NPC Issuance Wiki

NPC Advisory Opinion No. 2017-016 — Data Sharing Agreement vs. Service Level Agreement

Issued Advisory Opinion

Text

17 March 2017

Re: DATA SHARING AGREEMENT vs. SERVICE LEVEL AGREEMENT

Dear [Redacted],

This pertains to your query received by the National Privacy Commission (NPC) on 14 February 2017, via email, inquiring whether or not a data sharing agreement (DSA)—a concept first introduced in the Implementing Rules and Regulations (IRR) of Republic Act No. 10173, also known as the Data Privacy Act of 2012 (DPA)1—may form part of a service level agreement (SLA), or should the same be reflected in a separate agreement or document.

Data sharing is the disclosure or transfer to a third party of personal data under the custody of a personal information controller (PIC) or personal information processor (PIP).2 Where such disclosure is made by a PIP, it must be upon the instructions of the PIC concerned. Unless otherwise provided by law, the terms of a data sharing arrangement are laid out in a DSA. In the IRR, it is stated that a DSA should “establish adequate safeguards for data privacy and security, and uphold rights of data subjects”.3 Meanwhile, in NPC Circular No. 16-02, which has for its subject, “Data Sharing Agreements involving Government Agencies”, a DSA is defined as “a contract, joint issuance, or any similar document that contains the terms and conditions of data sharing arrangement between two or more parties: Provided, that only personal information controllers shall be made parties to a data sharing agreement.”4

A Service Level Agreement (SLA), on the other hand, is a document that “sets the expectations between the consumer and provider. It helps define the relationship between the two parties. It is the cornerstone of how the service provider sets and maintains commitments to the service consumer.”5

Proceeding from the foregoing definitions, the stark difference between the two (2) concepts is perceptible: a DSA is entered into by PICs, while an SLA is between a PIC and a data subject (i.e., consumer or client). A few other points may be inferred from this main distinction, namely:

  1. Governance and Applicability. The terms of a DSA are primarily governed by Section 20 of the IRR (and NPC Circular No. 16-02, where government agencies are involved), while those of an SLA are guided by regular contract rules, except where the SLA specifically concerns the processing of personal data. In the case of the latter, relevant provisions of the DPA shall also apply.

  2. NPC Authority. A DSA may be reviewed by the NPC, on its own initiative or upon a complaint by a data subject.6 The review of a typical SLA, however, would normally be outside the scope of the NPC’s authority. However, where such a contract involves the processing of personal data, the NPC, in its regulatory capacity or by virtue of its investigatory powers, may proceed to subject a particular SLA to its scrutiny.

With such contrasting characteristics in place, it is easy to appreciate why the terms of these two transactions should be encased in separate documents. Premised on different objects and causes, and with different parties involved, it is not only practical, but imperative even, that their particulars be outlined in separate contracts in order to avoid convoluted arrangements, and unintended or unnecessary entanglements.

For your reference.

Sincerely,

RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman

Footnotes

  1. IRR, §20(b)(2). ↩

  2. Id., §3(f). ↩

  3. Id., §20(b)(2)(a). ↩

  4. NPC Circular No. 2016-02, §3(A). ↩

  5. See: Wustenhoff, Edward. Service Level Agreement in the Data Center, 4 April 2002, https://pdfs.semanticscholar.org/d05c/dcaf25d144109fb6581aa033f4dac99c4e7f.pdf ↩

  6. IRR, §20(b)(2)(b). ↩

Backlinks

  • No backlinks found