Are all personal information controllers explicitly required to register their data processing systems?

No, a personal information controller that regularly employs fewer than two hundred fifty persons is generally not required to officially register its operational systems. However, a strict legal exception exists if the particular processing it securely carries out is likely to heavily pose a substantial risk to the fundamental rights and freedoms of data subjects. Registration is also fully required if the operational processing is not merely occasional or if it significantly includes the sensitive personal information of at least one thousand individuals. These explicit registration parameters are defined in Section 47 IRR. “Section 47. Registration of Personal Data Processing Systems. The personal information controller or personal information processor that employs fewer than two hundred fifty (250) persons shall not be required to register unless the processing it carries out is likely to pose a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes sensitive personal information of at least one thousand (1,000) individuals.” 20-May-26

About Nicolas and De Vega Law Offices

 Nicolas and De Vega Law Offices is a full-service law firm in the Philippines.  You may visit us at the 16th Flr., Suite 1607 AIC Burgundy Empire Tower, ADB Ave., Ortigas Center, 1605 Pasig City, Metro Manila, Philippines.  You may also call us at +632 84706126, +632 84706130, +632 84016392 or e-mail us at [email protected]. Visit our website https://ndvlaw.com/.