A breach report must contain the required notification contents along with the specific name and contact details of the controller’s designated representative.
What details must be included in a breach report submitted to the Commission? Read More »
All security incidents, including those not strictly requiring formal notification, must be rigorously documented internally through comprehensive written or aggregated reports.
Are organizations required to strictly document all security incidents, even minor ones? Read More »
Intentionally breaking into systems containing personal data is severely punished by 1 to 3 years imprisonment and hefty criminal fines.
Intentionally concealing a known security breach brings a harsh penalty of 1.5 to 5 years imprisonment and severe financial fines.
How is the concealment of a security breach legally penalized? Read More »
Entities should utilize the encryption of personal data during active storage and transit, alongside robust authentication processes, to limit unauthorized access.
Is encryption a required technical security measure under the rules? Read More »
Improperly discarding personal information in public areas or trash containers brings 6 months to 2 years imprisonment and substantial criminal fines.
What is the exact penalty for improperly disposing of regular personal information? Read More »
Improperly disposing of sensitive personal data invites a harsher penalty of 1 to 3 years imprisonment and fines up to Php1,000,000.00.
How does the law penalize the improper disposal of sensitive personal information? Read More »
The Commission can legally award financial indemnity and restitution to aggrieved data subjects based on the New Civil Code provisions.
Can a data subject get financial restitution for a violation of their rights? Read More »
Entities originally had exactly one year from the effectivity of the rules to completely register their data processing systems with the Commission.
The majority of the Secretariat must have served at least five years in a government agency involved in processing personal data.
What are the specific qualifications for members of the Commission’s Secretariat? Read More »
