Education & EdTech Data Governance

A university registrar receives an urgent request to confirm a graduate's digital credential. The record in the student system looks correct. A separate service stores the electronic artifact. The issuing history is held by another department. An employer's verification request arrived through email. Nobody is quite sure which evidence proves provenance, which evidence records the verification, and which system owns the current status.

At the same time, the university's learning platform is introducing automated recommendations. The product team calls it personalization. Faculty members ask whether it ranks students. Privacy asks whether minors are affected. Governance asks whether the use connects to Vietnam's AI risk controls.

These may sound like separate projects. Under education-data governance, they are connected by one operating question: can the institution show who owns the record, how it moves, what decision was taken, and which evidence supports that decision?

Vietnam's Decree 88/2026/NĐ-CP was issued on 28 March 2026 and took effect on 15 May 2026. Led by the Ministry of Education and Training, it is an active education-sector overlay for education and training data governance, learner records, credentials, sharing, and interoperability.

Decree 88 has broad subject coverage. Article 2 applies to Vietnamese agencies, organizations and individuals, and to foreign agencies, organizations and individuals that directly participate in or conduct activities related to Vietnam's education and training data.

In practice, organizations affected can include schools, universities, training institutions, education authorities, education technology providers, digital-learning platforms, credential services and other participants in education-data flows. Specific obligations depend on the organization's actual role, activities and data use.

Education data involving state secrets requires separate treatment. Decree 88 expressly excludes education and training data related to state secrets from its scope. Where that classification is relevant, the State Secrets Protection Law 117/2025/QH15 and Decree 63/2026/NĐ-CP should be assessed separately rather than treating the Decree 88 workflow as the governing framework.

ComplianceOne does not replace the SIS, LMS, credential platform, identity service or education database. It provides the governance layer connecting education-data activities to legal obligations, accountable owners, access decisions, sharing, credential evidence, exceptions and review history. Operational systems remain the systems of record and action.

Govern education-data evidence without replacing education systems.

Digital Student Records Now Have Their Own Active Layer

Circular 70/2026/TT-BGDĐT governs management and use of digital student records (học bạ số) in general and continuing education. Effective on 8 October 2026, it complements Decree 88. It does not apply universally to every education organization: confirm whether the institution and activity fall within its general/continuing-education scope.

Its operational themes include creation and required content, validation and digital signing, issuance, access and use, connection and sharing, storage, information security and personal-data protection, and logging and traceability of activities. ComplianceOne supports a dedicated Digital Student Records framework for Circular 70 to govern applicable obligations and evidence. Institutional systems perform record creation, signing, issuance and storage.

The official Decree 88 record confirms its issue and effective dates; the official Circular 70 record confirms the circular's commencement.

My central argument is that institutions should stop treating privacy, credential integrity, database governance, and AI oversight as separate documentation exercises. The records must remain legally distinct, but the evidence needs to connect around the actual learner, system, credential, and decision context.

The Student Record Is an Ecosystem

Education data rarely remains inside one student-information system.

Admissions data may begin in an application portal. Identity information may be checked through another service. Course activity sits in a learning platform. Assessment data moves through testing tools. Attendance may come from classroom systems. Credentials are issued, stored, shared, and later checked. Support services can add health, accessibility, or welfare information.

An EdTech vendor may process only one slice of the journey, yet that slice can involve minors, detailed learning behavior, or consequential decisions.

An application list helps, but it does not explain the whole ecosystem. Institutions need relationships between:

• Education and training data categories.
• Systems and databases that hold or use them.
• Accountable owners and organizational units.
• Sources, recipients, and storage locations.
• Quality, update, access, and lifecycle controls.
• Credential provenance and verification evidence.
• Sharing and interconnection decisions.
• Personal-data and AI risk records that also apply.

This relationship view is what turns a static inventory into an operating record.

Why Learner Data Needs Its Own Governance Attention

Learner data can be unusually revealing. It may describe identity, attendance, performance, behavior, disability support, family context, financial status, disciplinary matters, and future opportunities. For minors, the imbalance between institution, platform, and learner is even more pronounced.

Education teams should not assume that a legitimate teaching purpose resolves every privacy question. Purpose, access, retention, transparency, sharing, and safeguards still need accountable review under the applicable personal-data framework.

ComplianceOne's education overlay cross-links learner, student, staff, parent/guardian and minor personal-data processing to separate Personal Data Protection Law safeguards. That design avoids duplication while preserving the education-specific context.

The practical benefit is clarity. A learning activity can remain visible as an education record while pointing to the separate privacy assessment and safeguards it depends on. Reviewers can see both the sector reason for the record and the horizontal data-protection work without mistaking them for one obligation.

Lifelong-Learning Records Connect Institutions to VNeID

Decree 88 defines the lifelong-learning record (hồ sơ học tập suốt đời). It includes school records, learning and training results, diplomas and certificates, recognition of foreign qualifications, competency-assessment results, awards and achievements, and confirmation of current enrollment.

Articles 8–9 provide for a unique code linked to the individual's personal identification number, with basic identity information checked against the National Population Database before allocation. Data is held in the National Database on Education and Training. Article 12 provides for validly received and stored data to be shared and integrated with VNeID. Individuals can use their integrated lifelong-learning data as the relevant equivalent of paper records under the applicable conditions.

ComplianceOne governs evidence around the accountable owner, source system, data creation, approval, digital signing and issuance, corrections, sharing, verification performed elsewhere, exceptions and review history. Responsible institutions and infrastructure operators perform VNeID integration.

Credentials Create Two Different Questions

When institutions discuss digital diplomas, certificates, transcripts, and learning records, two questions are often collapsed.

The first concerns credential provenance and institutional action: who created or issued the record, the responsible institution, source evidence, changes, reissuance or revocation where relevant, and verification carried out by an authorized institution or service.

The second concerns digital-record legal validity or equivalence: whether the electronic record was created or digitized under applicable conditions, digital-signature evidence, its relationship to the source or original, integration into the appropriate education-data infrastructure, and evidence supporting use as the legally valid electronic record.

Decree 88 Article 8 requires lifelong-learning data to be digitally signed. A record created directly as a data message has the value of an original when electronic-transactions conditions are met. An electronic copy issued from the database must be digitized from the original or original register, accurate, complete, digitally signed and available for checking and comparison. ComplianceOne preserves evidence for the responsible institution's review; it does not determine legal equivalence.

These questions belong in related but distinct records. A credential can have clear provenance while a legal-equivalence review remains incomplete. Conversely, a policy statement about electronic records does not prove the history of a particular diploma.

ComplianceOne keeps credential and learning-record evidence separate from electronic-record readiness. It organizes evidence about issuance and verification performed by responsible institutions or services. It does not issue a diploma, authenticate one on its own authority, or declare a credential valid.

That boundary protects everyone. The educational institution or authorized actor remains responsible for the credential act. The governance platform preserves the evidence and review history around it.

AI in Education Demands Context, Not Labels

AI can support learning, administration, accessibility, content recommendations, assessment, monitoring, and fraud detection. The same broad technology can create very different consequences depending on its deployed purpose.

ComplianceOne's education overlay cross-links relevant education AI uses to the separate Vietnam AI governance stack: AI Law 134/2025/QH15, Decree 142/2026/NĐ-CP and Decision 33/2026/QĐ-TTg. Circular 05/2026 is relevant only according to its actual scope and guidance status. Decree 88 is not an AI classification instrument.

Decision 33's education categories must be read with their conditions:

• AI providing automatic self-learning content under educational curricula using uncontrolled input content, deployed at a scale capable of systemic risk or widespread effects on learners.
• AI automatically conducting examinations or assessment, with its generated result used as an official basis for learning-result or competency assessment or learner ranking within the national education system.
• AI monitoring or analysing learner behaviour using biometric data, or high-frequency automatic feedback or alerts about attention, personal expression, learning results or learner assessment that cause psychological stress or infringe learner privacy during learning.

Personalization, analytics or learner profiling language alone does not establish high-risk status. Reviewers must apply Decision 33's conditions together with Decree 142's criteria and exclusions. The official signed Decision 33 supplies the controlling appendix.

A ComplianceOne record may trigger or cross-link an AI applicability review. A human-owned AI governance process remains responsible for classification and supporting evidence.

This distinction matters because labels such as personalization or analytics can hide consequential functionality. Governance teams need to describe what the system actually does in context, which learners it affects, what decisions it informs, and whether a relevant AI risk review exists.

The platform should never infer a learner's profile or risk category as part of compliance administration. Nor should it classify the AI system autonomously. It should connect the declared education use to a human-owned AI governance record where responsible reviewers make and evidence the relevant decisions.

Connect Decree 88 to the Wider Compliance Stack

Use Decree 88 as the sector anchor, then assess each separate applicable layer:

Keep applicability, accountable decisions and evidence separate for each framework. One Decree 88 record does not prove compliance with every layer.

Where a public authority or operator has responsibility for national or specialised database infrastructure, ComplianceOne's supported national-database and data-sharing frameworks may require a separate applicability review. This is not automatic for ordinary schools, universities or EdTech vendors.

A Seven-Part Operating Model for Education Data

Education-data governance becomes more coherent when institutions connect seven practices: inventory, database ownership, lifecycle control, credential evidence, sharing governance, privacy cross-linking, and AI risk cross-linking.

Each practice answers a separate accountability question, but none should exist in isolation.

1. Inventory the Flow, Not Only the Dataset

A governed education-data inventory should tie information to systems, owners, sources, and recipients. It should also record the responsible organizational unit, storage context, review date, and status.

The flow is important because student information changes meaning as it moves. An assessment score may begin in a testing platform, enter a learning record, inform academic support, appear in a transcript, and later be shared with another institution.

For each material activity, teams should ask:

• What education or training data is involved?
• Which system creates or receives it?
• Which unit and person are accountable?
• Where did the information originate?
• Which internal and external recipients use it?
• Where is it stored or made available?
• Which quality, access, update, and lifecycle controls apply?
• Which privacy, credential, sharing, or AI evidence is linked?

The answer does not need to reproduce every database field. It needs enough structure for reviewers to follow responsibility and movement.

2. Assign Controls Per Education Database

A single policy for all education databases can conceal differences in ownership, quality, access, and lifecycle.

An admissions database, learning platform, credential repository, and alumni system may have different purposes and retention patterns. They may also have different operators, vendors, user populations, and sharing relationships.

Each database in scope should carry its own control description, implementation evidence, accountable owner, and review history. Shared policy can still provide the institutional baseline. Database-specific records show how that baseline operates in context.

This also improves change review. When one vendor, interface, owner, or access model changes, the institution can identify the affected database and connected evidence without reopening every control indiscriminately.

3. Treat Access as a Lifecycle

Education access changes with enrollment, employment, teaching assignments, support roles, internships, graduation, and vendor engagements.

A one-time authorization is therefore insufficient. Institutions need to explain why access was granted, what role or purpose justified it, when it was reviewed, and what happened when the relationship changed.

Technical identity systems enforce login and permissions. Governance evidence records the justification, accountable approval, and review that sit around those controls. The two should connect without being confused.

Important review points include:

• A learner changes program or institution.
• A staff member changes role or leaves.
• A faculty assignment ends.
• A vendor support arrangement changes.
• A credential service gains a new function.
• An inactive account remains linked to sensitive records.

Access governance becomes defensible when lifecycle events trigger review rather than waiting for an annual certification to discover stale privileges.

4. Preserve Credential Provenance and Verification Evidence

Credential evidence should identify the artifact, evidence description and source, related obligation, responsible person, review date, and status. Where available, it should connect to issuance history and any recorded changes.

The record should describe verification accurately. If an authorized institution, provider, or external service performed a check, the evidence can record what was checked, by whom, when, and with what result. The platform does not convert that record into its own authoritative verification.

This precision is commercially and legally important. A compliance tool that claims to verify diplomas creates an expectation that it possesses authority, source access, or cryptographic functionality it may not have. Evidence management is valuable without that overstatement.

The durable outcome is traceability. When a graduate, employer, auditor, or institution raises a question, the responsible team can locate the source and history used for its decision.

5. Govern Sharing and Interconnection as Decisions

Education data can move between institutions, platforms, public services, credential systems, assessment providers, and other recipients. An interface diagram can show where a connection exists. It does not necessarily explain why the sharing was approved, which information is in scope, or what safeguards apply.

A governed sharing record should name the source, recipient, purpose, data scope, storage context, responsible owner, authorization, safeguards, and review point. It should also link to related frameworks where the same transfer raises separate privacy, identity, data, or cybersecurity questions.

This structure helps when a connection evolves. If a recipient changes its service or the data scope expands, the owner can test whether the original decision and safeguards still fit.

The platform does not perform the transfer simply because it records the arrangement. Its role is to preserve the accountable decision and supporting evidence.

6. Link Personal-Data Safeguards Without Duplicating Them

Learner, student, staff, and minor information can fall under personal-data safeguards. The education overlay should identify that relationship without building a second privacy program.

