For corporate offenders, the responsible officers are heavily penalized, and the court may legally suspend or completely revoke the corporation’s functional rights.
A personal information controller is an entity that controls the collection or processing of personal data, excluding personal household use.
Who is considered a personal information controller? Read More »
Sensitive personal information includes deeply personal data about an individual’s race, health, education, legal proceedings, and specific government-issued identification numbers.
What types of data fall under sensitive personal information? Read More »
The Act specifically does not apply to information relating to the position, title, or functions of current or former government employees.
Does the Data Privacy Act apply to government employees and their official functions? Read More »
The Act applies extraterritorially if the processing actively relates to Philippine citizens or residents, or if the entity has Philippine links.
Does the Data Privacy Act apply to entities processing data outside the Philippines? Read More »
The Privacy Commissioner must be at least 35, of excellent moral character, and a recognized expert in IT and data privacy.
What are the qualifications to be appointed as the Privacy Commissioner? Read More »
Processing sensitive personal information is prohibited unless strict exceptions like specific consent, legal mandates, or health and life protection apply.
Is the processing of sensitive personal information absolutely prohibited? Read More »
Controllers can legally subcontract data processing but remain entirely responsible for ensuring proper safeguards and strict confidentiality are maintained.
Can a personal information controller subcontract the processing of data? Read More »
Data subjects have the right to legally access the contents, specific sources, recipients, processing methods, and disclosure reasons of their data.
What is the right of the data subject regarding access to their personal information? Read More »
Data subjects can quickly dispute inaccurate personal data, compelling the controller to correct it immediately and officially inform third-party recipients.
Does a data subject have the right to correct inaccurate personal information? Read More »
