Text
17 March 2021
Re: FORENSIC AUDIT ON COMPANY-ISSUED ASSETS AND COMPANY-RELATED ACCOUNTS
Dear [Redacted],
We write in response to your email received by the National Privacy Commission (NPC) which sought to clarify whether the conduct of a forensic audit on company-issued assets and company-related accounts will have any negative implications or non-compliance with the Data Privacy Act of 20121 (DPA) and if there are any specific guidelines for such audits.
We understand that the internal audit team of your company is planning to perform a forensic audit on company-issued assets such as laptops and mobile phones, and company-related accounts and accesses such as email addresses, WiFi access, browsing and download history, among others. The purpose of such forensic audit is to ensure that no confidential company information is disclosed to third parties and that the use of company-issued assets shall not cause any type of company information breach.
The NPC has limited information as to the actual scope of the forensic audit which may involve personal and sensitive personal information (collectively, personal data) stored in the company-issued assets and accounts.
Discussion
General Data Privacy Principles; Lawful Basis for Processing; Data Subject Rights
Forensic audits conducted by employers on company-issued equipment and accounts may involve the processing of personal data. As such, employers must ensure compliance with the provisions of the DPA, particularly the general data privacy principles of transparency, legitimate purpose, and proportionality.
In this connection, we wish to emphasize that employers, as personal information controllers, must:
-
Establish a lawful basis for the forensic audit. The audit should be anchored on legitimate purposes related to the protection of company interests, compliance with legal obligations, or the protection of the vital interests of the company or its employees.
-
Ensure that the scope of the forensic audit is proportionate to the stated purpose. The audit should not extend beyond what is necessary to achieve the legitimate objectives.
-
Maintain transparency by informing employees about the conduct of the forensic audit, the purposes thereof, and how their personal data will be processed, handled, and protected.
-
Implement reasonable and appropriate security measures to protect the personal data collected during the audit from unauthorized access, disclosure, or misuse.
-
Respect data subject rights, including the right to access, correction, and erasure, subject to applicable exceptions under the law.
-
Where sensitive personal information is involved in the forensic audit, employers must ensure strict compliance with the requirements for processing such information under Section 13 of the DPA.
We recommend that employers establish clear internal policies governing forensic audits and ensure that such policies are communicated to employees. The scope and conduct of the forensic audit should be reasonable and proportionate to its stated purpose. Any personal data collected during the audit should be handled in accordance with the principles of the DPA and should not be used for purposes other than those disclosed to the data subjects.
This opinion is based solely on the limited information you have provided. Additional information regarding the actual scope and nature of the forensic audit may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