Cross-links allow the education activity to point to the relevant privacy evidence while retaining its own owner, database, learning purpose, and sector context. One assessment or safeguard can support several reviews without becoming several conflicting copies.

Teams should still examine whether the linked evidence remains current for the education use. A generic privacy assessment may not reflect a new learner population, analytics feature, recipient, or retention practice. Reuse should reduce duplication, not reduce scrutiny.

7. Connect AI Uses to Human-Owned Risk Review

When an AI system assesses, ranks, monitors, or profiles learners, the education record should identify the system and connect to the relevant AI governance evidence.

The institution should describe the deployed use in plain language. Does the system score examinations, recommend interventions, monitor behavior, rank applicants, or influence progression? Who is affected? What role does a person retain in the decision? Which notices, challenge routes, and oversight evidence exist?

The compliance record should not derive a learner profile or make a pedagogical judgment. It should not decide that the AI system is high risk. Those decisions remain with responsible people using the applicable AI governance process.

The cross-link makes missing work visible. If a consequential learner system has no completed AI risk review, leadership can assign ownership. If a review exists, education teams can connect their sector evidence without copying the classification.

A New Adaptive Learning Platform

Consider a school adopting an adaptive learning platform. The vendor describes personalized content recommendations, progress monitoring, and teacher dashboards.

The institution first records the education-data activity. The inventory identifies the learner data, source systems, recipients, storage context, owner, and review date. The relevant database records document quality, update, access, and lifecycle controls.

Because the deployed functionality may warrant assessment, the education team initiates or links a separate AI applicability and risk review under Decree 142 and Decision 33. Progress monitoring or personalization alone does not establish high-risk status. Responsible reviewers document what the system actually does, which decisions it informs, which learners are affected, and which human oversight remains.

Privacy evidence addresses learner and minor safeguards through the appropriate personal-data process. The vendor and sharing records identify the recipient, purpose, data scope, and safeguards. Technical systems enforce access, while governance evidence records why access and sharing were approved.

ComplianceOne connects the institution's declarations, decisions, owners, and supporting evidence so reviewers can see whether critical questions were answered.

A Diploma Verification Request

An employer asks a university to confirm a digital diploma. The registrar identifies the credential record and the evidence source maintained by the institution. The verification performed through the authorized process is recorded with its responsible person, date, result, and supporting material.

If the electronic artifact has changed or been reissued, the history remains visible. A separate readiness record addresses the institution's evidence regarding legal equivalence of electronic education records where applicable.

ComplianceOne organizes evidence, exceptions, approvals and review history. The registrar and authorized verification service retain responsibility for the credential action.

That division makes the evidence trustworthy. A later reviewer can distinguish the educational act from the governance record about that act.

An Inter-Institution Data Exchange

Two education institutions establish an interconnection to support learner transfer. The data team can explain the interface, but governance requires a broader record.

The sharing decision identifies both institutions, the purpose, information scope, storage context, accountable owner, authorization, and safeguards. The inventory records source and recipient relationships. Privacy and cybersecurity records remain separate but linked.

When the exchange expands to include another record category, the owner reviews whether the earlier authorization and safeguards still apply. Contributor and approval history shows who made the update and when.

The result is not proof that every technical event was secure. It is evidence that the institution governed the arrangement as it changed.

What Education Leaders Should Review

Boards and senior leaders do not need every system field. They need assurance that education-data decisions have accountable owners and visible gaps.

A useful review can ask:

1. Which material activities or databases lack current owners, review dates or quality, access and lifecycle evidence?
2. Which relevant institutions are ready for lifelong-learning-record and VNeID data obligations?
3. Which in-scope general/continuing education activities satisfy Circular 70 digital-record requirements?
4. Can credential provenance and authorized verification be traced, with legal-validity/equivalence evidence reviewed separately?
5. Which sharing arrangements or credentials have changed since their evidence was approved?
6. Are learner, staff, parent/guardian and minor safeguards linked to current privacy evidence?
7. Which education AI deployments have completed a separate Decision 33 / Decree 142 review with human-owned classification and oversight?

Leaders should also protect the language used in reports. No official form has been verified against the checked Decree 88 Gazette text, appendices, or linked Ministry of Education and Training procedure references. ComplianceOne's eight templates are internal working documents, not government forms.

