IDC Names Securiti a Worldwide Leader in Data Privacy
ViewListen to the content
Influenced by the European Union Data Protection Directive (95/46/EC), the Philippines passed the Data Privacy Act 2012 Republic Act. No, 10173 (the "DPA") in 2012. The purpose of the DPA is to provide rights to individuals for their enhanced control over their personal information while ensuring a free flow of information to promote innovation and growth in the Philippines. The National Privacy Commission (the “NPC''), which was established under the DPA in 2016, issued Implementing Rules and Regulations of the Republic Act. No, 10173 (the “IRRs or IRR” ). The IRRs provide comprehensive details related to lawful basis of processing, data subjects’ rights, organizations’ obligations while processing the personal information of individuals, and layout penalties for organizations in case of non-compliance with the DPA and its IRRs. Under the DPA, the purpose of the collection of personal information should be ‘legitimate’, and processing must be both ‘lawful’ and ‘fair’.
The DPA is applicable to ‘the processing of all types of personal information and to any natural and juridical person involved in personal information processing’. It covers the processing of personal information in both public and private sectors with the following exemptions:
The DPA applies to any entity whether in the Philippines or outside of the Philippines if:
It includes any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information or when put together with other information would directly and certainly identify an individual.
It refers to a person or organization who controls the collection, holding, processing or use of personal information, including a person or organization who instructs another person or organization to collect, hold, process, use, transfer or disclose personal information on his or her behalf.
It includes personal information about an individual’s race, ethnic origin, marital status, age, colour, and religious, philosophical or political affiliations, individual’s health, education, the genetic or sexual life of a person, or personal information related to any proceeding for any offence committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings; tax returns, social security number and any other government-sanctioned classified information about a person.
Personal information processor refers to any natural or juridical person to whom a PIC may outsource the processing of personal data pertaining to a data subject.
Information: Data subjects have the right to be informed when personal information related to them is being processed by the PIC (the data controller) or PIP (the data processor).
Erasure: Data subjects can request the PIC to delete, remove, or destruct their personal data from their personal information filling system.
Object: Data subjects have the right to object to their personal information being processed by the PIC, including processing for direct marketing, automated processing, or processing for profiling.
Rectification: Data subjects have the right to request the rectification of their incomplete and/or inaccurate personal information held by the PIC.
Access: Data subjects have the right to access their personal information held by the personal information controller.
Portability: Data subjects have the right to request a copy of their personal information in an electronic or structured format from the personal informational controller.
Indemnification: Data subjects have the right to be indemnified for damages sustained due to inaccurate, incomplete, false, unlawfully obtained, or unauthorized use of personal information by the PIC.
Complain: Data subjects have the right to file a complaint against the personal information controller before the NPC.
Non-compliance with the DPA, its IRRs and any issuances of the NPC can lead to the administrative, civil and criminal liabilities. It can result in imprisonment of six months to seven years, with fines ranging from PHP 100,000 to PHP 5 million that depends on which type of personal information is involved. The DPA has provided detailed penalties for unauthorized processing of personal information and sensitive personal information, improper disposal of personal information, processing for unauthorized purposes, intentional breach, concealment of a security breach, malicious disclosure, and other offences pursuant to the DPA and its IRRs.
The DPA also prescribes that if the offender is a corporation, partnership, or any other juridical person, the penalty shall be imposed upon the responsible officers who participated in, or by their gross negligence, allowed the commission of the crime.
The multi-disciplinary practice to grow trust-equity of your brand and comply with privacy regulations.
Get the Book“By leveraging the PrivacyOps constructs from this book across our organization we were able to not only save time and money but also mitigate the risks associated with manual methods of privacy management.”
- Marty Collins, Chief Privacy and Legal Officer, QuinStreet, Inc
Given the complex obligations for the organisations to manage the disclosure, access, rectification and other requests of the data subjects, ensuring the effective security measures and other compliance requirements, complying with the DPA and its IRRs can be very labor-intensive and costly. Securiti automation helps you with swift and efficient compliance with the DPA and its IRRs as well as other data privacy regulation.
Securiti is the leader in AI-powered PrivacyOps and data governance. Similar to DevOps for software, PrivacyOps reimagines how to implement privacy management throughout an organisation efficiently.
Securiti is a recognized innovator in this market, having been awarded "Most Innovative Startup" at RSA Conference 2020, and Leader in the Forrester Wave: Privacy Management Software. Securiti PrivacyOps solution uniquely combines real-time data intelligence harnessing bot and AI technology with full workflow automation of all the major privacy compliance functions.
DPA stands for the Data Privacy Act of 2012, a law in the Philippines that governs the protection of personal data and the privacy rights of individuals.
The Data Privacy Act of the Philippines specifies penalties for violations, including fines and imprisonment, depending on the nature and severity of the breach.
PDPA stands for the Personal Data Protection Act. It's a term used in various countries to refer to laws that regulate the processing and protection of personal data.
Data Protection Act (DPA) regulations are laws that establish rules and principles for the collection, use, processing, and protection of personal data, intending to safeguard individuals' privacy rights.
The Data Protection Act establishes guidelines for how organizations handle personal data, including how it's collected, processed, stored, and shared. It grants individuals certain rights and sets out obligations for data controllers and processors.
Anas Baig is a Product Marketing Manager with a proven track record in the cybersecurity industry. He has been a prominent contributor to numerous esteemed publications, including Infosecurity Magazine, CSO Online, Tripwire, Security Affairs, Network Computing, Security Boulevard, and several other renowned cybersecurity blogs.His in-depth knowledge and extensive experience in the industry make him a trusted source for cutting-edge insights and information in the ever-evolving world of cybersecurity.
Get all the latest information, law updates and more delivered to your inbox
September 21, 2023
Introduction The emergence of Generative AI has ushered in a new era of innovation in the ever-evolving technological landscape that pushes the boundaries of...
September 15, 2023
The wealth of data available to organizations globally has brought tremendous improvements in their ability to target and cater to their customers' needs. Organizations...
September 13, 2023
Kuwait didn’t have any data protection law until the Communication and Information Technology Regulatory Authority (CITRA) introduced the Data Privacy Protection Regulation (DPPR). The...
At Securiti, our mission is to enable enterprises to safely harness the incredible power of data and the cloud by controlling the complex security, privacy and compliance risks.
Copyright © 2023 Securiti · Sitemap · XML Sitemap
info@securiti.ai
Securiti, Inc.
300 Santana Row
Suite 450
San Jose, CA 95128