DPO Radio
AesirX ComplianceOne | Vietnam Education Data
VIETNAM EDUCATION DATA OVERLAY [ACTIVE]
Education Records, Credentials, and Data Governance
Direct-scope support for education organizations, with reference-only access for other users.
Why Education Data Decree 88 Matters
If you run a school, university, training institution, education-data platform, EdTech product or a diploma and certification system in Vietnam, Decree 88/2026/NĐ-CP governs your education and training data. The Government issued it on 28 March 2026, and it took effect on 15 May 2026. The Ministry of Education and Training is the lead authority.
The decree covers education and training data governance, learner records, credentials, sharing and interoperability. In practice it asks you to:
- Inventory your education and training data with its systems, owners, sources and recipients.
- Own each education database, with quality, update, access and lifecycle controls.
- Prove your credentials: keep provenance, authenticity and verification evidence for diplomas, certificates, transcripts and learning records.
- Control data movement: record lawful sharing, interconnection, authentication and reuse controls wherever education data moves between systems.
- Be ready for legal equivalence of electronic education records, where that applies.
Personal-data safeguards and a separate AI framework meet education operations:
- Learner, student, staff and minor personal data links to your Personal Data Protection Law (PDPL) safeguards. It is not governed twice.
- AI that assesses, ranks, monitors or profiles learners can be linked in ComplianceOne to the AI Law and the AI High-Risk Systems Decision where applicable. Decree 88 does not impose an AI duty; these are separate frameworks.
You choose whether to add this overlay. Organizations outside its scope can add it in reference mode, which creates no deadlines, no score contribution and no automated workflows. ComplianceOne keeps the education duties connected to the Data Law, PDPL, cybersecurity, identity and AI laws they depend on, without repeating those duties or blurring which law owns which requirement.
What Decree 88 Covers
Dimension
Coverage
Instrument
Decree 88/2026/NĐ-CP, issued 28 March 2026, effective 15 May 2026; lead authority: Ministry of Education and Training.
Scope
Scope Schools, universities, education and training institutions, education-data platforms, EdTech providers, and certification and diploma systems.
Operational themes
Education-data inventory; education database governance; learner, staff and minor data safeguards; credential and learning-record integrity; data sharing and interconnection; readiness for legal equivalence of electronic records.
Evidence
Learner-record inventories, credential and verification records, and sharing and interconnection records; ComplianceOne also includes an optional AI cross-link to separate frameworks.
Official forms
None verified. No official form was found in the Decree 88 Gazette text, its appendices or the linked Ministry of Education and Training procedures. The 8 templates in ComplianceOne are internal working documents.
Fines
ComplianceOne records no fine amounts for this decree.
Status
In force; an optional education overlay, in direct mode for in-scope organizations and reference mode for others.
The Education Data Instrument Stack
Decree 88/2026/NĐ-CP – Education and Training Data
ActiveDecree 88/2026/NĐ-CP is the sector data-governance decree this overlay is built on. It covers:
- education and training data inventory and database governance;
- learner, staff and minor safeguards;
- credential and learning-record integrity;
- sharing and interconnection;
- legal equivalence of electronic records;
- the lifelong learning-record roadmap.
Circular 70/2026/TT-BGDĐT – Digital Student Records Circular
ActiveEffective 8 October 2026. Circular 70/2026/TT-BGDĐT sets the rules for each digital student record under the decree. The Ministry of Education and Training issued it on 22 August 2026. It requires:
- one digital student record per learner, on a unified identifier;
- verified source data;
- individual and institutional digital signatures;
- controlled reissuance with change history;
- connection and synchronisation with the national education database;
- consent-based sharing with recipient restrictions;
- storage under archival law, and security duties.
It binds institutions that run Vietnam's general or continuing-education programmes, in force from 8 October 2026. A foreign-curriculum school is not automatically covered.
How ComplianceOne Supports Decree 88
A living data inventory.
Your education and training data inventory is a register with accountable review, not a static spreadsheet. It ties each data set to its systems, owners, sources and recipients. Each education database in scope has a governance record for its control description, implementation and owner.
Credential evidence you can produce on demand.
Diploma, certificate, transcript and learning-record verification is its own evidence type, separate from general data records. Provenance and authenticity checks stay traceable.
Sharing on the record.
Data-sharing and interconnection records capture recipients, storage locations and links to the other laws each transfer touches.
Personal data and AI, linked rather than repeated.
