[Table of Contents] [Glossary]

Rule IV. Data Privacy Principles 

Section 17. General Data Privacy Principles. The processing of personal data shall be allowed, subject to compliance with the requirements of the Act and other laws allowing disclosure of information to the public, and adherence to the principles of transparency, legitimate purpose, and proportionality. 

[Table of Contents] [Glossary]

Rule V. Lawful Processing of Personal Data 

Section 21. Criteria for Lawful Processing of Personal Information. Processing of personal information is allowed, unless prohibited by law. For processing to be lawful, any of the following conditions must be complied with: 

[Table of Contents] [Glossary]

Rule VI. Security Measures for the Protection of Personal Data 

Section 25. Data Privacy and Security. Personal information controllers and personal information processors shall implement reasonable and appropriate organizational, physical, and technical security measures for the protection of personal data. 

[Table of Contents] [Glossary]

Rule VII. Security of Sensitive Personal Information in Government 

Section 30. Responsibility of Heads of Agencies. All sensitive personal information maintained by the government, its agencies, and instrumentalities shall be secured, as far as practicable, with the use of the most appropriate standard recognized by the information and communications technology industry, subject to these Rules and other issuances of the Commission. The head of each government agency or instrumentality shall be responsible for complying with the security requirements mentioned herein. The Commission shall monitor government agency compliance and may recommend the necessary action in order to satisfy the minimum standards. 

[Table of Contents] [Glossary]

Rule VIII. Rights of Data Subjects

Section 34. Rights of the Data Subject. The data subject is entitled to the following rights:

[Table of Contents] [Glossary]

Rule IX. Data Breach Notification

Section 38. Data Breach Notification. 

a. The Commission and affected data subjects shall be notified by the personal information controller within seventy-two (72) hours upon knowledge of, or when there is reasonable belief by the personal information controller or personal information processor that, a personal data breach requiring notification has occurred. 

[Table of Contents] [Glossary]

Rule X. Outsourcing and Subcontracting Agreements. 

Section 43. Subcontract of Personal Data. A personal information controller may subcontract or outsource the processing of personal data: Provided, that the personal information controller shall use contractual or other reasonable means to ensure that proper safeguards are in place, to ensure the confidentiality, integrity and availability of the personal data processed, prevent its use for unauthorized purposes, and generally, comply with the requirements of the Act, these Rules, other applicable laws for processing of personal data, and other issuances of the Commission. 

[Table of Contents] [Glossary]

Rule XI. Registration and Compliance Requirements 

Section 46. Enforcement of the Data Privacy Act. Pursuant to the mandate of the Commission to administer and implement the Act, and to ensure the compliance of personal information controllers with its obligations under the law, the Commission requires the following: 

[Table of Contents] [Glossary]

Rule XII. Rules on Accountability 

Section 50. Accountability for Transfer of Personal Data. A personal information controller shall be responsible for any personal data under its control or custody, including information that have been outsourced or transferred to a personal information processor or a third party for processing, whether domestically or internationally, subject to cross-border arrangement and cooperation. 

[Table of Contents] [Glossary]

Rule XIII. Penalties 

Section 52. Unauthorized Processing of Personal Information and Sensitive Personal Information.