Responsibilities of the Transport Cooperative in the Event of a Change of the Personal Data Processing Party

Transport cooperatives frequently collect and process a large amount of personal data from customers (such as travel history, contact information, etc.) and drivers. Due to changes in organizational structure or key personnel, changes in the party responsible for processing personal data often occur.

In this article, VDPC will analyze the legal obligations of transport cooperatives when there is a change in the personal data processing party, in accordance with the applicable laws and regulations.

Legal basis: Article 2, 37 Law on Personal Data Protection 2025

1.What Type of Personal Data Do Transport Cooperatives Process?

The type of personal data (PD) processed by a transport cooperative (hereinafter referred to as the “Cooperative”) is primarily basic personal data(such as customers’ names, ages, addresses, phone numbers, etc)

(Basic personal data refers to personal data reflecting common identifying and biographical information, frequently used in transactions and social relations, as listed in the government-issued catalog.)

Under the regulations on personal data processing activities, the Cooperative may carry out processing activities such as collecting, amending, or deleting personal data, as well as activities within the scope of personal data control, such as determining the purposes of data collection and processing.

2. Role of the Transport Cooperative When Directly Processing Personal Data

(1) In this case, if the Cooperative has a dedicated department responsible for processing personal data (e.g., IT department, technical department, etc.), the Cooperative becomes a Personal Data Controller and Processor—i.e.,(an agency, organization, or individual that determines the purposes and means of personal data processing and directly processes the data)

(2) As a Personal Data Controller and Processing party, the responsibilities of the Cooperative will include:

Specify the responsibilities, rights, and obligations to be complied with of concerned parties in agreements or contracts concerning personal data processing
Decide on the purposes and means of personal data processing in documents and agreements with personal data subject matters, ensuring compliance with the principles and contents
Adopt appropriate managerial and technical measures to protect personal data according to the law and review and update such measures if necessary
Issue notices of violations against personal data protection regulations
Select an appropriate personal data processing party to process personal data
Ensure the rights of personal data subject matters
Assume responsibility before personal data subject matters for any damage arising from personal data processing

In addition, there are other responsibilities such as:

Prevent unauthorized collection of personal data from its system, equipment, and service
Cooperate with the Ministry of Public Security of Vietnam and competent state authorities in protecting personal data, providing information serving the investigation, and handling violations against personal data protection laws
Only receive personal data after concluding an agreement or contract on personal data processing with the personal data controlling party or personal data processing and controlling party
Process personal data in compliance with the agreement or contract concluded with the personal data controlling party
Implementing all personal data protection measures as required by law
Assume responsibility before Personal data controlling party, Personal data processing and controlling party for any damage arising from personal data processing
Implement other responsibilities pursuant to regulations.

3. Role of the Transport Cooperative When Processing Personal Data Through a Third Party

(1) In this case, if the Cooperative engages a third party (such as an IT company, technical services company, software provider, or data processing company) to process its personal data, the Cooperative becomes a Personal Data Controller( an agency, organization, or individual that determines the purposes and means of personal data processing)

(2) In this capacity as a Personal Data Controller, the responsibilities of the Cooperative will include:

Specify the responsibilities, rights, and obligations to be complied with of concerned parties in agreements or contracts concerning personal data processing
Decide on the purposes and means of personal data processing in documents and agreements with personal data subject matters, ensuring compliance with the principles and contents
Adopt appropriate managerial and technical measures to protect personal data and review and update such measures if necessary
Issue notices of violations against personal data protection regulations
Select an appropriate personal data processing party to process personal data
Ensure the rights of personal data subject matters
Assume responsibility before personal data subject matters for any damage arising from personal data processing
Prevent unauthorized collection of personal data from its system, equipment, and service
Cooperate with the Ministry of Public Security of Vietnam and competent state authorities in protecting personal data, providing information serving the investigation, and handling violations against personal data protection laws
Implement other responsibilities pursuant to regulations.

CONCLUSION

Transport cooperatives bear a very high legal responsibility in safeguarding sensitive personal data. Ensuring the security of medical information is a critical factor, requiring the Cooperative to regularly review its security systems and train personnel in accordance with strict legal standards.

The above outlines the Responsibilities of the Transport Cooperative in the Event of a Change of the Personal Data Processing Party. If you have any questions regarding this matter, please contact VDPC for accurate legal advice and support.

Sincerely !

Zalo: 098.159.5243

The above is a summary and analysis of legal regulations based on the Advisor’s perspective for reference purposes only. This content does not apply to any specific real-world case, and VDPC shall not be held liable for any application by readers based on the aforementioned information without obtaining professional consultation from experts. Readers are kindly requested to contact us for precise advice tailored to your specific case of interest. Sincerely!

See more: