2021 Rules of Procedure of the NPC, as Amended (Current Version)

Issuance Text

2021 RULES OF PROCEDURE OF THE
NATIONAL PRIVACY COMMISSION, AS AMENDED

RULE I. GENERAL PROVISIONS

SECTION 1. Title. These Rules shall be known as the “2021 NPC Rules of Procedure”.

SECTION 2. Liberal Construction. Any doubt in the interpretation of any provision of these Rules shall be liberally interpreted in a manner mindful of the rights and interests of the data subject about whom personal information is processed.

SECTION 3. Scope. These Rules shall apply to the receipt, investigation, alternative dispute resolution, preliminary conference, adjudication, and all other proceedings before the NPC.

SECTION 4. Definition of Terms. The terms defined in the DPA, and its rules, are adopted accordingly in this Circular. (a)

a. AFFIRMATIVE DEFENSES – shall refer to any defense by the respondent which, if found to be credible, will negate liability under the DPA, even if it is proven that the respondent in fact committed the alleged acts. (a)
b. BREACH INVESTIGATION – shall refer to an investigation conducted by the NPC with respect to a data breach notification prompted by the applicable rules promulgated by the Commission.
c. COMMISSION – shall refer to the Privacy Commissioner and the two (2) Deputy Privacy Commissioners.
d. COMPLAINT INVESTIGATION – shall refer to an investigation conducted by the NPC with respect to a formal complaint filed by a data subject or his or her representative for violation of the DPA. (a)
e. COMPLIANCE CHECK – shall refer to the systematic and impartial evaluation of a personal information controller (PIC) or personal information processor (PIP), in whole or in any part, process, or aspect thereof, to determine whether activities that involve the processing of personal data are carried out in accordance with the standards mandated by the DPA, IRR, and NPC issuances. It is an examination that includes Privacy Sweeps, Documents Submission, and On-Site Visits, which intends to determine whether a PIC or PIP is able to demonstrate organizational commitment, program controls, and review mechanisms intended to assure privacy and personal data protection in data processing systems. (n)
f. COURIER – shall refer to any private mail carrier accredited by the Supreme Court, the NPC, or by international conventions of which the Philippines is a signatory.
g. DIGITAL SIGNATURE – shall refer to an electronic signature consisting of a transformation of an electronic document or an electronic data message using an asymmetric or public cryptosystem such that a person having the initial untransformed electronic document and the signer’s public key can accurately determine: (1) whether the transformation was created using the private key that corresponds to the signer’s public key; and (2) whether the initial electronic document had been altered after the transformation was made.¹
h. DOCUMENTS SUBMISSION – shall refer to a mode of Compliance Check where the NPC may require the submission of documents and additional information from a PIC or PIP that has undergone a Privacy Sweep to, among others, clarify certain findings arising therefrom and to determine the level of compliance of the PIC or PIP with respect to its obligations under the DPA, IRR, and NPC issuances. (n)
i. ELECTRONICALLY-STORED INFORMATION – shall refer to any information that is received, recorded, transmitted, stored, processed, retrieved, or produced electronically. It shall include any printout or output that accurately reflects the electronically stored information.²
j. EVALUATING OFFICER – shall refer to a member of the Compliance and Monitoring Division (CMD), a special committee, or task force (or respective members thereof) that may or may not include members from the CMD, created by order of the Commission to evaluate documents and information submitted to the CMD pertaining to compliance requirements and personal data breach notifications. (a)
k. HEARING OFFICER – shall refer to a member of the Complaints and Investigation Division (CID), a special committee, or task force (or respective members thereof) that may or may not include members from the CID, created by order of the Commission to conduct hearings. (n)
l. INVESTIGATING OFFICER – shall refer to a member of the CID, a special committee, or task force (or respective members thereof) that may or may not include members from the CID, created by order of the Commission to conduct investigations, hearings, and prepare related reports. (a)
m. JURIDICAL PERSON – shall refer to: (1) the State and its political subdivisions, (2) corporations, institutions, and entities that are created by law for public interest or purpose, and (3) corporations, partnerships, and associations for private interest or purpose to which the law grants a juridical personality, separate and distinct from that of each shareholder, partner, or member.³ (n)
n. MEDIATION – shall refer to the voluntary process in which a Mediation Officer facilitates communication and negotiation and assists the parties in reaching a voluntary agreement regarding a dispute.
o. MEDIATION OFFICER – shall refer to a member of the Legal Division (LD), a special committee, or task force (or respective members thereof) that may or may not include members from the LD, created by order of the Commission to conduct mediation. (a)
p. MEDIATION SUPPORT OFFICER – shall refer to a member of the LD, a designated person, special committee, or task force (or respective members thereof) that may or may not include members from the LD, created by order of the Commission to provide support to Mediation Officers. (n)
q. NPC – shall refer to the National Privacy Commission created under the DPA. (a)
r. ON-SITE VISIT – shall refer to a mode of Compliance Check if there are persistent or substantial findings of non-compliance of the PIC or PIP with the obligations indicated in the DPA, IRR, and NPC issuances. (n)
s. PARTIES IN INTEREST – shall refer to a real party in interest who stands to be benefited or injured by the judgment in the suit, or the party entitled to the avails of the suit. Unless otherwise authorized by law or these Rules, every action must be prosecuted or defended in the name of the real party in interest.⁴ (n)
t. PRELIMINARY MEDIATION CONFERENCE – shall refer to the initial mediation conference after the parties mutually agree to enter into the mediation proceeding and the case is referred by the Investigating Officer to the Mediation Officer. (n)
u. PRIVACY SWEEP – shall refer to the initial mode of Compliance Check where the NPC shall review a PIC or PIP’s compliance with respect to its obligations under the DPA, IRR, and NPC issuances, based on publicly available or accessible information, such as, but not limited to websites, mobile applications, raffle coupons, brochures, and privacy notices. (n)
v. PRIVATE CAUCUS – shall refer to a private meeting with either party called by the Mediation Officer, with the consent of both parties, to discuss issues in private and to arrive at a mutually satisfactory agreement beneficial to all parties. (n)
w. PUBLIC AUTHORITY – shall refer to any government entity created by the Constitution or law. (n)
x. RULES – shall refer to the 2021 NPC Rules of Procedure, including its amendments, unless otherwise stated. (a)
y. SUA SPONTE INVESTIGATION – shall refer to an investigation initiated by the NPC on its own for possible violation of the DPA. (a)

SECTION 5. Enforcement Powers. The Commission may use its enforcement powers under the DPA in the course of investigations to order cooperation of the subject of the inquiries or other interested individuals or entities, including public authorities, or to compel appropriate action to protect the interests of data subjects. (a)

SECTION 6. Prescriptive Period of the Penal provision of the DPA. The Commission adopts the periods of prescription for violations penalized by specials acts as provided under Act 3326⁵ and any amendments thereto.

RULE II. COMPLAINTS

SECTION 1. Who may file complaints. Subject to Rule X of these Rules, data subjects who are affected by a privacy violation or data breach may file complaints for violations of the DPA: Provided, that a representative may file on behalf of a data subject if he or she is authorized by a special power of attorney. In the case of a minor or a person alleged to be incompetent, the pertinent provisions of the Rules of Court and its amendments shall apply. It is sufficient that proof establishing the relationship with the complainant be presented to the NPC as an attachment to the complaint. In case the minor or a person alleged to be incompetent is represented by the father or mother, the birth certificate shall be considered sufficient proof, while for the guardian, the court order designating the person as guardian shall be sufficient. (a)

One or more data subjects may be represented by a single juridical person: Provided, that the juridical person filing the complaint must be authorized by a special power of attorney to appear and act on behalf of the data subjects: Provided further, the person representing the juridical person acting as the representative of one or more data subjects must be authorized to appear and act on behalf of the juridical person by a Board Resolution contained in a duly notarized Secretary’s Certificate or its equivalent in case of government agencies⁶. (n)

In cases where the complainant is a non-resident citizen who has no authorized representative in the Philippines or is unable to appoint such a representative, such person may submit a complaint in accordance with these Rules: Provided, that the complaint must be notarized by the Philippine Embassy or Consulate, or with an apostille certificate from the country of origin. (n)

SECTION 2. Exhaustion of remedies. No complaint shall be given due course unless it has been sufficiently established and proven that:

the complainant has informed, in writing, the personal information controller (PIC), personal information processor (PIP), or concerned entity of the privacy violation or personal data breach to allow for appropriate action on the same; and
the PIC, PIP, concerned entity did not take timely for appropriate action on the claimed privacy violation or personal data breach, or there is no response from the PIC, PIP, or concerned entity within fifteen (15) calendar days from receipt of written information from the complainant.

