Who is accountable for personal information transferred to a third party for processing?

The primary personal information controller remains fully and legally responsible for all personal information placed under its control or custody. This unwavering and strict accountability persists entirely even when the sensitive information has been transferred to a third party for processing. The controller must carefully utilize contractual or other reasonable legal means to seamlessly provide a comparable level of protection while the data is actively processed by the third party. This foundational and non-transferable principle of data accountability is codified in Section 21 Data Privacy Act. “SEC. 21. Principle of Accountability. – Each personal information controller is responsible for personal information under its control or custody, including information that have been transferred to a third party for processing, whether domestically or internationally… (a) The personal information controller is accountable for complying with the requirements of this Act and shall use contractual or other reasonable means to provide a comparable level of protection…” 21-May-26

About Nicolas and De Vega Law Offices

 Nicolas and De Vega Law Offices is a full-service law firm in the Philippines.  You may visit us at the 16th Flr., Suite 1607 AIC Burgundy Empire Tower, ADB Ave., Ortigas Center, 1605 Pasig City, Metro Manila, Philippines.  You may also call us at +632 84706126, +632 84706130, +632 84016392 or e-mail us at [email protected]. Visit our website https://ndvlaw.com/.