Responsibilities in Cases of Changes to the Personal Data Processing Officer and Practical Situations

Organizations, Enterprises typically designate a department, individual, or external entity to be in charge of and responsible for activities related to the processing of information and data of partners, customers, employees, and other relevant subjects. This person or department plays a key role in supervising compliance with regulations on data in general and personal data in particular, in accordance with the Law on Personal Data Protection 2025. However, due to changes in organizational structure, corporate restructuring, or personnel replacement, any change to the party responsible for personal data processing constitutes an event that must be strictly and carefully managed.

In this article, VDPC analyzes the legal obligations arising from changes to the party responsible for personal data processing in accordance with applicable laws and regulations.

Legal basis: Article 2, 22, 37 Law on Personal Data Protection 2025

1. Practical Situation

Transport Cooperative A has completed the procedure for notifying and conducting a Personal Data Processing Impact Assessment in accordance with applicable regulations.

However, at present, the cooperative has changed its operational model: instead of outsourcing the management of its ride-hailing application to an IT company, it has now recruited an internal IT Department to operate the application and has received a full transfer of data and source code from the previously engaged IT company.

In this context, is the cooperative required to carry out any procedures to notify A05 of such changes? How do the cooperative’s responsibilities change in this case?

2. Types of Personal Data Processed by the Cooperative

The types of personal data processed by Transport Cooperative A (hereinafter referred to as the “Cooperative”) mainly fall within the scope of basic personal data (for example: customers’ names, ages, addresses, telephone numbers, etc.).

(Basic personal data refers to personal data reflecting common biographical and identity-related information that is frequently used in transactions and social relations, as categorized by the Government.)

Pursuant to regulations on personal data processing activities, acts involving impacts on personal data—such as collecting data from customers and partners, or activities of modifying or deleting data—carried out by the newly recruited IT Department of the Cooperative constitute personal data processing activities.

Meanwhile, acts related to personal data such as deciding on the purposes of processing customers’ and partners’ personal data collected by the Cooperative, and deciding on the means of collecting, modifying, or deleting personal data, are classified as personal data controlling activities.

3. Role of Transport Cooperative A in Personal Data Activities

Pursuant to the newly promulgated Law on Personal Data Protection, and based on the personal data controlling and processing activities as analyzed above, upon recruiting an internal IT Department to operate the application and receiving the full transfer of data and source code from the previously outsourced IT company, the Cooperative assumes the role of a Personal Data Controlling and Processing Party.

(A Personal Data Controlling and Processing Party refers to an agency, organization, or individual that determines the purposes and means of personal data processing and directly processes personal data.)

4. Is the Cooperative Required to Notify A05 of the Change in the IT Department?

(1)Yes. Pursuant to the Law on Personal Data Protection, the Cooperative is required to promptly update its Personal Data Processing Impact Assessment dossier in cases where there is a change in information regarding the organization or individual providing personal data protection services.

Specifically, this includes changes related to the personal data processing unit, from the previously outsourced IT company to the internally recruited IT Department of the Cooperative.

(2) With respect to the dossier and procedures for such updates, as the Law on Personal Data Protection does not yet provide detailed regulations and the relevant guiding documents have not been issued, these matters are expected to be specified in subsequent guiding documents or decrees issued in connection with the Law on Personal Data Protection.

5. How Do the Cooperative’s Responsibilities Change in This Case?

As the Cooperative has assumed the role of a Personal Data Controlling and Processing Party, it shall bear both the responsibilities of a personal data controller and a personal data processor in accordance with the Law on Personal Data Protection, including but not limited to the following obligations:

Specify the responsibilities, rights, and obligations of the concerned parties to be complied with in agreements or contracts regarding personal data processing
Decide on the purposes and means of personal data processing in documents and agreements with personal data subject matters, ensuring compliance with the principles and contents
Adopt appropriate managerial and technical measures to protect personal data according to the law and review and update such measures if necessary
Issue notices of violations against personal data protection regulations
Select an appropriate personal data processing party to process personal data
Ensure the rights of personal data subject matters
Assume responsibility before personal data subject matters for any damage arising from personal data processing

Additionally, there are other responsibilities, such as:

Prevent unauthorized collection of personal data from its system, equipment, and service
Cooperate with the Ministry of Public Security of Vietnam and competent state authorities in protecting personal data, providing information serving the investigation, and handling violations against personal data protection laws
Only receive personal data after concluding an agreement or contract on personal data processing with the personal data controlling party or personal data processing and controlling party
Process personal data in compliance with the agreement or contract concluded with the personal data controlling party
Adequately implement measures to protect personal data
Assume responsibility before the personal data controlling party or personal data processing and controlling party for any damage arising from personal data processing
Implement other responsibilities pursuant to regulations.

CONCLUSION

When there is a change in the party responsible for personal data processing, the organization’s legal obligation is to ensure the continuity of data security and regulatory compliance. Any delay or omission in updating such information may result in serious legal risks, adversely affecting the enterprise’s operations and reputation.

The above sets out the Responsibilities in Cases of Changes to the Party Responsible for Personal Data Processing and the relevant practical situations. Should you have any further questions regarding this matter, please contact VDPC for the most accurate advice and support.

Sincerely!

Zalo: 098.159.5243

The above is a summary and analysis of legal regulations based on the Advisor’s perspective for reference purposes only. This content does not apply to any specific real-world case, and VDPC shall not be held liable for any application by readers based on the aforementioned information without obtaining professional consultation from experts. Readers are kindly requested to contact us for precise advice tailored to your specific case of interest. Sincerely!

See more: