Responsibilities of the taxi company when changing the party responsible for processing personal data

The taxi company usually collects and processes a substantial amount of personal data of its customers (such as travel history, contact information, etc.) and drivers. Due to changes in organizational structure or key personnel, changes in the party responsible for processing personal data occur on a regular basis.

In this article, VDPC will analyze the legal obligations of the Taxi Company when changing the party responsible for processing personal data, in accordance with applicable laws and regulations.

Legal basis: Article 2, 37 Law Personal data protection 2025

1. What types of personal data does the Taxi Company process?

The types of personal data (PD) processed by the Taxi Company mainly fall within the scope of basic personal data (for example: customers’ name, age, address, phone number, etc.).

(Basic personal data refers to personal information reflecting general personal and background characteristics, commonly used in transactions and social relations, as listed in the catalog promulgated by the Government.)

According to regulations on personal data processing, the Taxi Company may perform activities related to the processing of personal data, such as collecting, amending, or deleting personal data, as well as activities within the scope of personal data controlling, such as determining the purpose of collecting and processing personal data.

2. The Role of the Taxi Company When Directly Processing Personal Data

(1) In this case, if the Taxi Company has a dedicated internal department responsible for processing personal data (for example, the IT Department, technical department, etc.), the Taxi Company shall be considered both a personal data processing and controlling party ( an agency, organization, or individual that determines the purpose, means, and directly processes personal data).

(2) In this situation, the Taxi Company may be identified as the personal data processing and controlling party, and its responsibilities shall include:

Specify the responsibilities, rights, and obligations of the concerned parties to be complied with in agreements or contracts regarding personal data processing, pursuant to regulations
Decide on the purposes and means of personal data processing in documents and agreements with personal data subject matters, ensuring compliance with the principles and contents
Adopt appropriate managerial and technical measures to protect personal data according to the law and review and update such measures if necessary
Issue notices of violations against personal data protection regulations
Select an appropriate personal data processing party to process personal data
Ensure the rights of personal data subject matters
Assume responsibility before personal data subject matters for any damage arising from personal data processing

Additionally, there are other responsibilities, such as:

Prevent unauthorized collection of personal data from its system, equipment, and service
Cooperate with the Ministry of Public Security of Vietnam and competent state authorities in protecting personal data, providing information serving the investigation, and handling violations against personal data protection laws
Only receive personal data after concluding an agreement or contract on personal data processing with the personal data controlling party or personal data processing and controlling party
Process personal data in compliance with the agreement or contract concluded with the personal data controlling party
Adequately implement measures to protect personal data pursuant to regulations
Assume responsibility before the personal data controlling party or personal data processing and controlling party for any damage arising from personal data processing
Implement other responsibilities pursuant to regulations.

3. The Role of the Taxi Company When Processing Personal Data Through a Third Party

(1)In this case, if the Taxi Company engages a third party (such as an IT company, technical or software service provider, data processing company, etc.) to process its personal data, the Taxi Company shall be considered the personal data controlling party (an agency, organization, or individual that determines the purposes and means of personal data processing).

(2) In this situation, the Taxi Company may be regarded in the capacity of a personal data controlling party, and its responsibilities shall include:

Specify the responsibilities, rights, and obligations to be complied with of concerned parties in agreements or contracts concerning personal data processing
Decide on the purposes and means of personal data processing in documents and agreements with personal data subject matters, ensuring compliance with the principles and contents
Adopt appropriate managerial and technical measures to protect personal data and review and update such measures if necessary
Issue notices of violations against personal data protection regulations
Select an appropriate personal data processing party to process personal data
Ensure the rights of personal data subject matters
Assume responsibility before personal data subject matters for any damage arising from personal data processing
Prevent unauthorized collection of personal data from its system, equipment, and service
Cooperate with the Ministry of Public Security of Vietnam and competent state authorities in protecting personal data, providing information serving the investigation, and handling violations against personal data protection laws
Implement other responsibilities pursuant to regulations.

CONCLUSION

The taxi company bears a high legal responsibilities for safeguarding sensitive personal data. Ensuring the security of medical information is a critical factor, requiring the company to regularly review its security systems and train personnel in accordance with strict legal standards.

The above outlines the Responsibilities of the taxi company when changing the party responsible for processing personal data. If you have any questions regarding this matter, please contact VDPC for the most accurate consultation and support.

Sincerely !

Zalo: 098.159.5243

The above is a summary and analysis of legal regulations based on the Advisor’s perspective for reference purposes only. This content does not apply to any specific real-world case, and VDPC shall not be held liable for any application by readers based on the aforementioned information without obtaining professional consultation from experts. Readers are kindly requested to contact us for precise advice tailored to your specific case of interest. Sincerely!

See more: