Welcome back to The Lawyers Talk of BLawyers Vietnam. I am Dang Thi Kim Chau, and it is my pleasure to reconnect with you all in today’s podcast episode.
Pursuant to the Law on Personal data protection 2025 (“PDPL 2025”), agencies and organizations are responsible for appointing a department or personnel with sufficient qualifications and capacity to protect personal data or engaging organizations or individuals to provide personal data protection services.
However, in practice, many enterprises encounter the same concern when implementing this requirement: who should be designated as the appropriate focal point to perform as Data Protection Officer (“DPO”)? Should it be the Legal Department, the Information Technology Department, the Human Resources Department, or a dedicated specialized unit? The selection of an appropriate model not only affects compliance effectiveness but also directly impacts how data is managed and operated within the enterprise.
In today’s episode, we will discuss 03 key issues, as follows:
- The possible organizational models that enterprises may adopt for the DPO?;
- The requirements and qualifications that DPO must satisfy?; and
- How the scope of work of such function should be defined to ensure both legal compliance and practical alignment with the enterprise’s operational activities?
1. Organizational models for establishing a DPO within enterprises
When implementing the PDPL 2025, enterprises are required to establish a DPO responsible for personal data protection. This constitutes a core component of the DPO, enabling the enterprise to monitor, coordinate, and ensure that data flows are processed in compliance with applicable legal requirements.
(i) Firstly, regarding the organizational form of the DPO: Enterprises may choose to:
- Appoint an individual or establish an internal personal data protection unit: Such individual or unit will be responsible for coordinating, supervising, and working with relevant departments to ensure that personal data is processed in compliance with applicable legal requirements; or
- Engage an external organization or individual to provide DPO services: Importantly, the external service provider must satisfy the statutory requirements on qualifications, expertise, and experience in personal data protection under applicable laws.
When making such selection, enterprises should take into account their scale of operations, volume of personal data, and operational costs, in order to balance legal compliance with business efficiency.
(i) Secondly, regarding the organizational structure models for the enterprise’s DPO:
When organizing internally, enterprises may apply the following 03 common models:
- Centralized model: a dedicated personal data protection unit is responsible for coordinating policies and overseeing personal data protection activities across the enterprise. This model is suitable for large enterprises or those processing complex and high-volume data flows.
- Decentralized model: each department has its own designated personal data protection personnel responsible for managing data protection risks within that specific department. This model enables close alignment with operational activities; however, a coordination mechanism is required to ensure consistent application of policies across the enterprise.
- Hybrid model: a combination of a central personal data protection unit and designated personal data protection personnel within various departments such as legal, sales, technical, etc. This model ensures centralized governance while maintaining close supervision of individual data processing activities.
Regardless of the model selected, enterprises must designate at least one DPO to act as the primary point of contact with the personal data protection authority (the Ministry of Public Security). This ensures that all personal data-related activities within the enterprise are properly monitored, guided, and communicated with the competent state authority in an official and effective manner.
2. Requirements for a DPO
In this section, we will discuss the requirements that DPOs must satisfy, as well as several practical issues commonly raised by enterprises.
When many enterprises begin implementation, the first question is often: “What qualifications and experience should a DPO have to ensure both legal compliance and effective operations?”
(i) Pursuant to Decree 356/2025/ND-CP, personal data protection personnel must possess at least a college-level qualification or higher. In terms of experience, for internal personnel, a minimum of 02 years of working experience (calculated from the date of graduation) in one of the following fields is required: legal affairs, information technology, cybersecurity, data security, risk management, compliance control, human resource management, or personnel administration. For outsourced service providers, the requirements are more stringent, requiring approximately 03 years of experience in similar fields.
A common question raised by enterprises is whether one individual may concurrently hold multiple roles, for example, serving both as an IT officer and a DPO. This is permissible; however, enterprises must carefully assess such arrangements in terms of expertise, authority, and coordination capacity to ensure effective implementation.
