and the consent of the child's legal representative, a parent or guardian (dual consent), whenever it processes the personal data of a child aged 7 or over? Under the Personal Data Protection Law (PDPL), the answer is no. Dual consent is required only for processing that would disclose the child's private life or personal secrets. For other processing, the legal representative consents on the child's behalf, and the child's own consent is not required (Article 24.2 of the PDPL). However, Decree 330/2026 of the Government on administrative penalties for violations in the fields of cybersecurity and personal data protection (Decree 330/2026) seems to apply dual consent to a broader set of circumstances. Article 60.1(c) of Decree 330/2026 fines processing of the data of a child aged 7 or over without dual consent. That rule was taken from Decree 13/2023, which ceased to have effect on 1 January 2026.

On 16 March 2026, the Ministry of Public Security (MPS) issued the draft decree on administrative sanctions in the fields of cybersecurity and personal data protection (the Draft Decree) for public consultation. It is the first step to put concrete penalties behind the PDPL 2025, which took effect on 1 January 2026 but left the enforcement details to the Government. The Draft covers a wide range of sectors, such as cybersecurity, personal data, AI, telecommunications, and digital signatures. This post focuses on the personal data provisions (Articles 57 to 69 of the Draft Decree), which raise potential concerns for businesses.

When companies think about data protection, they usually focus on “visible” data like names, email addresses, or bank details. However, there is a hidden layer called metadata - essentially “data about data” - that often gets ignored.

Under Vietnam’s new personal data protection rules, overlooking metadata is a major risk. If metadata can be used to identify a specific person, it falls under the same strict rules as regular personal data.

What is Metadata? The “Digital Footprint”

Metadata is information that describes the context of a file or a message rather than the content itself. Even if you remove a person’s name from a file, the metadata can still point directly to them.