Data Protection in the Philippines

Registration in the Philippines

Data Protection Officer and Data Processing Systems

NPC Circular No. 2022-04 (effective January 2023) provides for mandatory registration of the Data Protection Officer (“DPO”) and the data processing systems (“DPS”) for PICs or PIPs that:

  • employ two hundred and fifty (250) or more persons;
  • process Sensitive Personal Information of one thousand (1,000) or more individuals; or
  • process data that will likely pose a risk to the rights and freedoms of data subjects.

Registration is done via the NPC’s online platform i.e. the NPC Registration System or NPCRS accessible here.

Entities that are not subject to mandatory registration may opt to voluntarily register their DPO and DPS.

A PIC or PIP who is not subject to mandatory registration and does not undertake voluntary registration shall submit a sworn declaration. The Commission, through an order, may require a PIC or PIP to submit supporting documents related to this submission.

A covered PIC or PIP shall register its newly implemented DPS or inaugural DPO in the NPCRS within twenty (20) days from the commencement of such system or the effective date of such appointment.

In the event that a covered PIC or PIP seeks to make minor amendments to its existing registration information, which include updates to an existing DPS, or a change in DPO, the PIC or PIP shall update the NPCRS within ten (10) days from the system update or effective date of the appointment of the new DPO. Major amendments, however, such as amendments to the name of the entity or the business address must be made within thirty (30) days from the effectiveness of the change.

A Certificate of Registration issued upon completion of the registration process shall be valid for one (1) year from its date of issue. The PIC / PIP must renew its registration within thirty (30) days before the expiration of the one-year validity period.

Beginning on 1 October 2024, all PICs and PIPs are required to pay the corresponding fees to register their DPS and / or renew said registration. The enhanced NPCRS will also facilitate the submission of the Sworn Declaration and Undertaking, a mandatory declaration for persons and entities that claim exemption from the NPC’s registration requirement.

PICs and PIPs are mandated to prominently display their NPC registration at the main entrance of their place of business and on their websites, if the PIC and PIP have an online presence.

Continue reading

  • no results

Previous topic
Back to top