What is Philippines DPA

Definition of Key Terms:

Organizations’ Obligations under the DPA

• Organizations that process personal information under the DPA are required to adhere to the principles of transparency, legitimate purpose and proportionality. The PIC is obliged to comply with the DPA, its IRRs and any guidelines issued by the NPC.
• Organisations are required to collect the consent of data subjects prior to the processing of personal information.
• The PIC must implement reasonable and appropriate organizational, physical and technical measures for the protection of personal information against any accidental, natural or unlawful destruction, alteration and disclosure, as well as against any other unlawful processing.
• The PIC is also required to ensure that third parties processing personal information on their behalf should also implement security measures.
• The PIC is responsible for personal information under its control or custody, including information that has been transferred to a third party for processing, whether domestically or internationally, subject to cross-border arrangement and cooperation.
• The DPA necessitates that organisations should have a personal information privacy program in place to implement and review procedures for the collection of personal data and consent, fulfilling data subject requests, data access management, and data retention policies.

Non Compliance Risks and Penalties:

Non-compliance with the DPA, its IRRs and any issuances of the NPC can lead to the administrative, civil and criminal liabilities. It can result in imprisonment of six months to seven years, with fines ranging from PHP 100,000 to PHP 5 million that depends on which type of personal information is involved.  The DPA has provided detailed penalties for unauthorized processing of personal information and sensitive personal information, improper disposal of personal information, processing for unauthorized purposes, intentional breach, concealment of a security breach, malicious disclosure, and other offences pursuant to the DPA and its IRRs.

The DPA also prescribes that if the offender is a corporation, partnership, or any other juridical person, the penalty shall be imposed upon the responsible officers who participated in, or by their gross negligence, allowed the commission of the crime.

How Securiti Can help?

Given the complex obligations for the organisations to manage the disclosure, access, rectification and other requests of the data subjects, ensuring the effective security measures and other compliance requirements, complying with the DPA and its IRRs can be very labor-intensive and costly. Securiti automation helps you with swift and efficient compliance with the DPA and its IRRs as well as other data privacy regulation.

Securiti is the leader in AI-powered PrivacyOps and data governance. Similar to DevOps for software, PrivacyOps reimagines how to implement privacy management throughout an organisation efficiently.

Securiti is a recognized innovator in this market, having been awarded "Most Innovative Startup" at RSA Conference 2020, and Leader in the Forrester Wave: Privacy Management Software. Securiti PrivacyOps solution uniquely combines real-time data intelligence harnessing bot and AI technology with full workflow automation of all the major privacy compliance functions.