(ii) In addition to experience, DPO must also be trained in specialized knowledge of personal data protection. This includes the ability to develop policies, procedures, and templates; implement data subject rights; prepare data protection impact assessment documentation; and establish incident response plans.
(iii) With regard to training and certification, Vietnamese personal data protection authorities do not currently recognize any official professional certification or licensing scheme for DPO. This means that enterprises are not required to purchase external training programs or rely on international certifications.
However, depending on business needs, enterprises may engage third-party service providers, or even proactively organize internal training for their own DPO. In such cases, enterprises should ensure that the training process and assessment are properly documented, so that competent authorities can verify that the enterprise has fulfilled its obligation to train DPO in accordance with legal requirements.
(iv) Finally, enterprises are responsible for assessing and selecting DPO, issuing formal appointment decisions, and maintaining compliance documentation. In the case of outsourcing, the service provider must have at least 03 personnel who meet the required qualifications and experience standards. Accordingly, when selecting DPOs, enterprises should not only consider qualifications and experience, but also organizational positioning, authority, and coordination capability. These factors are decisive in determining whether the DPO operates effectively in practice, rather than existing merely as a formal designation.
3. Key Responsibilities of a DPO within enterprises
Pursuant to Article 8 of the PDPL 2025, violations of personal data protection regulations may result in administrative sanctions, criminal liability, or compensation for damages. Administrative fines imposed on enterprises may reach up to 5% of the preceding year’s revenue in cases of unlawful cross-border transfer of personal data, or up to VND 3 billion for other violations.
Accordingly, the legal risks associated with personal data processing within enterprises are significant. In this context, the DPO plays a critical role as a key function enabling legal compliance, mitigating financial risks, and strengthening customer trust.
(i) Firstly, the DPO is responsible for:
- Establishing internal policies, procedures, regulations, and templates to ensure that all personal data processing activities are based on lawful grounds and comply with applicable legal requirements;
- Monitoring data flows within the enterprise to ensure that personal data is processed in a lawful, purpose-specific, and transparent manner;
- Preparing, maintaining, and updating records and reports, including data protection impact assessment dossiers, cross-border personal data transfer impact assessment dossiers, and annual compliance reports (in cases where competent authorities inspect or audit the enterprise’s personal data protection activities);
- Establishing procedures for customers or employees to exercise their rights, including access, correction, deletion of personal data, or withdrawal of consent, and ensuring that such procedures are properly communicated within the organization;
- Developing and implementing periodic training and capacity-building programs on personal data protection within the enterprise;
- Coordinating the implementation of technical security measures and developing incident response plans in the event of data breaches or leaks; and
- Updating relevant personal data protection regulations and advising senior management on necessary policies and decisions.
(ii) Secondly, regarding the limitation of liability of the DPO, current laws do not provide detailed provisions in this regard. Accordingly, enterprises may:
- Define the scope of work and authority in the appointment decision or service contract, ensuring that the DPO clearly understands their responsibilities;
- Establish liability exemption mechanisms for non-intentional errors or breaches not amounting to serious misconduct; and
- Provide sufficient resources and working conditions to enable the DPO to perform their duties effectively and minimize risks arising from external factors.
Thus, DPOs bear significant responsibilities, serving both as the function in charge of managing and monitoring data flows and as the primary legal liaison with the competent regulatory authority. Enterprises should clearly define their authority, scope of work, and supporting mechanisms to ensure that these responsibilities are effectively carried out, thereby mitigating legal risks and safeguarding business operations.
Through today’s discussion, we have reviewed the organizational models, personnel requirements, key responsibilities, and limitations of liability of the DPO. We hope that this information will help enterprises better understand the pivotal role of the DPO and serve as a basis for effective implementation in practice.
Should you have any questions or concerns, please feel free to leave your comments below. For more information about BLawyers Vietnam, please visit our website below the The Lawyers Talk podcast screen.
Thank you and see you again.
The above is not official advice from BLawyers Vietnam. If you have any questions or suggestions about the above, please contact us at info@blawyersvn.com. We would love to hear from you.
Date: 24 June 2026
Chau Dang
Please see further information at link