Philippines Data Privacy Act: Are you Ready for Phase II?




Controllers and processors who have completed Phase I registration with the National Privacy Commission (NPC) will now have to gear up for Phase II.

Phase II involves providing the NPC with the following information:
    name and contact details of the organization, head of the organization, and the Data Privacy Officer;
  1. purpose or mandate of the organization;
  2. identification of all existing policies relating to data governance, data privacy, and information security, and other documents that provide a general description of privacy and security measures for data protection;
  3. attestation regarding certifications attained by the organization, including its relevant personnel, that are related topersonal data processing;
  4. brief description of the registrant’s data processing system or systems that should include:
    1. name of the system;
    2. purpose or purposes of the processing;
    3. whether processing is being done as a personal information controller (PIC), personal information processor (PIP), or both;
    4. whether the system is outsourced or subcontracted, and if so, the name and contact details of the PIP;
    5. description of the category or categories of data subjects, and their personal data or categories thereof;
    6. recipients or categories of recipients to whom the personal data may be disclosed; and
    7. whether personal data is transferred outside the Philippines
  5. notification regarding any automated decision-making operation.
This information is supposed to be provided to the NPC online through the Commission’s platform. After submission, the NPC is supposed to confirm to the registrant via email the successful completion of the registration process. The NPC will also issue a certificate of registration. Deadline for Phase II registration is March 8, 2018.

The certificate of registration requires an annual renewal, and the application must be filed two months prior to, but not later than, March 8 of every year. Thus, assuming a successful Phase II registration in 2018, the next renewal will need to be applied for no later than March 8, 2019.

About SyCip Salazar Hernandez & Gatmaitan



Founded in 1945, SyCip Salazar Hernandez & Gatmaitan is one of the most established and largest law firms in the Philippines. Although its work centers on business activity, the firm has offered a broad and integrated range of legal services that cover such areas as family relations, constitutional issues, and other matters of law unrelated to commerce.

Originally published on SyCipLaw website