Controllers with under 250 employees are exempt from registration unless processing poses risks, is non-occasional, or includes 1,000 sensitive records.
Decisions producing legal effects concerning a data subject cannot be based solely on automated processing without the individual’s consent.
Can a decision with legal effects be made solely on the basis of automated processing? Read More »
Maliciously disclosing unwarranted or false personal information is penalized with 1.5 to 5 years imprisonment and heavily fined up to Php1,000,000.00.
What is the formal penalty for maliciously disclosing false personal information? Read More »
Public officers committing offenses face an additional accessory penalty of absolute disqualification from public office for double the criminal term.
Controllers must notify the Commission and affected subjects within 72 hours upon discovering or reasonably believing a data breach occurred.
Notifications must detail the breach’s nature, affected data, mitigation measures, contact representatives, and provided assistance to the data subjects.
What specific information must a complete data breach notification formally contain? Read More »
Data processing systems refer to the structure and procedure for collecting and processing personal data in an information or filing system.
What does “data processing systems” mean under the Implementing Rules and Regulations? Read More »
Data sharing involves the disclosure or transfer of personal data to a third party or another personal information controller.
How is “data sharing” defined in the rules? Read More »
The Act does not apply to specific information regarding the position, title, and functions of a current or former government employee.
Transparency requires that data subjects are fully aware of the nature, purpose, risks, and extent of their personal data processing.
How is the principle of transparency applied in the processing of personal data? Read More »
