Philippines Data Privacy Act

The Philippines Data Privacy Act of 2012, Republic Act No. 10173, with the National Privacy Commission's Implementing Rules and Regulations of 2016: processing on the principles of transparency, legitimate purpose and proportionality with six lawful criteria and a prohibition on sensitive and privileged information subject to six exceptions; the rights to be informed, to access, to rectification, to erasure or blocking, to damages, to portability and, under the IRR, to object; reasonable and appropriate organizational, physical and technical security measures with four statutory minimums, confidentiality of personnel, and notification of the Commission and data subjects of breaches likely to cause serious harm within 72 hours; accountability for transfers by contractual or other means and a designated accountable individual; security clearances, off-site access limits and encryption for sensitive personal information in government; and, under the IRR, records of processing, data sharing agreements, outsourcing contract terms, registration of processing systems (250 staff or 1,000 sensitive records), notification of solely automated decisions and an annual breach summary. Eight criminal offences with imprisonment and fines, enforced by the National Privacy Commission.