Text
14 August 2017
Re: SECTION 47 OF THE IMPLEMENTING RULES AND REGULATIONS OF THE DATA PRIVACY ACT OF 2012
Dear [Redacted],
This pertains to your query received by the National Privacy Commission (NPC) on 26 May 2017, via email, which sought to clarify Section 47(a)(9) of the Implementing Rules and Regulations. Specifically, it states:
“Section 47. Registration of Personal Data Processing Systems. The personal information controller or personal information processor that employs fewer than two hundred fifty (250) persons shall not be required to register unless the processing it carries out is likely to pose a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes sensitive personal information of at least one thousand (1,000) individuals.
a. The contents of registration shall include:
xxx xxx xxx
- Attestation to all certifications attained that are related to information and communication processing;”
The attestation regarding the certifications attained by the personal information controller or personal information processor must contain and enumerate the certifications or accreditations obtained by the entity in relation with information and communication processing.
These certifications need not necessarily be on data privacy but on the standards required by the specific sector or industry to which the entity belongs. Indeed, an example would be the certification in accordance with the standards set by the International Standards Organization.
However, in the event that the company or entity does not possess any certification or accreditation, such fact must instead be stated in the attestation requirement.
For your reference.
Sincerely,
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman