Law on Personal Data Protection — processing the personal data of children

Processing the personal data of a person under 16 requires the consent of their parent or legal representative, which in practice puts an age-verification obligation on social platforms, games and education technology serving Vietnamese users. This sits inside a framework that already treats consent as the dominant lawful basis and that, as the cross-border entry describes, counts storing data on a foreign server as an export. Marked 'check': the Law and its implementing Decree both took effect on January 1, 2026, the primary texts are Vietnamese-language, and no enforcement practice exists yet — confirm the precise scope of the legal-representative requirement and any exemptions before designing a consent flow.