The NPC may waive any or all of the requirement of this Section at its discretion upon (a) good cause shown, properly alleged and proved by the complainant; or (b) if the allegations in the complaint involve a serious violation or breach of the Data Privacy Act of 2012, taking into account the risk of harm to the affected data subject, including but not limited to:

i. when there is grave and irreparable damage which can only be prevented or mitigated by action of the NPC;
ii. when the respondent cannot provide any plain, speedy, or adequate remedy to the alleged violation; or
iii. the action of the resident is patently illegal.

SECTION 3. Form and contents of the complaint. The complaint should be in the proper form, as follows:

The complaint must be in writing, signed by the party or his or her counsel, and verified in the format prescribed under the Rules of Court.
The complaint must specify the identity of the individual claiming to be the subject of a privacy violation or the person so damaged or injured by a data breach, who shall be referred to as the complainant.
The complaint shall include the complainant’s contact information, and where the complainant or duly authorized representative may be served with orders, issuances, or communications, including an electronic mail address if available.
The complaint must identify the person, entity or organization complained of who shall be referred to as the respondent: Provided, that in the case of juridical persons, the responsible officers may also be included as respondents if they participated in, or by their gross negligence, allowed the commission of the alleged violation of the Data Privacy Act of 2012. If not known, the complainant shall state the circumstances that may lead to the identity of the respondent.
The complainant shall also provide in the complaint, if known: (a) respondent’s contact information; and (b) where respondent may be served with orders, issuances, or communications from the NPC.
The complaint shall include a narration of the material facts and supporting testimonial or documentary evidence, if any, all of which show: (a) the violation of the Data Privacy Act of 2012, its Implementing Rules and Regulations, or NPC issuances; or (b) the acts or omissions allegedly committed by respondent and in the case of juridical persons, employees or agents who committed the offense amounting to a privacy violation or personal data breach.
The complaint must include any and all reliefs sought by the complainant.
The complainant shall attach any and all correspondence with respondent on the matter complained of and include a statement of the action taken by respondent to address the complaint, if any, showing compliance with the immediately preceding Section.
The supporting documents shall consist of copies of any documentary evidence and the affidavits of witnesses, if any, including those affidavits necessary to identify the documents and to substantiate the complaint.
A certification against forum shopping must accompany the complaint. The complainant shall certify under oath in the complaint, or in a sworn certification annexed and simultaneously filed with the pleading: (a) that he or she has not commenced any action or filed any claim involving the same issues in any court, tribunal or quasi-judicial agency and, to the best of his or her knowledge, no such other action or claim is pending with such court, tribunal or quasi-judicial agency; (b) if there is such other pending action or claim, a complete statement of its present status; and (c) if he or she should thereafter learn that the same or similar action or claim has been filed or is pending, he or she shall report that fact within five (5) calendar days therefrom to the NPC.

Failure to comply with the proper form and contents of the complaint may cause for outright dismissal under Section 1(1), Rule IV: Provided, an application that does not comply with the foregoing requirements may be acted upon if it merits appropriate consideration on its face, or is of such notoriety that it necessarily contains sufficient leads or particulars to enable the taking of further action.

SECTION 4. Filing fees. No further action on a complaint shall be made unless the appropriate filing fees have been paid, except when: (a) the complainant is the government, or any agency or instrumentality, and government-owned and controlled corporations organized and existing under their own charter; excluding government-owned and controlled corporations organized and incorporated under the Corporation Code; (b) the complaint is filed by an indigent complainant as defined in the Rules of Court or as otherwise prescribed by NPC through an advisory; or (c) the NPC, upon motion by the requesting party, waives this requirement based on discretion and for good cause shown.

SECTION 5. Where to file complaints. A complaint may be filed at any office of the NPC.

SECTION 6. Evaluation. Within five (5) calendar days from the receipt of the complaint, the NPC shall raffle or assign the case to an investigating officer to conduct the proceedings.

SECTION 7. Consolidation of cases. Except when consolidation would result in delay or injustice, the NPC may, upon motion or in its discretion, consolidate two (2) or more complaints involving common questions of law or fact and/or same parties.

