Controllers can invoke privileged communication over certain processed data, rendering any evidence gathered from such privileged information legally inadmissible.
Lawful surveillance, interception, or recording of communications must strictly comply with the data privacy principles of transparency, proportionality, and legitimate purpose.
Do wiretapping and surveillance activities need to comply with the Data Privacy Act? Read More »
Entities must designate a Data Protection Officer or compliance officer completely accountable for ensuring strict adherence to privacy and security laws.
Who is responsible for ensuring an organization’s compliance with data privacy laws? Read More »
Entities must carefully select, supervise, and routinely train their employees and agents who have active access to sensitive personal data.
Entities should utilize the encryption of personal data during active storage and transit, alongside robust authentication processes, to limit unauthorized access.
Is encryption a required technical security measure under the rules? Read More »
Notifications must detail the breach’s nature, affected data, mitigation measures, contact representatives, and provided assistance to the data subjects.
What specific information must a complete data breach notification formally contain? Read More »
Subcontracting agreements must strictly stipulate that a binding obligation of confidentiality is imposed on all persons authorized to process data.
Controllers with under 250 employees are exempt from registration unless processing poses risks, is non-occasional, or includes 1,000 sensitive records.
Decisions producing legal effects concerning a data subject cannot be based solely on automated processing without the individual’s consent.
Can a decision with legal effects be made solely on the basis of automated processing? Read More »
Maliciously disclosing unwarranted or false personal information is penalized with 1.5 to 5 years imprisonment and heavily fined up to Php1,000,000.00.
What is the formal penalty for maliciously disclosing false personal information? Read More »
