Can a personal information controller subcontract the processing of data?

Yes, a personal information controller has the full legal authority to subcontract the processing of personal information to a reliable third party. However, the original controller permanently retains the strict responsibility for ensuring that proper safeguards are diligently established. These rigorous safeguards must actively ensure the absolute confidentiality of the processed personal information and prevent its malicious use for any unauthorized purposes. The specific rules and severe liabilities surrounding the outsourcing of data processing are clearly defined in Section 14 Data Privacy Act. “SEC. 14. Subcontract of Personal Information. – A personal information controller may subcontract the processing of personal information: Provided, That the personal information controller shall be responsible for ensuring that proper safeguards are in place to ensure the confidentiality of the personal information processed, prevent its use for unauthorized purposes, and generally, comply with the requirements of this Act and other laws for processing of personal information.” 21-May-26

About Nicolas and De Vega Law Offices

 Nicolas and De Vega Law Offices is a full-service law firm in the Philippines.  You may visit us at the 16th Flr., Suite 1607 AIC Burgundy Empire Tower, ADB Ave., Ortigas Center, 1605 Pasig City, Metro Manila, Philippines.  You may also call us at +632 84706126, +632 84706130, +632 84016392 or e-mail us at [email protected]. Visit our website https://ndvlaw.com/.