HR DATA MANAGEMENT AND CONCLUSION OF ELECTRONIC EMPLOYMENT CONTRACTS (2026)

DAY 1 (JULY 24, 2026): LEGAL FRAMEWORK AND DATA COLLECTION & INTEGRATION PROCESSES

Morning Session

General Provisions – Identifying "Digital Assets" and Security Boundaries

1. General provisions – requirements and conditions for personal data protection under Decree No. 356/2025/ND-CP Elaborating on Certain Articles and Implementation Measures of the Law on Personal Data Protection;

2. Classification of HR data: Categorizing Basic Data (full name, citizen ID number, phone number) and Sensitive Data (eKYC biometric data, GPS location data, financial history);

3. Human factor risk awareness: Analysis of data breaches caused by employees' intentional violations of security protocols or accidental clicks on malicious links (accounting for 70% of security incidents).

4. Financial Consequences: Discussion of compliance violations by Data Protection Officers (DPOs) leading to significant penalties and the direct accountability of executive leadership for compliance failures.

Afternoon Session

Concluding Electronic Employment Contracts (eContract)

and the "Consent" Mechanism

1. eContracts: Practical implementation from the Content Layer to the eKYC Identity Verification Layer, Digital Signature, and Integrity Assurance Layer.

2. Designing transparent consent notices:

• Prohibiting the use of Pre-Ticked Consent Boxes.
• Developing a separate consent notice: Presenting a distinct notice stating, "This is sensitive personal data," before employees complete eKYC verification or enable GPS location services.

3. Integrating data protection clauses: Drafting template clauses on confidentiality, purposes of data processing, and employer commitments in eContracts.

JULY 25, 2026: SLA OPERATIONS

& DATA PROTECTION IMPACT ASSESSMENT (DPIA) COMPLIANCE DOCUMENTATION

Morning Session

Managing Operations & Implementing Data Subject Rights

1. Establish the SLA Dashboard:

• Respond within 2 business days: Implement a procedure for receiving and handling employees' requests to access, correct, or delete their personal data.
• Complete within 15–20 days: Implement a procedure to cease processing or permanently delete personal data across all systems.

2. The "Need-to-know" Principle: Implementing strict access controls, ensuring only authorized personnel (e.g., payroll accountants, direct HR staff) have access to sensitive data.

3. Role of the DPO: Providing guidance on the competency standards and responsibilities of dedicated data protection personnel within the organization.

Afternoon Session

Implementing Employers' Personal Data Protection Responsibilities

Completing DPIA Documentation and Practicing Incident Response

1. Developing data flow diagrams: Visually mapping how personal data flows throughout the employee lifecycle - from recruitment and employment to offboarding and data deletion.

2. Completing the DPIA report (Form No. 10): Practicing how to justify the purpose of data processing and identify risk mitigation measures for submission to the Department of Cybersecurity and High-Tech Crime Prevention (A05) within 60 days.

3. Practicing 72-hour breach notification: simulating a biometric data breach scenario and practicing emergency notification to affected employees and the competent authorities.

4. Discussion and course wrap-up.