Philippines Data Privacy Act

Philippines DPA 2012 - NPC registration, DPO, breach notification, data subject rights.


Short name	PH DPA
Region	Asia-Pacific
Country or scope	Philippines
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers PH DPA

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 9 controls from Safeguard's control catalog for PH DPA.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for PH DPA and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`PH-DPA-20` Security of Personal Information	Controllers must implement reasonable and appropriate organizational, physical, and technical measures to protect personal information against unlawful destruction, alteration, and disclosure, which requires integrity assurance over the software performing the processing (RA 10173, s.20)	Scan
`PH-DPA-20C` Safeguards Against Software Vulnerabilities	The required security measures include protecting the computer network against accidental, unlawful or unauthorized use and interference; knowing the exact versions of deployed components is a precondition to guarding them against known vulnerabilities (RA 10173, s.20(c))	Scan
`PH-DPA-21` Accountability for Transfers to Third Parties	A controller remains accountable for personal information transferred to third parties for processing and must use contractual or other reasonable means to ensure comparable protection, which requires knowing who supplies each processing component (RA 10173, s.21)	Scan
`PH-DPA-11` Transparency of Processing	Processing must adhere to the principles of transparency, legitimate purpose, and proportionality; a machine-readable, standard-format account of the processing software supports demonstrable transparency (RA 10173, s.11)	Scan
`PH-DPA-20F` Breach Notification Readiness	The NPC and affected data subjects must be notified when sensitive personal information that may enable identity fraud has been acquired by an unauthorized person; timely scoping of such a breach requires individually identifiable system components (RA 10173, s.20(f))	Scan
`PH-DPA-INV` Records of Processing Systems	Compliance with the NPC's registration and accountability regime presupposes a documented inventory of the data processing systems in use, including the software components composing them (RA 10173 and NPC implementing rules, registration of data processing systems)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`PH-DPA-S12`	Lawful Basis for Processing
`PH-DPA-S16`	Right to Be Informed
`PH-DPA-S17-18`	Right to Access and Rectification
`PH-DPA-S19`	Right to Erasure and Blocking
`PH-DPA-S20`	Security Measures for Personal Information
`PH-DPA-S21`	Subcontractor and Third-Party Processor Security
`PH-DPA-S22-24`	Data Protection Officer Designation
`PH-DPA-S25-26`	NPC Registration
`PH-DPA-IRR`	Implementing Rules Compliance

Policy templates

Written for PH DPA:

Data Protection Officer Charter (Philippines RA 10173)
Personal Information Security Policy (Philippines RA 10173 Section 20)
Data Subject Rights Procedure (Philippines RA 10173 Sections 16-19)

And 22 from the standard set, adapted to PH DPA.