According to the Decree on Personal Data Protection recently issued by the Government (Decree 13/2023/ND-CP, effective from July 1, 2023), personal data protection is implemented in comply with the provisions of international treaties to which the Socialist Republic of Vietnam is a member, other provisions of relevant Laws and this Decree.

The Decree sets out a number of principles for personal data protection. Accordingly, personal data is processed in accordance with the law; The data subject is informed about the activities related to the processing of his or her personal data, unless the law has otherwise stipulation;

Personal data will only be processed for the purposes that have been registered and declared by the Personal Data Controller, Personal Data Processor, Personal Data Controller, and the Third Party on processing of personal data; Personal data collected must be appropriate and limited to the scope and purpose for which it is processed. Personal data may not be bought or sold in any form, unless otherwise prescribed by law;

Personal data is updated and supplemented in accordance with the processing purpose; Personal data is subject to protection and security measures during processing, including protection against violations of regulations on personal data protection and loss prevention, destruction or damage due to incidents, use of technical measures; etc., …

Verify the age of children before processing personal data

Article 20 of the Decree specifically regulates the processing of children's personal data.

Specifically, processing of children's personal data is always carried out in accordance with the principle of protecting the rights and for the best interests of children;

The processing of children's personal data must have the child's consent in cases where the child is 7 years of age or older and has the consent of the father, mother or guardian as prescribed, unless otherwise specified in Article 17 of this Decree. Personal Data Controllers, Personal Data Processors, Personal Data Controllers and Processors, Third Parties must verify the age of children before processing their personal data.

The Decree also stipulates a number of cases of stopping processing of children's personal data, irreversibly deleting or destroying children's personal data such as: Processing data for improper purposes or having completed the purpose of processing of personal data with the consent of the data subject, unless otherwise provided by law;

The child's father, mother or guardian withdraws consent to the processing of the child's personal data, unless otherwise provided by law;

At the request of a competent authority when there is sufficient evidence to prove that the processing of personal data affects the legitimate rights and interests of children, unless otherwise prescribed by law.

Ngoc Chau