Learner, student, staff and minor data is personal data, so its evidence links to your PDPL safeguards. Where AI assesses, ranks, monitors or profiles learners, the AI education-system risk record links that use to your AI Law and high-risk-system evidence. Contributor, review and approval history stays with every record.
Related Modules
Data Mapping
Maintains the education and training data inventory, system relationships, and sharing and interconnection records
Explore Data Mapping
Data Classification
Separates learner, minor and staff personal data from general education records for handling decisions
Explore Data Classification
Access & Accountability
Logs access to education and credential databases, requires a justification for it, and compiles evidence packages for review
Explore Access & Accountability
Audit Trail
Keeps contributor, review, approval and evidence history across inventory, credential and AI records
Explore Audit TrailCompare the Difference
Without Structured Framework Operations
With ComplianceOne
Education data inventories aren't tied to their systems, owners, sources and recipients.
Keep the education and training data inventory as a register tied to systems, owners, sources and recipients.Nobody has written down who owns each education database, or its quality and access controls.Give each education database in scope an accountable owner, with quality and access-lifecycle controls.Diploma, certificate and transcript verification evidence is scattered and hard to rebuild.Track diploma, certificate, transcript and learning-record verification as its own evidence type.Education data moves between systems with no record of who authorized it.Record each sharing and interconnection decision with its recipients and the other laws it touches.AI that ranks, monitors or profiles learners has no recorded link to AI Law risk controls.Link AI learner-assessment systems to your AI Law and high-risk-system evidence without repeating it.Built for Identity Law Compliance Operations
Separate laws stay identifiable. Decree 88 Article 4(3) addresses learner, teacher and education-management personal data. The AI learner-system risk record is a ComplianceOne cross-link to the AI Law and the AI High-Risk Systems Decision where applicable, not an AI requirement created by Decree 88.
Two questions, kept apart. Credential and learning-record integrity, and legal-equivalence readiness for electronic records, are separate record types. A diploma or transcript carries evidence of who issued it and when it changed. Whether its electronic form counts as legally equivalent is a separate question, though institutions are often asked both at once.
Evidence entered once. ComplianceOne links the education overlay to related Vietnamese laws, decrees and decisions, from the Data Law and PDPL to the identity and AI instruments. These are product links; they do not mean Decree 88 cites or imposes every linked framework. Those links connect existing records, so evidence you gather here is usable elsewhere without re-entry.
Related Content
See Decree 88 Compliance in Action
See how ComplianceOne organizes learner and credential evidence, ownership and review under Decree 88, with separate links to applicable AI frameworks.
Ronni K. Gothard Christiansen - Technical Privacy Engineer & CEO
Technical Compliance Expert, 32+ Years Open Source Advocate, X-BoD Open Source Matters Inc.
People Also Ask
Schools, universities, education and training institutions, education-data platforms, EdTech providers, and certification and diploma systems. Organizations outside this scope can still add the overlay in reference mode.
Reference mode is the default outside the education scope. You can browse the requirements and evidence templates, but ComplianceOne creates no deadlines, adds nothing to your compliance score and starts no automated workflows.
The diploma, certificate and transcript verification record asks for the evidence description and source, the obligation it relates to, and a responsible person with a review date and status. It is its own evidence type, separate from the general education-data inventory.
No. No official form was found in the Decree 88 Gazette text, its appendices or the linked Ministry of Education and Training procedures. The 8 templates in ComplianceOne are internal working documents for organizing evidence, not government forms.
Learner, student, staff and minor personal data links to your Personal Data Protection Law safeguards rather than being governed a second time. Your education records stay connected to your data-protection work but separate from it.
No. ComplianceOne records no fine amounts for this decree. Confirm any penalty figures against the official Decree 88 text.
Where you use AI to assess, rank, monitor or profile learners, the AI education-system risk record links that use to your AI Law and high-risk-system evidence, including under the AI High-Risk Systems Decision. The assessment itself is not repeated.
No. It organizes your evidence on diploma, certificate and transcript provenance and verification. It does not issue credentials or verify them on its own authority.
Next Steps
Start a Compliance Pilot
Test the workflows, evidence and review with your compliance team.
Discuss Your Compliance Needs
Review applicability, evidence sources and your operating model with us.
The evolution of Aesir is Aesir + 
(the Norse symbol for Necessity)"Needed in order to achieve a particular result"
♥Join the AesirX Privacy Newsletter. Stay Informed. Stay Compliant.
