Purpose:

adopt generally accepted international principles and standards for personal data
protection.

safeguard the fundamental human right of every individual to

privacy while ensuring free flow of information for innovation, growth, and
national development.

recognize the vital role of information and communications technology in nation-building

and enforce the State’s inherent obligation to ensure that personal data in information
and communications systems in the government and in the private sector are secured
and protected.

SCOPE OF APPLICATION

The Act and these Rules apply to the processing of personal data
by any natural and juridical person in the government or private sector.

 applies to data found in the philippines

 data is about a filipino citizen
 processing of data is being done in the philippines
 The act, practice or processing of personal data is done or engaged in by
an entity with links to the Philippines

Extraterritorial Application. –
dThis Act applies to an act done or practice engaged in and outside of the Philippines
by an entity if:
(a) The act, practice or processing relates to personal information about a Philippine
citizen or a resident;
(b) The entity has a link with the Philippines, and the entity is processing personal
information in the Philippines or even if the processing is outside the Philippines as long
as it is about Philippine citizens or residents such as, but not limited to, the following:
(1) A contract is entered in the Philippines;
(2) A juridical entity unincorporated in the Philippines but has central management and
control in the country; and
(3) An entity that has a branch, agency, office or subsidiary in the Philippines and the
parent or affiliate of the Philippine entity has access to personal information; and
(c) The entity has other links in the Philippines such as, but not limited to:
(1) The entity carries on business in the Philippines; and
(2) The personal information was collected or held by an entity in the Philippines.
Rule Making. The Commission shall develop, promulgate, review or
amend rules and regulations for the effective implementation of the Act. This
includes:

1. Recommending organizational, physical and technical security measures

for personal data protection, encryption, and access to sensitive personal
information maintained by government agencies, considering the most
appropriate standard recognized by the information and communications
technology industry, as may be necessary;
2. Specifying electronic format and technical standards, modalities and
procedures for data portability, as may be necessary;
3. Issuing guidelines for organizational, physical, and technical security
measures for personal data protection, taking into account the nature of the
personal data to be protected, the risks presented by the processing, the size of
the organization and complexity of its operations, current data privacy best
practices, cost of security implementation, and the most appropriate standard
recognized by the information and communications technology industry, as may
be necessary;
4. Consulting with relevant regulatory agencies in the formulation, review,
amendment, and administration of privacy codes, applying the standards set out
in the Act, with respect to the persons, entities, business activities, and business
sectors that said regulatory bodies are authorized to principally regulate
pursuant to law;
5. Proposing legislation, amendments or modifications to Philippine laws
on privacy or data protection, as may be necessary;
6. Ensuring proper and effective coordination with data privacy regulators
in other countries and private accountability agents;
7. Participating in international and regional initiatives for data privacy
protection.

LAWFUL PROCESSING OF PERSONAL DATA

general rule is that is it allowed

exception: unless it is prohibited by law

for such to be lawful it must comply with any of the following conditions

a. The data subject must have given his or her consent prior to the
collection, or as soon as practicable and reasonable;

b. The processing involves the personal information of a data subject who is

a party to a contractual agreement, in order to fulfill obligations under the
contract or to take steps at the request of the data subject prior to entering the
said agreement;
c. The processing is necessary for compliance with a legal obligation to
which the personal information controller is subject;
d. The processing is necessary to protect vitally important interests of the
data subject, including his or her life and health;
e. The processing of personal information is necessary to respond to
national emergency or to comply with the requirements of public order and
safety, as prescribed by law;
f. The processing of personal information is necessary for the fulfillment of
the constitutional or statutory mandate of a public authority; or
g. The processing is necessary to pursue the legitimate interests of the
personal information controller, or by a third party or parties to whom the data is
disclosed, except where such interests are overridden by fundamental rights and
freedoms of the data subject, which require protection under the Philippine
Constitution.

following guidelines for organizational security

Compliance Officers.
Data Protection Policies.
Records of Processing Activities.
Management of Human Resources.

RIGHTS OF DATA SUBJECTS

Right to be informed.

Right to object and withold consent

When a data subject objects or withholds consent, the personal information

controller shall no longer process the personal data, unless:
The personal data is needed pursuant to a subpoena
The collection and processing are for obvious purposes, including, when
it is necessary for the performance of or in relation to a contract or service
The information is being collected and processed as a result of a legal
obligation.