The platform also does not record monetary fine amounts for Decree 88. Penalty claims should be checked against authoritative legal sources and qualified advice rather than copied from summaries.

These cautions do not weaken the program. They distinguish verified facts from workflow aids and prevent internal documentation from acquiring authority it does not possess.

Reference Mode Without Accidental Commitment

ComplianceOne's Decree 88 overlay supports in-scope education organizations. Other organizations can install the overlay in reference mode to review requirements and evidence templates without generating deadlines, compliance-score contributions, or automated workflows.

This is useful for technology providers, partners, and organizations exploring education services. They can understand the operating model before completing scope analysis.

Reference access should not be presented as a legal conclusion. It provides a safe way to study the framework while the organization remains responsible for applicability assessment.

The Shift From Student Records to Student-Data Accountability

Education institutions have always managed records. The modern challenge is managing the relationships around those records as systems, providers, analytics, and sharing arrangements multiply.

The governance shift is from asking where the data is stored to asking who owns the activity, where the data came from, who receives it, why access exists, how quality and lifecycle are controlled, and which evidence supports credentials or AI decisions.

This approach also keeps human authority where it belongs. Institutions and authorized actors issue and verify credentials. Educators and accountable reviewers interpret learner context. AI governance reviewers assess system risk. The compliance platform connects the evidence and preserves the history.

That boundary is essential for trustworthy EdTech. Automation should make accountability easier to inspect, not make consequential decisions appear ownerless.

Education-data governance under Decree 88 becomes manageable when institutions connect education-data inventory, database governance, credential evidence, sharing decisions, privacy safeguards, and AI risk review without merging their distinct roles.

To see how governed education records and connected evidence can support daily privacy and compliance operations, explore AesirX ComplianceOne.

Ronni K. Gothard Christiansen
Technical Privacy Engineer and CEO, AesirX.io

Education & EdTech Data Governance in Practice

See how ComplianceOne connects student records, digital credentials, data sharing, privacy and AI governance with accountable owners and supporting evidence, without replacing existing education systems.

Laws and instruments referenced

Laws and instruments referenced

Decree 88/2026/NĐ-CP provides the primary education-sector framework for education and training data, the National Database on Education and Training, lifelong-learning records, data sharing and interoperability.

Circular 70/2026/TT-BGDĐT, effective 8 October 2026, governs digital student records in general and continuing education within its defined scope.

Personal Data Protection Law 91/2025/QH15, Decree 356/2025/NĐ-CP and Decision 778/QĐ-BCA provide the applicable personal-data protection framework and procedures for learner, staff, parent/guardian and minor data processing.

Data Law 60/2024/QH15, Decree 165/2025/NĐ-CP and Decision 20/2025/QĐ-TTg establish the wider data-governance framework, including important and core data classification where applicable.

Cybersecurity Law 116/2025/QH15 and Decrees 333/2026/NĐ-CP, 331/2026/NĐ-CP and 330/2026/NĐ-CP address applicable cybersecurity obligations, information-system protection and enforcement.

Electronic Transactions Law 20/2023/QH15 and Decree 23/2025/NĐ-CP, alongside applicable digital-signature and trust-service requirements, provide the electronic-record framework relevant to signed education records, credentials and legal equivalence.

Identity Law 26/2023/QH15, Decree 69/2024/NĐ-CP and Decree 320/2026/NĐ-CP provide the relevant identity and electronic-identification framework, including personal identifiers and VNeID.

AI Law 134/2025/QH15, Decree 142/2026/NĐ-CP, Decision 33/2026/QĐ-TTg and Circular 05/2026, according to its applicable scope and guidance status, provide the separate AI governance framework for education AI systems.

State Secrets Protection Law 117/2025/QH15 and Decree 63/2026/NĐ-CP require separate assessment where education or training data relates to state secrets, which Decree 88 excludes from its scope.

These instruments do not automatically apply in full to every school, university, training provider or EdTech organization. Applicability depends on actual activities, systems, data and organizational responsibilities.

Disclaimer

This article provides general operational and compliance information and does not constitute legal or professional advice. Regulatory applicability depends on the organization, activities, systems and data involved. ComplianceOne supports governance and evidence management but does not issue or verify credentials, perform VNeID integration, assess learners or autonomously classify AI systems. Organizations should confirm applicable requirements with qualified legal, compliance and technical professionals.

Frequently Asked Questions About Education & EdTech Data Governance