What counts as children's personal data in a preschool?
Short answer: almost everything a preschool records about a child is personal data, because the Law on Personal Data Protection No. 91/2025/QH15 defines personal data as digital data or information in other forms that identifies or helps identify a specific person (Article 2(1)). The Law took effect on 1 January 2026, and children are protected under Article 24, with parents or the legal representative exercising rights on the child's behalf.
Decree 356/2025/ND-CP splits personal data into two groups. The table places common preschool data into the lists in Articles 3 and 4 of the Decree.
| Data type | Example in school | Category |
|---|---|---|
| Name, date of birth, gender, address | Enrolment file, class list | Basic (Article 3) |
| Child's image | Activity photos, ID photo, lesson videos | Basic (Article 3(6)) |
| Parent details, family relationships, phone numbers | Contact book, parent directory | Basic (Article 3) |
| Health status | Allergies, medication, health check records, growth measurements | Sensitive (Article 4(1)(d)) |
| Biometrics | Face recognition for attendance, fingerprint pick-up | Sensitive (Article 4(1)(đ)) |
| Location via location services | School bus tracking, GPS devices | Sensitive (Article 4(1)(h)) |
| Private life, family secrets | Notes on family circumstances, special support | Sensitive (Article 4(1)(c)) |
| Attendance, daily notes | Arrival/departure, meals, naps, teacher comments | Personal data; assess by context |
Parental consent: who signs, and for what
Under Article 24(2) of Law 91/2025, the child's legal representative (usually a parent) exercises the data subject's rights on behalf of the child. Processing a child's data to publish or disclose private life or personal secrets of a child aged 7 or older requires consent from both the child and the representative. The 7-year mark matches the Law on Children 2016: Article 6(11) prohibits publishing or disclosing a child's private-life information without consent from children aged 7 or older and from their parents or guardians.
Most preschoolers are under 6, so in practice the school needs consent from parents or guardians. That consent must satisfy Article 9 of the Law: voluntary, informed about data types, purposes, the controller and the parent's rights; given per purpose; and silence is not consent. Article 6 of Decree 356 accepts consent in writing, by SMS, email or in an app with a consent mechanism, as long as it is verifiable and the school keeps it.
Note: enrolment is an agreement between parent and school. Some processing necessary to perform that agreement may not need separate consent (Article 19(1)(d) of the Law), but purposes outside it, such as promotional photos, need separate consent. Ask counsel to draw the line for your school.
- Split consent forms by purpose: operations and care (records, health, attendance); sharing photos in a closed class group; public posting (fanpage, website, ads); cameras/live viewing; sharing with third parties (insurers, health check providers).
- No pre-ticked boxes; parents choose each item.
- State that health and biometric data are sensitive personal data (Article 6(4) of Decree 356).
- Keep the consent record with date and form version; update when purposes change.
- Make withdrawal easy. When a parent withdraws, the school must stop processing for that purpose (Article 24(3) of the Law).
Posting children's photos on Facebook, fanpages and Zalo groups
Posting a child's photo to the school fanpage or website is making personal data public. Article 16 of Law 91/2025 allows this only with the data subject's consent, as required by law, or to perform a contract, and the scope must fit the purpose. Article 32 of the 2015 Civil Code also requires consent to use a person's image. Under Article 33 of Decree 56/2017/ND-CP guiding the Law on Children, a child's personal image, name, age and school and class details are private-life information of the child.
A class Zalo or Facebook group is not harmless just because it is closed: photos are still transferred to every member, can be downloaded and spread. A group photo is data of many children at once.
- Only post publicly the photos of children whose parents consented to public posting; blur or skip the others.
- Do not caption public photos with full name, date of birth or specific class.
- Never post photos of children changing, bathing, crying, injured, or in situations affecting their dignity.
- In class groups: only parents of that class; group rules banning resharing of other children's photos; review members when children move class.
- Teachers should not keep children's photos on personal phones long term; use school devices or storage.
- Remove photos on parental request. Under Article 5(4) of Decree 356, deletion requests must be answered within 2 working days and completed within 20 days.
Cameras and live streaming in preschool classrooms
Camera footage is personal data of the children, teachers and parents in frame. Article 32 of Law 91/2025 allows recording in public places and public activities without consent in certain cases, but a classroom is an access-controlled space and there is no official guidance classifying it as a public place. The safer approach is to treat cameras as a separate purpose: clear notice, parental consent (and agreement with teachers), and restricted viewing rights.
If cameras or software use face recognition, the data is biometric and therefore sensitive. If biometric or location data is breached, the controller must notify affected parents within 72 hours (Article 29 of Decree 356) as well as the specialised personal data protection authority under the Ministry of Public Security.
A note on AI: the List of high-risk AI systems annexed to Decision 33/2026/QD-TTg (effective 15 August 2026) includes "systems using AI to monitor and analyse learner behaviour" where the system uses biometric data (face, gaze, behaviour or emotion recognition) or issues frequent automatic alerts about a learner's attention or expressions. If a school's cameras or software have such features, ask the vendor how the system is classified under the AI Law; see Vietnam's AI Law 2025.
- No cameras in toilets or changing areas.
