As Vietnam’s personal data protection regulatory framework continues to evolve, businesses face increasingly specific requirements for implementing and maintaining compliance. Personal Data Protection Officers (DPOs) need legal knowledge, an understanding of cybersecurity, and the ability to coordinate with relevant departments to identify and manage risks arising from personal data processing activities.
The Law on Personal Data Protection No. 91/2025/QH15 and Decree No. 356/2025/ND-CP establish the legal framework for personal data protection in Vietnam. To implement these requirements in practice, businesses need to consider their operational characteristics, the types of data they process, their information technology systems, and their relationships with parties involved in data processing.
To support businesses and professionals responsible for personal data protection, Asia Legal, in collaboration with CyRadar, is organizing a Personal Data Protection Officer (DPO) Training and Certification Program on November 12–13, 2026, in Hanoi. The program combines legal knowledge, cybersecurity expertise, and practical skills to help participants translate compliance requirements into policies, procedures, forms, and implementation measures suited to their organizations’ operational needs.
1. PROGRAM INFORMATION
- Program title: Personal Data Protection Officer (DPO) Training and Certification Program under the 2025 Law on Personal Data Protection and Decree No. 356.
- Date: November 12–13, 2026.
- Venue: 5th Floor, Asia Legal, No. 23, Lot N03, Dich Vong New Urban Area, Cau Giay Ward, Hanoi, Vietnam.
- Organizers: Asia Legal in collaboration with CyRadar.
2. TRAINING OBJECTIVES
The program is designed to equip participants with the foundational knowledge and practical skills necessary to carry out or support personal data protection activities within their organizations.
Upon completing the program, participants will have the opportunity to:
- Understand the legal framework for personal data protection, including relevant requirements under the 2025 Law on Personal Data Protection and Decree No. 356.
- Understand the roles and responsibilities of DPOs and how they coordinate with legal, information technology, cybersecurity, and other relevant departments.
- Identify personal data processing activities, determine applicable legal bases, and map data flows.
- Develop and review policies, procedures, and forms to support compliance.
- Learn approaches to preparing Personal Data Protection Impact Assessments (DPIAs) and Cross-Border Transfer Impact Assessments (CTIAs).
- Strengthen their ability to identify risks and select appropriate management measures based on their organizations’ operational characteristics.
3. TRAINING CONTENT
The program consists of six modules delivered over two days, combining foundational knowledge, compliance implementation skills, and practical case studies.
Module 1. Cybersecurity Skills and Information System Management
Participants will explore key aspects of access control management, information system protection, and coordination between DPOs and IT and cybersecurity teams. This module helps participants better understand the relationship between legal compliance requirements and data protection measures in technology-driven environments.
Module 2. Legal Framework for Personal Data Protection
This module focuses on the legal framework governing personal data protection in Vietnam, including the Law on Personal Data Protection No. 91/2025/QH15 and Decree No. 356/2025/ND-CP. Participants will review key legal requirements to consider when organizing personal data processing activities and implementing compliance measures within their organizations.
Module 3. Roles and Responsibilities of a DPO
This module clarifies the role of DPOs within an organization’s governance structure, their responsibilities for coordinating compliance activities, and their working relationships with relevant departments.
Through this module, participants will gain a clearer understanding of the scope of their responsibilities and how to coordinate personal data protection activities across their organizations.
Module 4. Identifying Legal Bases and Mapping Personal Data Processing Flows
Participants will learn how to identify the appropriate legal basis for different personal data processing activities, including circumstances in which consent is not required and those in which consent is required under applicable regulations.
The module also covers data flow mapping, identifying the roles of parties involved in processing, managing processors and third parties, and identifying risks throughout the personal data lifecycle.
Module 5. Developing Policies, Procedures, and Forms
This module introduces participants to the development and review of documentation supporting compliance, from internal policies to procedures and forms relating to personal data processing.
The focus is on applying legal requirements to organizational governance and ensuring that documentation is tailored to each organization’s operational model and practical needs.
Module 6. Preparing DPIA and CTIA Documentation
Participants will be introduced to approaches for preparing Personal Data Protection Impact Assessments (DPIAs) and Cross-Border Transfer Impact Assessments (CTIAs).
The module focuses on identifying processing or transfer activities that fall within the scope of assessment, evaluating relevant risks, and preparing documentation to support compliance with applicable requirements.
4. TRAINERS
The program features professionals in the legal and cybersecurity fields, bringing complementary perspectives on regulatory compliance and the practical implementation of personal data protection measures.
- Lawyer Luu Xuan Vinh – Managing Lawyer at Asia Legal.
- Mr. Nguyen Minh Duc – Chief Executive Officer (CEO) of CyRadar and cybersecurity expert.
- Lawyer Tran Dai Phong – Associate Lawyer at Asia Legal.
By combining legal knowledge with cybersecurity expertise, the program addresses personal data protection from both regulatory and information system management perspectives.
5. WHO SHOULD ATTEND?
The program is suitable for:
- Professionals currently responsible for, or assigned to undertake, personal data protection duties within businesses.
- Personnel working in legal, human resources (HR), information technology (IT), cybersecurity, and compliance functions.
- Professionals at Vietnamese enterprises and foreign-invested enterprises (FDI) that are implementing or strengthening their personal data protection compliance frameworks.
- Individuals seeking to develop a career in personal data protection and explore a pathway toward becoming a DPO.
6. TUITION FEES AND PARTICIPANT BENEFITS
Tuition Fees
- Standard tuition fee: VND 9,000,000 per participant.
- 20% early registration discount: Available to participants who register before October 30, 2026. The discounted fee is VND 7,200,000 per participant.
- 20% group registration discount: Available to groups registering three or more participants. The discounted fee is VND 7,200,000 per participant.
The two discount policies cannot be combined. Each participant may apply only one discount.
The tuition fee includes participation in the training program, refreshments during breaks, lunch on both training days, training materials, practical templates, and a certificate of completion subject to the program’s requirements.
Participant Benefits
By participating in the program, participants will have the opportunity to:
- Gain knowledge of the legal framework and cybersecurity issues relevant to personal data protection.
- Develop a structured understanding of compliance implementation, from identifying legal bases and mapping data flows to developing policies, procedures, and forms.
- Practice working with documentation relating to personal data protection impact assessments and cross-border personal data transfers.
- Access training materials and practical templates to support learning, research, and workplace application.
- Receive a certificate of completion upon meeting the program’s requirements.
7. REGISTRATION
The program is scheduled to take place on November 12–13, 2026, in Hanoi. The registration deadline is November 5, 2026. The number of participants is limited to facilitate effective training delivery and practical exercises.
Interested individuals can find further information and register using the link below:
Registration link: https://forms.gle/8vPWiDVkAyNtFh5z7
Through this program, Asia Legal and CyRadar aim to support professionals responsible for personal data protection in strengthening their knowledge, developing practical implementation skills, and taking a more proactive approach to establishing and maintaining compliance within their organizations.
———————————————————
Asia Legal – Business Law Firm
Website: asialegal.vn
Email: info@asialegal.vn
Tele: 084 400 8484
Address: No. 23, Lot N03, Dich Vong New Urban Area, Dich Vong Street, Cau Giay Ward, Hanoi, Vietnam
