NATIONAL PRIVACY COMMISSION
Implementing Rules and Regulations of Republic Act No. 10173, known as the “Data Privacy Act of 2012”
Pursuant to the mandate of the National Privacy Commission to administer and implement the provisions of the Data Privacy Act of 2012, and to monitor and ensure compliance of the country with international standards set for data protection, the following rules and regulations are hereby promulgated to effectively implement the provisions of the Act:
Rule I. Preliminary Provisions
1. Title
2. Policy
3. Definitions
Rule II. Scope of Application
4. Scope
5. Special Cases
6. Protection afforded to data subjects
7. Protection afforded to journalists and their sources
Rule III. National Privacy Commission
8. Mandate
9. Functions
10. Administrative Issuances
11. Reports and Public Information
12. Confidentiality of Personal Data
13. Organizational Structure
14. Secretariat
15. Effect of Lawful Performance of Duty
16. Magna Carta for Science and Technology Personnel
Rule IV. Data Privacy Principles
17. General Principles
18. Principles of Transparency, Legitimate Purpose and Proportionality
19. Principles in Collection, Processing and Retention
a. Collection must be for a specified and legitimate purpose
b. Personal Data shall be processed fairly and lawfully
c. Processing should ensure data quality
d. Personal data shall not be retained longer than necessary
e. Any authorized further processing shall have adequate safeguards
20. Principles for Data Sharing
Rule V. Lawful Processing of Personal Data
21. Lawful Processing of Personal Information
22. Lawful Processing of Sensitive Personal Information and Privileged Information
23. Extension of Privileged Communication
24. Surveillance of Subjects and Interception of Recording of Communications
Rule VI. Security Measures for Protection of Personal Data
25. Data Privacy and Security
26. Organizational Security
27. Physical Security
28. Technical Security
29. Appropriate Level of Security
Rule VII. Security of Sensitive Personal Information in Government
30. Responsibility of Heads of Agencies
31. Requirements Relating to Access by Agency Personnel to Sensitive Personal Information
32. Implementation of Security Requirements
33. Applicability to Government Contractors
Rule VIII. Rights of Data Subject
34. Rights of the Data Subject
a. Right to be informed
b. Right to object
c. Right to access
d. Right to correct
e. Right to rectification, erasure or blocking
35. Transmissibility of Rights of the Data Subject
36. Right to Data Portability
37. Limitation on Rights
Rule IX. Data Breach Notification.
38. Data Breach Notification
39. Contents of Notification
40. Delay of Notification
41. Breach Report
42. Procedure for Notification
Rule X. Outsourcing and Subcontracting Agreements.
43. Subcontract of Personal Data
44. Agreements for Outsourcing
45. Duty of Personal Information Processor
Rule XI. Registration and Compliance Requirements
46. Enforcement of the Data Privacy Act
47. Registration of Data Processing Systems
48. Notification for Automated Processing Operations
49. Review by the Commission
Rule XII. Rules on Accountability
50. Accountability for Transfer of Personal Information
51. Accountability for Violation of the Act, these Rules and other issuances
Rule XIII. Penalties
52. Unauthorized Processing of Personal Information and Sensitive Personal Information
53. Accessing Personal Information and Sensitive Personal Information Due to Negligence
54. Improper Disposal of Personal Information and Sensitive Personal Information
55. Processing of Personal Information and Sensitive Personal Information for Unauthorized Purposes
56. Unauthorized Access or Intentional Breach
57. Concealment of Security Breaches Involving Sensitive Personal Information
58. Malicious Disclosure
59. Unauthorized Disclosure
60. Combination or Series of Acts
61. Extent of Liability
62. Large-Scale
63. Offense Committed by Public Officer
64. Restitution
65. Fines and Penalties
Rule XIV. Miscellaneous Provisions
66. Appeal
67. Period for Compliance
68. Appropriations Clause
69. Interpretation
70. Separability Clause
71. Repealing Clause
72. Effectivity Clause
RESOURCES