- Post a notice that recording is in progress at the classroom door (in the spirit of Article 32(2) of the Law).
- Live viewing: one account per parent with authentication, no public links; log who viewed and when.
- Set a retention period matching the purpose and auto-delete when it expires (Article 32(4) of the Law sets this principle for public recording).
- Encrypt transmission; if stored in the cloud, data must be encrypted at rest and in transit (Article 12(4) of Decree 356).
Software, education apps and Article 21 of Decree 356
Many schools use management software and parent communication apps. Typically the school is the controller (it decides purposes) and the software vendor is a processor under contract. Article 37 of the Law requires controllers to choose suitable processors and set out responsibilities in the contract; processors may only receive data after a contract is in place.
Article 21(5) of Decree 356 lists "collecting and processing personal data via education apps or software with monitoring features such as attendance, video recording, behaviour scoring and emotion recognition" as a personal data processing service. Organisations providing such services must meet the conditions in Article 22 and obtain a certificate from the Ministry of Public Security (Articles 24 and 25 of Decree 356). When choosing a vendor, schools should ask directly about compliance with this provision and have it stated in the contract.
Disclosure: EYC builds Early Years Circle, an operating platform for early childhood education with four experiences: Teacher, Family, Admin and TV. We follow the rules discussed here closely. The table below lists generic criteria that apply to any vendor. See also how to choose preschool management software and parent communication apps.
| Question for the vendor | Why it matters |
|---|---|
| Does the data processing contract state roles, purposes, duration and deletion on termination? | Law Art. 37; Decree 356 Art. 7 |
| Does the software do attendance, video recording, behaviour scoring or emotion recognition? What is its compliance status under Decree 356 Arts. 21–25? | Decree 356 Art. 21(5) |
| Where is data stored? Is it transferred abroad (servers, cloud, AI)? | Law Art. 20 (cross-border transfer dossier) |
| Encryption at rest and in transit? Role-based access for teachers, parents, admins? | Decree 356 Arts. 12(4), 4 |
| Does it record parental consent per purpose and export proof? | Law Art. 9; Decree 356 Art. 6 |
| Can parents view, correct and delete data within legal deadlines? | Law Art. 4; Decree 356 Art. 5 |
| How quickly does the vendor report incidents to the school? | Law Art. 23 (72 hours to the authority) |
| Is children's data used to train AI or for other purposes? | Law Art. 30; Decree 356 Art. 10 |
| Can all data be exported and deleted when the school stops using it? | Law Art. 14 |
Retention and deletion when a child leaves
The Law requires data to be kept only as long as suits the purpose (Article 3) and deleted once the purpose is fulfilled or the retention period expires (Article 14). Deletion must be secure and prevent unauthorised recovery.
- Set a retention schedule per data type: student records (per education-sector rules, if any), activity photos, camera footage, class chat groups.
- When a child transfers or graduates: remove from class groups, revoke parent accounts, delete photos with no remaining purpose, hand over to parents what they want to keep.
- Remember copies: teacher drives, phones, backups, old social media accounts.
- Record deletion of sensitive data (health, biometrics).
Training teachers and staff
Most risk comes from daily habits: photos on personal phones, class lists sent in chat groups, health books left open. The Law requires organisations to designate a data protection unit or person, or hire a service (Article 33(2)), unless exempt: household businesses and micro-enterprises are exempt; small enterprises and start-ups may opt out for 5 years. The exemption does not apply to those directly processing sensitive data (Article 38 of the Law, Article 41 of Decree 356); preschools holding children's health information should review this point with counsel.
- Start-of-year induction: which data is sensitive, rules for taking and posting photos, how to answer parents' data questions.
- A do/don't list posted in the staff room.
- Suspected-breach procedure: report immediately to the person in charge; the school must notify the authority within 72 hours if the case falls under Article 23 of the Law.
- Confidentiality undertakings for new staff; revoke access on departure.
Frequently asked questions
Does a preschool need parental permission to post children's photos on Facebook?
Yes. Public posting is making personal data public, which requires consent under Article 16 of Law 91/2025; Article 32 of the 2015 Civil Code also requires consent to use a person's image. For preschoolers, parents or the legal representative consent on the child's behalf. Keep public-posting consent separate from consent for closed class groups.
At what age must the child's own consent be sought?
From age 7, publishing or disclosing a child's private-life information requires consent from both the child and the parent or representative (Article 24(2) of Law 91/2025, Article 6(11) of the Law on Children 2016). For preschoolers under 7, parents or the representative exercise rights for the child.
Do classroom cameras in a preschool need parental consent?
There is no official guidance classifying a classroom as a public place under Article 32 of Law 91/2025. The cautious approach is clear notice, parental consent for cameras and live viewing, restricted viewers and a set retention period.
Is a child's health information sensitive data?
Yes. Health status is sensitive personal data under Article 4(1)(d) of Decree 356/2025. Schools must restrict access, have processing procedures and security measures, and tell parents the data is sensitive when asking for consent.
How quickly must a school delete a child's photos on request?
Under Article 5(4) of Decree 356, the controller must respond within 2 working days and complete deletion within 20 days; where processors or third parties must delete, within 30 days, with one possible extension.