Text
28 June 2017
Re: PROCESSING OF PERSONAL DATA IN OUTSOURCING AND OFFSHORING ARRANGEMENTS
Dear [Redacted],
Discussion
This pertains to your query received by the National Privacy Commission (NPC) on 29 May 2017 regarding the processing of personal data in outsourcing and offshoring arrangements. Specifically, you seek guidance on whether the Data Privacy Act (DPA) applies to service providers that handle personal data on behalf of a company; whether there is a distinction between outsourcing to local and foreign entities; and whether the company remains liable even if the service provider violates data privacy obligations.
The DPA applies to all natural and juridical persons involved in the processing of personal information.1 This includes personal information controllers and personal information processors.
A personal information controller is defined as a natural or juridical person who, alone or jointly with others, determines the purposes, content and methods of processing of personal information, and has the power and capability to implement such processing. A personal information processor, on the other hand, is a natural or juridical person who processes personal information in accordance with the instructions of a personal information controller. It may be a service provider contracted by the controller to process personal information.
In outsourcing and offshoring arrangements where a company (the controller) engages the services of another entity (the processor) to handle personal data on its behalf, both the controller and the processor are covered by the DPA and must comply with its requirements.
The location of the processor—whether local or foreign—does not affect the applicability of the DPA, provided that the personal information is processed in relation to the offering or delivery of goods or services to data subjects in the Philippines.
Where a personal information processor violates data privacy obligations in handling personal data on behalf of the controller, the controller retains liability under the DPA. The controller is responsible for ensuring that the processor complies with applicable data privacy requirements through contractual and technical safeguards.
The DPA requires that any processing of personal data be done lawfully, transparently, and in accordance with the purposes specified. Controllers must ensure that processors implement appropriate safeguards for the protection of personal data and must establish procedures to address data subject rights.
For your reference.
Very truly yours,
IVY D. PATDU Officer-in-Charge and Deputy Privacy Commissioner for Policies and Planning