DPO Radio
AesirX ComplianceOne | Circular 70 Vietnam Digital Student Records
ACTIVE
Circular 70/2026/TT-BGDĐT Digital Student Records
Management and Use of Digital Student Records
Issued by the Ministry of Education and Training on 22 August 2026, in force since 8 October 2026. Keep your digital student records evidenced under the circular's applicable duties: record provenance, dual signatures, reissuance, guardian consent, synchronisation, backup and vendor evidence.
Circular 70/2026/TT-BGDĐT: Scope and Current Status
If your school runs Vietnam's general-education or continuing-education programmes, Circular 70/2026/TT-BGDĐT sets how you manage and use digital student records (học bạ số). The Ministry of Education and Training issued it on 22 August 2026, and it is in force from 8 October 2026.
It is signed, binding regulation, not draft guidance. None of its obligations applied before that date. It has 26 articles in seven chapters.
Who is covered. The circular covers institutions running Vietnam's general or continuing-education programmes, and the education-management bodies above them. An international school that runs only a foreign curriculum is not automatically covered.
Whether it is covered, for example through a Vietnamese-programme stream, is a question for counsel. ComplianceOne asks you to record that decision before treating the circular as applying.
What it requires. The circular follows each record through its life:
| Stage | What the circular requires |
|---|---|
| Identity | One digital record per learner, tied to a unified, unique identifier |
| Creation | Built from verified source data, with traceability |
| Signing | Digitally signed by the responsible individuals and by the institution |
| Issuance and reissuance | Issued records are not simply overwritten; change history is kept |
| Use | Used within its purpose |
| Connection | Collected, connected and synchronised with the national education database; ready to integrate with the national education platform, the public-service portal and the VNeID application |
| Sharing | Only within authority, purpose and necessity, on a legal basis or valid consent |
| Storage | Kept throughout and after the learner's education, under archival law |
| Security | Authentication, authorisation, access control, sharing and access histories, backup and recovery, integrity and availability, secure transmission |
How Circular 70 Relates to Its Family
Decree 88/2026/NĐ-CP governs education data broadly. Circular 70 sits beneath it and sets exactly how one kind of record, the digital student record, is created, signed, issued, reissued, shared, synchronised, stored and secured. The circular's transition rules follow the lifelong learning-record roadmap set under Decree 88.
Three other areas of law meet the circular:
- Personal data. Guardian and learner consent, purpose limitation and recipient restrictions are duties under the Personal Data Protection Law and Decree 356.
- Electronic signatures. The individual and institutional digital signatures rest on the electronic-transactions and trust-services rules.
- Cybersecurity. Authentication, access control and audit logging fall under the cybersecurity rules.
ComplianceOne links to your evidence under those laws rather than creating a second set of controls.
Technical Provisions and Compliance Obligations
| Provision | What It Establishes | Operational Implication |
|---|---|---|
| Articles 1–2 | Scope: management and use of digital student records in general-education and continuing-education institutions; the institutions, management bodies and related organisations and individuals bound | Whether you are covered is a decision you record, not a default |
| Articles 4–5 | Legal value of the digital record and the principles of its management and use | The digital record is an official record, so you need evidence for its whole lifecycle |
| Articles 6–7 | Record fields and detailed specifications follow Ministry rules; creation from verified source data with one unified, unique identifier per learner | Check, reconcile and verify source data before entry, and keep it traceable |
| Articles 8–10 | Signing and issuance principles; digital signing by responsible individuals and the institution; issuance | Keep individual and institutional signature evidence for each issued version |
| Articles 11–12 | Exploitation and use of the record | Use the record only for its purpose, and keep a history of its use |
| Articles 13–14 | Collection of record data and connection with the national education database and national platforms | Keep evidence of synchronisation and integration readiness; do not assume it |
| Article 15 | Sharing — within authority, purpose and necessity; on a legal basis or the data subject's valid consent; recipients may not repurpose or transfer unlawfully | Record the basis for every sharing event, with guardian consent where the learner is a minor |
| Article 16 | Storage — secure, complete and continuous throughout and after the learner's education, under archival law | Archival law sets the retention period; the circular states none |
| Article 17 | Security — authentication, authorisation, access control, sharing and access histories, backup and recovery, integrity, availability, secure transmission and synchronisation | An inspector can ask for your access and sharing histories |
| Articles 18–23 | Learner rights and the responsibilities of the Ministry, provincial departments, commune People's Committees, institutions and related organisations and individuals | Your vendors and system providers are related organisations with their own duties |
| Articles 24–25 | In force from 8 October 2026. Paper records issued before then stay valid. Institutions create digital records for current and new learners from that date. Authenticated electronic copies may be used while the receiving system is not ready. Digitisation follows the Ministry's roadmap, aligned to the lifelong learning-record schedule | The transition is dated and phased, and you plan for your own phase |
| Obligation | Timeline | Reference |
|---|---|---|
| Circular takes effect | 8 October 2026 | Article 24 |
| Annual creation of digital student records | Before 30 June each year; in special cases, before 30 August each year | Article 7(4) |
| Paper records issued before the effective date | Remain valid under the law | Article 25(1) |
| Digital records for current and new learners | Created from the effective date under the circular | Article 25(2) |
| Authenticated electronic copies while the receiving system is not technically ready | Permitted during that period | Article 25(3) |
| Digitisation and standardisation of existing paper and learning data | Per the Ministry's roadmap, prioritising current learners and frequent administrative procedures | Article 25(4) |
| Preparation of implementation conditions | Aligned to the lifelong learning-record roadmap under Decree 88/2026 | Article 25(5) |
Forms and Data Requirements
The circular leaves the detailed record fields, data standards and forms (biểu mẫu) to Ministry of Education and Training rules: Articles 6(1)–(2), 14(4) and 19(2). It sets general principles and minimum technical requirements, but does not reproduce those detailed specifications or forms. Templates must be checked against the Ministry's applicable rules as they are issued.
Everything ComplianceOne gives you for Circular 70 is an internal preparation template, and is labelled as one:
- the scope decision;
- the provenance and signature register;
- the reissuance log;
- the consent evidence record;
- the sharing-history record;
- the synchronisation and backup evidence records;
- the school-system vendor questionnaire.
How ComplianceOne Supports Circular 70 Compliance
Work from the article.
Once Circular 70 is added to your workspace, each duty names the article it comes from. The circular's duties are in force from 8 October 2026, and each is counted from that date and no earlier.
Answer the vendor questions once.
The school-system and vendor questionnaire covers hosting location, foreign support access, APIs, VNeID integration, sub-processors, and deletion and archival responsibilities. You answer it once. The answers appear on the vendor register and the cross-border transfer assessment, so a foreign-hosted student-information system is checked against the national-synchronisation requirement on the record.
Record consent and evidence.
You record consent for sharing in the consent module, naming the representative where the learner is a minor. Sharing events, synchronisation, backup and recovery are evidence records with owners and dates. The audit trail keeps who did what and when.
Reissue without overwriting.
The issued-record register is available now. Issued versions cannot be overwritten, and each correction or reissuance is a new version with a reason.
What stays with you.
ComplianceOne never produces or signs the record. It never connects to the national education database, the public-service portal or VNeID.
Related Modules
Consent Governance
Guardian and learner consent evidence for sharing, with purpose and necessity recorded
Explore Consent Governance
Data Mapping
Record inventory, systems, data flows to the national database and to vendors, and retention under archival law
Explore Data Mapping
Access Accountability
Access justifications, sharing and access histories, and role-based permissions
Explore Access Accountability
Audit Trail
Keeps the history of creation, signing, issuance, reissuance, sharing and synchronisation
Explore Audit TrailCompliance Readiness Checklist
Now that Circular 70 applies, confirm that:
See Circular 70 Compliance in Action
See how ComplianceOne records your coverage decision, vendor questionnaire, sharing consent, and the synchronisation and backup evidence the circular asks for.
Ronni K. Gothard Christiansen - Technical Privacy Engineer & CEO
Technical Compliance Expert, 32+ Years Open Source Advocate, X-BoD Open Source Matters Inc.
Frequently Asked Questions
Yes. It was issued on 22 August 2026 and took effect on 8 October 2026, under its final chapter. It is binding regulation with a fixed start date, and ComplianceOne shows it as active from that date.
It covers institutions running Vietnam's general-education or continuing-education programmes, and the education-management bodies above them. An international school running only a foreign curriculum is not automatically covered. Coverage is a legal question for your specific situation, and ComplianceOne records your decision rather than assuming one.
Yes, but not by overwriting it. The circular requires traceability and change history, so a correction or reissuance is a new version and the earlier version is kept. ComplianceOne's issued-record register has no way to update or delete an issued version. The audit trail keeps who changed what and why.
Sharing must stay within authority, purpose and necessity, and include only the data needed. It must rest on a legal basis or the data subject's valid consent, which for a minor means the representative's consent. Recipients may not use the data beyond its purpose or transfer it unlawfully. ComplianceOne records each sharing event with its basis and the consent it relies on.
The circular requires connection and synchronisation with the national education database, and readiness to integrate with national platforms. The Personal Data Protection Law governs any foreign hosting of, or support access to, learner data. ComplianceOne's vendor questionnaire records hosting location, foreign support access, APIs, VNeID integration and sub-processors once. The cross-border transfer assessment reads the same answers, so one record answers both requirements.
Next Steps
Start a Compliance Pilot
Record your coverage decision, vendor questionnaire, and consent and synchronisation evidence under the duties in force from 8 October 2026.
Discuss Your Compliance Needs
Review your school's coverage, where your student-information system is hosted and who can access it, and how you reissue records.
The evolution of Aesir is Aesir + 
(the Norse symbol for Necessity)"Needed in order to achieve a particular result"
♥Join the AesirX Privacy Newsletter. Stay Informed. Stay Compliant.
