NPC Issuance Wiki

NPC Advisory Opinion No. 2017-024 — Retention Period for Personal Data

Issued Advisory Opinion

Text

21 June 2017

Re: RETENTION PERIOD

Dear [Redacted],

This is with regard to your query received by the National Privacy Commission (NPC) on 6 June 2017 regarding retention of personal data under the Data Privacy Act of 2012 (DPA) and its Implementing Rules and Regulation (IRR).

Specifically, you seek to inquire on the duration for which your company can keep the following files/information:

a. Job applicant’s personal data after unsuccessful application; b. Employee’s personal data after employee ceased employment; and c. Benefits enrollment information after employee ceased employment.

The DPA provides that personal data shall only be retained for as long as necessary for the fulfillment of the purposes for which the data was obtained or for the establishment, exercise or defense of legal claims, or for legitimate business purposes, or as provided by law.1

Further, the IRR expounds on such requirement under Section 19(d), to wit:

Section 19. General principles in collection, processing and retention. The processing of personal data shall adhere to the following general principles in the collection, processing, and retention of personal data: xxx xxx xxx

d. Personal Data shall not be retained longer than necessary.

  1. Retention of personal data shall only for as long as necessary:

    (a) for the fulfillment of the declared, specified, and legitimate purpose, or when the processing relevant to the purpose has been terminated;

    (b) for the establishment, exercise or defense of legal claims; or

    (c) for legitimate business purposes, which must be consistent with standards followed by the applicable industry or approved by appropriate government agency.

  2. Retention of personal data shall be allowed in cases provided by law.”

The IRR further provides that personal data shall not be retained in perpetuity in contemplation of a possible future use yet to be determined.2

From the foregoing, it is clear that the DPA and its IRR does not provide for a specific retention period. Instead, the law sets out the general principles and guidelines for the retention of personal data. As a general rule, records containing personal data should be retained only for as long as may be necessary for the purpose or purposes for which the personal data were collected.

The company should be mindful of the data privacy principles of transparency, legitimate purpose and proportionality. This means that data subjects must be informed of the retention periods of the company, and the purpose for retaining the records. The company must ensure that only that personal data which is adequate, relevant, suitable and necessary for the purpose will be retained.

Likewise, when retaining personal data, the company must implement security measures to ensure that the personal data being stored or retained are protected. These guidelines will not apply where the personal data is aggregated or kept in a form which does not permit identification of data subjects, in which case, the data may be kept longer.

It is recommended that the company develop and maintain its own record management policy which provide for retention periods and procedures for disposal of records containing personal data. Factors that may be considered by a company in determining retention periods of employment records would include:

  1. Legal requirements to which the company may be subject to;
  2. Applicable prescription periods in existing law (i.e. money claims);
  3. Department of Labor and Employment Rules;
  4. Bureau of internal revenue regulations for bookkeeping requirements; and
  5. Industry standards, and other laws and regulations that apply to the sector.

Thus, for as long as your company can determine a legitimate business purpose for the retention of the abovementioned personal data, which is consistent with standards followed in the industry you are in, or if there exists any legal claims being pursued by the company, or when retention is allowed as provided for by law, then retention of personal data is permitted. However, such retention must not be in perpetuity in consideration of some future use which has not yet been determined.

For your reference.3

Sincerely,

IVY D. PATDU Officer in Charge Deputy Privacy Commissioner for Policies and Planning

Footnotes

  1. Republic Act No. 10173, § 11(e). ↩

  2. Implementing Rules and Regulation of Republic Act No. 10173, §19(e)(3) ↩

  3. This advisory opinion is based on the limited information provided in the questions, and may vary based on additional information or when the facts are changed or elaborated. ↩

Backlinks