AesirX ComplianceOne | Vietnam Education Data

Decree 88/2026/NĐ-CP was issued by the Government of Vietnam on 28 March 2026 and took effect on 15 May 2026. The Ministry of Education and Training is the lead authority. It is an active education-sector overlay for education and training data governance, learner records, credentials, sharing, and interoperability, binding schools, universities, education and training institutions, education-data platforms, EdTech providers, and certification and diploma systems.

Within that scope, the decree asks organizations to inventory education and training data together with its systems, owners, sources, and recipients; assign accountable ownership, quality, update, access, and lifecycle controls for education databases; maintain provenance, authenticity, and verification evidence for diplomas, certificates, transcripts, and learning records; and record lawful sharing, interconnection, authentication, and reuse controls where education data moves between systems.

Two obligations point directly at the sensitivity of this population. Learner, student, staff, and minor personal-data processing must be cross-linked to the applicable Personal Data Protection Law safeguards rather than governed twice. And where an organization uses AI systems to assess, rank, monitor, or profile learners, that use must be mapped to AI Law and high-risk-system controls; the pack's cross-references reach as far as the AI High-Risk Systems Decision. A further obligation addresses the legal-equivalence readiness of electronic education records where applicable.

This overlay is opt-in: organizations outside its declared scope can install it in reference mode, which produces no deadlines, score contribution, or automated workflows. ComplianceOne keeps its education-specific obligations connected to the Data Law, PDPL, cybersecurity, identity, and AI frameworks they depend on, without duplicating those parent obligations or blurring which instrument owns which requirement.