Right to Access.

Right to rectification.
-data subject has the right to dispute the
inaccuracy or error in the personal data and have the personal information
controller correct it immediately and accordingly
Right to Erasure or Blocking.
-he right to
suspend, withdraw or order the blocking, removal or destruction of his or her
personal data from the personal information controller’s filing system.
however such right may only be exercised upon proof of the following:

(a) The personal data is incomplete, outdated, false, or unlawfully obtained;

(b) The personal data is being used for purpose not authorized by the data
subject;
(c) The personal data is no longer necessary for the purposes for which they
were collected;
(d) The data subject withdraws consent or objects to the processing, and there
is no other legal ground or overriding legitimate interest for the processing;
(e) The personal data concerns private information that is prejudicial to data
subject, unless justified by freedom of speech, of expression, or of the press or
otherwise authorized;
(f) The processing is unlawful;
(g) The personal information controller or personal information processor
violated the rights of the data subject.

Transmissibility of Rights of the Data Subject. The lawful heirs and

assigns of the data subject may invoke the rights of the data subject to which he
or she is an heir or an assignee, at any time after the death of the data subject

DATA BREACH NOTIFICATION

within seventy-two (72) hours upon knowledge of such breach
 notice must be made by the personal information controller to the

 Commission
 Data Subject

notification is required when it involves sensitive personal information
or such information may be used to enable identity fraud
personal information controller or the Commission believes that such unauthorized
acquisition is likely to give rise to a real risk of serious harm to any affected data
subject.

if there is delay or failure to notify

Commission may investigate the circumstances
include on-site examination of systems
and procedures.

 include on-site examination of systems and procedures.

  personal data possibly involved,
 measures taken by the entity to address the breach.
 measures taken to reduce the harm or negative consequences of the breach
 representatives of the personal information controller, including their contact
 details, from whom the data subject can obtain additional information about the
 breach, and any assistance to be provided to the affected data subjects.

Delay of notification may be delayed only to the extent

necessary to determine the scope of the breach

Breach Report
1. personal information controller shall notify the Commission by
submitting a report
2.report shall also include the name of a designated
representative of the personal information controller, and his or her contact
details.
3. All security incidents and personal data breaches shall be documented
through written reports

In the case of personal data breaches

report shall include the

facts surrounding an incident, the effects of such incident, and the remedial
actions taken by the personal information controller.

In other security incidents

not involving personal data, a report containing aggregated data shall constitute
sufficient documentation.

These reports shall be made available when requested

by the Commission. A general summary of the reports shall be submitted to the
Commission annually.

REGISTRATION AND COMPLIANCE REQUIREMENTS

Registration of personal data processing systems operating in the

country that involves accessing or requiring sensitive personal information of at
least one thousand (1,000) individuals, including personal data processing
system of contractors, and their personnel, entering into contracts with
government agencies;

b. Notification of automated processing operations where the processing

becomes the sole basis of making decisions that would significantly affect the
data subject;
c. Annual report of the summary of documented security incidents and
personal data breaches;
d. Compliance with other requirements that may be provided in other
issuances of the Commission.

The personal information controller or personal information processor that employs

fewer than two hundred fifty (250) persons shall not be required to register unless
The processing it carries out is likely to pose a risk to the rights and freedoms of data
subjects, the processing is not occasional, or the processing includes sensitive
personal information of at least one thousand (1,000) individuals.

PENALTIES

A penalty of imprisonment ranging from one (1) year to three (3) years
and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not
more than Two million pesos (Php2,000,000.00) shall be imposed on persons who
process personal information without the consent of the data subject, or without
being authorized under the Act or any existing law.

penalty of imprisonment ranging from three (3) years to six (6) years
and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not
more than Four million pesos (Php4,000,000.00)
imposed on persons who process sensitive personal information without the consent of
the data subject, or without being authorized under the Act or any existing law.

Malicious disclosure
concealment of security breach
unauthorized disclosure
Combination or Series of Acts

If the offender is an alien, he or she shall, in addition to the penalties herein

prescribed, be deported without further proceedings after serving the penalties
prescribed.

offender is a public official or employee

suffer perpetual or temporary
absolute disqualification from office, as the case may be

Interpretation. Any doubt in the interpretation of any provision of this

Act shall be liberally interpreted in a manner that would uphold the rights and
interests of the individual about whom personal data is processed.