The majority of the Secretariat must have served at least five years in a government agency involved in processing personal data.
What are the specific qualifications for members of the Commission’s Secretariat? Read More »
Notifications must detail the breach’s nature, affected data, mitigation measures, contact representatives, and provided assistance to the data subjects.
What specific information must a complete data breach notification formally contain? Read More »
Subcontracting agreements must strictly stipulate that a binding obligation of confidentiality is imposed on all persons authorized to process data.
Controllers with under 250 employees are exempt from registration unless processing poses risks, is non-occasional, or includes 1,000 sensitive records.
Decisions producing legal effects concerning a data subject cannot be based solely on automated processing without the individual’s consent.
Can a decision with legal effects be made solely on the basis of automated processing? Read More »
Maliciously disclosing unwarranted or false personal information is penalized with 1.5 to 5 years imprisonment and heavily fined up to Php1,000,000.00.
What is the formal penalty for maliciously disclosing false personal information? Read More »
Public officers committing offenses face an additional accessory penalty of absolute disqualification from public office for double the criminal term.
Government agency heads must limit approved off-site access to no more than 1,000 sensitive personal records at a single time.
Data subjects have the absolute right to actively object to their personal data being processed for automated processing or profiling.
Controllers must notify the Commission and affected subjects within 72 hours upon discovering or reasonably believing a data breach occurred.
