As the legal framework for personal data protection continues to develop, businesses face increasingly specific requirements in implementing and maintaining compliance. Data Protection Officers (DPOs) need legal knowledge, an understanding of cybersecurity, and the ability to coordinate with relevant departments to identify and manage risks arising from personal data processing activities.
The Law on Personal Data Protection No. 91/2025/QH15 and Decree No. 356/2025/ND-CP establish the legal framework governing personal data protection in Vietnam. To implement these requirements in practice, businesses need to consider their specific operations, the types of data processed, their information technology systems, and their relationships with other parties involved in data processing.
To support businesses and personnel responsible for this area, Asia Legal, in collaboration with CyRadar, is organizing a Personal Data Protection Officer (DPO) Training Program on 12–13 November 2026 in Hanoi. The program combines legal knowledge, cybersecurity expertise, and practical skills to help participants translate compliance requirements into policies, procedures, templates, and implementation measures suited to their operational needs.
1. PROGRAM INFORMATION
- Program Title: Personal Data Protection Officer (DPO) Training Program under the 2025 Law on Personal Data Protection and Decree No. 356.
- Date: 12–13 November 2026.
- Venue: 5th Floor, Asia Legal, No. 23, Lot N03, Dich Vong New Urban Area, Dich Vong Street, Cau Giay Ward, Hanoi, Vietnam.
- Organizers: Asia Legal, in collaboration with CyRadar.
2. TRAINING OBJECTIVES
The program is designed to equip participants with the foundational knowledge and practical skills necessary to carry out or coordinate personal data protection activities within their organizations.
Upon completion of the program, participants will be able to:
- Understand the legal framework for personal data protection, including relevant requirements under the 2025 Law on Personal Data Protection and Decree No. 356.
- Understand the roles and responsibilities of DPOs and how they coordinate with legal, information technology, cybersecurity, and other relevant departments.
- Identify personal data processing activities, determine the applicable legal bases, and develop data flow maps.
- Develop and review policies, procedures, and templates to support compliance activities.
- Understand the methodologies for preparing Personal Data Processing Impact Assessment (DPIA) dossiers and Cross-border Personal Data Transfer Impact Assessment (CTIA) dossiers.
- Improve their ability to identify risks and select appropriate management measures based on their organizations’ operational characteristics.
3. TRAINING CONTENT
The program comprises six modules delivered over two days, combining foundational knowledge, implementation skills, and practical case studies.
Module 1. Cybersecurity Skills and Information System Management
Participants will explore issues relating to access control, information system security, and coordination between DPOs and information technology and cybersecurity teams. This module helps participants better understand the relationship between legal compliance requirements and data protection measures in technology-driven environments.
Module 2. Legal Framework for Personal Data Protection
This module focuses on the legal framework governing personal data protection in Vietnam, including the Law on Personal Data Protection No. 91/2025/QH15 and Decree No. 356/2025/ND-CP. Participants will review the key legal requirements to consider when organizing personal data processing activities and implementing compliance measures within their organizations.
Module 3. Roles and Responsibilities of DPOs
This module clarifies the role of DPOs within corporate governance structures, their responsibilities in organizing and implementing compliance activities, and the coordination mechanisms required to work effectively with relevant departments.
Participants will gain a clearer understanding of their scope of work, responsibilities, and coordination arrangements when implementing personal data protection measures.
Module 4. Identifying Legal Bases and Mapping Personal Data Processing Flows
Participants will learn how to identify the appropriate legal basis for each personal data processing activity, including circumstances in which consent is not required and those in which consent is required under the applicable regulations.
The module also covers data flow mapping, identifying the roles of parties involved in processing, managing processors and third parties, and identifying risks throughout the personal data lifecycle.
Module 5. Developing Policies, Procedures, and Templates
This module introduces participants to the development and refinement of documentation supporting compliance, ranging from internal policies to procedures and templates relating to personal data processing.
The focus is on applying legal knowledge to corporate governance and ensuring that relevant documents are tailored to each organization’s operating model and practical requirements.
Module 6. Preparing DPIA and CTIA Dossiers
Participants will be introduced to the methodologies for preparing Personal Data Processing Impact Assessment (DPIA) dossiers and Cross-border Personal Data Transfer Impact Assessment (CTIA) dossiers.
The module focuses on identifying processing or transfer activities subject to assessment, evaluating relevant risks, and organizing documentation to support compliance with applicable regulations.
4. TRAINERS
The program brings together legal and cybersecurity professionals, combining perspectives on regulatory compliance with the practical implementation of data protection measures.
- Lawyer Luu Xuan Vinh – Managing Partner, Asia Legal.
- Mr. Nguyen Minh Duc – Chief Executive Officer of CyRadar and cybersecurity expert.
- Lawyer Tran Dai Phong – Associate Lawyer, Asia Legal.
By combining legal knowledge with cybersecurity expertise, the program addresses personal data protection from both regulatory and information system management perspectives.
5. WHO SHOULD ATTEND?
The program is suitable for:
- Personnel currently responsible for, or assigned to undertake, personal data protection functions within businesses.
- Personnel working in legal, human resources (HR), information technology (IT), cybersecurity, and compliance departments.
- Personnel at domestic and foreign-invested enterprises (FDI) that are implementing or strengthening their personal data protection compliance frameworks.
- Individuals seeking to develop a career in personal data protection and learn about the pathway to becoming a DPO.
6. TUITION FEES AND PARTICIPANT BENEFITS
Tuition Fees
- Standard tuition fee: VND 9,000,000 per participant.
- 20% early registration discount: Available to participants who register before 30 October 2026. The discounted fee is VND 7,200,000 per participant.
- 20% group registration discount: Available to groups of three or more participants. The discounted fee is VND 7,200,000 per participant.
The two discount schemes cannot be combined. Each participant may apply only one discount.
The tuition fee includes participation in the training program, refreshments during breaks, lunch on both training days, training materials, and the program’s practical templates.m, refreshments during breaks, lunch on both training days, training materials, practical templates, and a certificate of completion subject to the program’s requirements.
Participant Benefits
By participating in the program, participants will have the opportunity to:
- Gain knowledge of the legal framework and cybersecurity issues relevant to personal data protection.
- Understand the key steps in implementing compliance, from identifying legal bases and mapping data flows to developing policies, procedures, and templates.
- Practice preparing documentation relating to personal data processing impact assessments and cross-border personal data transfers.
- Access training materials and practical templates to support learning, further study, and application in their professional work.
7. REGISTRATION
The program is scheduled to take place on 12–13 November 2026 in Hanoi. The registration deadline is 5 November 2026. The number of participants is limited to facilitate effective training and practical exercises.
Interested participants can find further information and register using the link below:
Registration link: https://forms.gle/8vPWiDVkAyNtFh5z7
Through this program, Asia Legal and CyRadar aim to help personnel responsible for personal data protection strengthen their knowledge, improve their implementation skills, and take a more proactive approach to establishing and maintaining compliance within their organizations.
———————————————————
Asia Legal – Business Law Firm
Website: asialegal.vn
Email: info@asialegal.vn
Tele: 084 400 8484
Address: No. 23, Lot N03, Dich Vong New Urban Area, Dich Vong Street, Cau Giay Ward, Hanoi, Vietnam
