Issuance Text
FREQUENTLY ASKED QUESTIONS (FAQs) ON NPC CIRCULAR NO. 2023-05
PREREQUISITES FOR THE PHILIPPINE PRIVACY MARK (PPM) CERTIFICATION PROGRAM
I. WHAT DOES THIS CIRCULAR CONTAIN?
It provides the prerequisites for certifying personal information controllers (PICs) or personal information processors (PIPs) and accrediting certification bodies (CBs) under the PPM Certification Program.
II. ARE PICs AND PIPs REQUIRED TO OBTAIN PPM CERTIFICATION PROGRAM?
No, it only applies to PICs or PIPs that will voluntarily seek certification and to CBs that will voluntarily seek accreditation under the PPM Certification Program.
III. ARE ACCREDITATION AND CERTIFICATION THE SAME?
No. Accreditation refers to a third-party attestation related to a conformity assessment body conveying a formal demonstration of its competence to carry out specific conformity assessment tasks. CBs undergo the accreditation process to certify PICs and PIPs.
Meanwhile, Certification refers to a third-party attestation related to an object of conformity assessment (e.g., product, process, service, system, installation, project, data, design, material, claim, person, body, or organization) with the exception of accreditation. PICs and PIPs are the ones who undergo certification with specific standard/s.
IV. ARE THE REQUIREMENTS THE SAME FOR PICs AND PIPs?
Yes, the requirements for PICs and PIPs are the same. Section 4 of the Circular states that PICs or PIPs must be certified with the following standards:
- I. ISO/IEC 27001 – information security management system (ISMS)
- II. ISO/IEC 27701 – privacy information management system (PIMS)
The details of the PPM Certification Program, such as the certification scheme, which contains specific requirements and rules or procedures for the certification, will be issued by the NPC, separately.
V. WHAT ARE THE REQUIREMENTS FOR CBs?
Section 5 of the Circular states that CBs must be certified with the following standards:
- I. ISO/IEC 27001 – information security management system (ISMS)
- II. ISO/IEC 27701 – privacy information management system (PIMS)
- III. In addition, CBs must obtain accreditation based on ISO/IEC 17021-1.
VI. MAY ORGANIZATIONS OBTAIN ISO/IEC 27001 AND ISO/IEC 27701 CERTIFICATIONS IN ANY ORDER, OR MUST THEY FOLLOW A PARTICULAR SEQUENCE?
ISO/IEC 27701 (Privacy Information Management System [PIMS]) is an extension of ISO/IEC 27001 (Information Security Management System [ISMS]); therefore, an organization must secure the ISO/IEC 27001 Certification first before proceeding with securing the ISO/IEC 27701 Certification.
VII. WHY IS THE STANDARD ISO/IEC 17021-1 PART OF THE REQUIREMENTS?
The ISO/IEC 17021-1 is a global standard that contains requirements for bodies engaged in auditing and certifying management systems. It defines the criteria for assessing the competence, consistency, and impartiality of bodies providing audit and certification of all types of management systems. As a result, it is added as a requirement for CBs to ensure that they are operating in a competent, impartial, consistent, and reliable manner.
VIII. ARE THERE ANY ASSOCIATED COSTS OR FEES FOR ISO/IEC 27001 AND ISO/IEC 27701 CERTIFICATIONS?
Costs will be incurred when the interested participant undergoes certification with chosen CBs on the ISO standards specified in the Circular.
IX. WHAT HAPPENS IF PICs, PIPs, AND CBs FAIL TO COMPLETE THE REQUIREMENTS FOR CERTIFICATION OR ACCREDITATION UNDER SECTIONS 4 AND 5?
They shall not be qualified to apply for certification or accreditation, as the case may be, under the PPM Certification Program.
X. WILL THE APPLICATION BE CONSIDERED IF IT IS A TRANSFERRED ISO CERTIFICATION?
Yes, since there is no prohibition in the Circular regarding the transfer of ISO Certification from one CB to another.
XI. WHEN WAS THE CIRCULAR PUBLISHED IN A NEWSPAPER OF GENERAL CIRCULATION?
The Circular was published in the Daily Tribune on March 15, 2024.
XII. WHEN IS THE EFFECTIVITY OF THIS CIRCULAR?
The Circular took effect on March 15, 2024. As provided in Section 9 thereof, the Circular takes effect immediately after publication in one newspaper of general circulation.