RULE III. FILING AND SERVICE

SECTION 1. Modes of filing. The filing of all pleadings and other submissions shall be made through any of the following modes:

a. Submitting personally two (2) original copies and as many copies as there are receiving parties, plainly indicated as such, to the NPC;
b. Sending them by registered mail;
c. Sending them by courier; or
d. Transmitting them by electronic mail as may be authorized by the Commission.

In the first case, the receiving NPC officer or employee shall indicate on the pleading the date and hour of filing. In the second and third cases, the date of the mailing of motions, pleadings, and other submissions, as shown by the post office stamp on the envelope or the registry receipt, shall be considered as the date of their filing. The envelope shall be attached to the record of the case. In the fourth case, the date of electronic transmission shall be considered as the date of filing provided that it is sufficient in form.

All pleadings and other submissions other than the complaint must be accompanied by an affidavit of service to the other party/parties.

Illegible, erroneous, and otherwise malfunctioning submissions by electronic mail shall not be considered by the NPC.

SECTION 2. Modes of service. Unless otherwise stated, pleadings, motions, and other submissions shall be served personally or by registered mail, courier, or electronic mail as may be authorized by the Commission.

Service by electronic mail made by one party to another may only be made if the party recipient consents to such mode of service or by order of the Commission. The party recipient, within five (5) calendar days from receipt of the electronic mail, may move ex parte that the party sender resubmit the electronic mail due to illegibility or error in the first submission.

The Commission may, in its discretion, order any party who filed and/or served by electronic mail to send the printed and/or original signed copy of the document to the NPC through conventional service.

Documents not readily amenable to electronic scanning such as but not limited to those containing object evidence must be filed and served conventionally. In no instance may filing and service be done partly by electronic means and partly by conventional means.

The investigating officer or Commission, in their discretion and on a case to case basis, may demand that the parties file and serve their submissions conventionally.

SECTION 3. Presumption of service. There shall be disputable presumptive notice to a party of a hearing or conference if such notice appears on the records to have been mailed at least twenty (20) calendar days prior to the scheduled date of hearing.

SECTION 4. Extraterritorial service by NPC, when allowed. When the respondent does not reside and is not found in the Philippines, service may be effected out of the Philippines by personal service or as provided for in international conventions to which the Philippines is a party; or by publication in a newspaper of general circulation in such places and for such time as the investigating officer or Commission may order, in which case a copy of the order to comment shall be sent by registered mail to the last known address of the respondent, or in any other manner the investigating officer or Commission may deem sufficient. The complainant shall bear the cost referred to in this Section.

SECTION 5. Service by NPC to unknown respondent or respondent whose whereabouts are unknown. In cases where the respondent is unknown, or whenever his or her whereabouts are unknown and cannot be ascertained by diligent inquiry, service by the investigating officer or Commission shall be effected upon him or her by publication in a newspaper of general circulation in such places and for such time as the investigating officer or Commission may order. The complainant shall bear the cost of the publication.

In case the respondent has a known electronic mail address, service by the Commission may be effected upon him or her through electronic mail in lieu of publication.

SECTION 6. Service of judgments, orders, or resolutions of the NPC. At the discretion of the Commission, judgments, orders, or resolutions shall be served either personally, by registered mail, by courier, by sending through user accounts and auto-generated notification of electronic systems implemented by the NPC, or by electronic mail. When a complaint, pleading, or any other submission is filed or submitted through electronic mail, the NPC may serve its judgments, orders, or resolutions by electronic mail through the same electronic mail address used in the filing of the complaint or pleading, or submission of document, unless otherwise indicated in the complaint, pleading, motion, or other submissions of parties. When the NPC has opted to serve a judgment, order, or resolution by electronic mail, it shall no longer serve its issuances in the same case or matter by any other mode of service, unless circumstances warrant otherwise. (a)

For judgments, orders, or resolutions served by electronic mail, electronic service is considered complete at the time of electronic transmission of the document, or when available, at the time that the electronic notification of service of document is sent. (n)

For matters coursed through the electronic systems implemented by the NPC, the service of judgments, orders, or resolutions is deemed completed at the time it is successfully uploaded to the system. (n)

RULE IV. PRE-INVESTIGATION PHASE

(Amended and renumbered pursuant to NPC Circular No. 2024-01)

SECTION 1. Outright dismissal, when allowed. Within thirty (30) calendar days from receipt of the complaint, the Investigating Officer may give the complaint due course or dismiss the complaint without prejudice, on any of the following grounds:

The complaint is insufficient in form or does not comply with Section 3, Rule II of these Rules;
The complainant does not give the respondent an opportunity to address the complaint, unless failure to do so is justified;
The complaint does not pertain to a violation of the DPA or does not involve a privacy violation or data breach;
There is insufficient information to substantiate the allegations in the complaint; or
The parties, other than the responsible officers of juridical persons, cannot be identified or traced despite diligence to determine them. (a)

SECTION 2. Amendment of complaint, when allowed. The complainant may substantially amend the complaint once as a matter of right at any time before the respondent has filed a comment, in which case the respondent shall be provided a copy and granted a fresh period to submit his or her comment. Substantial amendments after the respondent has filed a comment may only be done upon motion and with leave of the Investigating Officer.

SECTION 3. Permissive joinder of parties. All persons in whom or against whom any right to relief in respect to or arising out of the same transaction or series of transactions is alleged to exist, whether jointly, severally, or in the alternative, may, except as otherwise provided in these Rules, join as complainants or be joined as respondents in one complaint, where any question of law or fact common to all such complainants or to all such respondents may arise in the action; but the NPC may make such orders as may be just to prevent any complainant or respondent from being embarrassed or put to expense in connection with any proceedings in which the party may have no interest. (n)

SECTION 4. Compulsory joinder of indispensable parties. Parties in interest without whom no final determination can be had of an action shall be joined either as complainants or respondents. (n)

SECTION 5. Necessary party. A necessary party is one who is not indispensable but who ought to be joined as a party if complete relief is to be accorded as to those already parties, or for a complete determination or settlement of the claim subject of the action.⁷ (n)

SECTION 6. Non-joinder of necessary parties to be pleaded. Whenever in any complaint or pleading in which a claim is asserted a necessary party is not joined, the pleader shall set forth the party’s name, if known, and shall state why the party is omitted. Should the NPC find the reason for the omission unmeritorious, it may order the inclusion of the omitted necessary party if jurisdiction over the person may be obtained.

The failure to comply with the order for a necessary party’s inclusion, without justifiable cause, shall be deemed a waiver of the claim against such party.

The non-inclusion of a necessary party does not prevent the NPC from proceeding with its investigation, and any decision rendered therein shall be without prejudice to the rights of such necessary party. (n)

SECTION 7. Misjoinder and non-joinder of parties. Neither misjoinder nor non-joinder of parties is ground for dismissal of a complaint. Parties may be dropped or added by order of the NPC by motion of any party or on its own initiative at any stage of the action and on such terms as are just. Any claim against a misjoined party may be severed and proceeded with separately. (n)

SECTION 8. Entity without juridical personality as respondent. When two or more persons not organized as an entity with juridical personality enter into a transaction, they may be sued under the name by which they are generally or commonly known. In the answer of such respondent, the names and addresses of the persons composing the entity must be accurately stated. The address to be used shall be the last known address of the respondent. (n)

SECTION 9. Submission of comment. Upon finding that the complaint may be given due course, the respondent shall be required to file a verified comment within fifteen (15) calendar days from receipt of the order. A copy of the complaint, together with its supporting evidence, shall be attached to the order to comment.

A complaint may be submitted for resolution if the respondent does not file a comment within the period provided.

In case the respondent is a minor or a person alleged to be incompetent, the pertinent provisions of the Rules of Court and its amendments shall apply. It is sufficient that proof establishing the relationship with the respondent be presented to the NPC as an attachment to the comment. In case the minor or a person alleged to be incompetent is represented by the father or mother, the birth certificate shall be considered sufficient proof, while for the guardian, the court order designating the person as guardian shall be sufficient. (n)

In case the respondent is a juridical person, the representative filing the comment must be authorized to appear and act on behalf of the juridical person by a Board Resolution contained in a duly notarized Secretary’s Certificate, or its equivalent for a government agency⁸. (n)

SECTION 10. Content of the comment. The respondent shall raise all of his or her defenses in the comment. No motions to dismiss shall be entertained: Provided, the Investigating Officer, in his or her discretion, may treat a motion to dismiss as the respondent’s comment.

SECTION 11. Change of physical address or electronic mail address. A party who changes physical address or electronic mail address while the complaint is pending must promptly file, within five (5) calendar days from such change, a notice of change of physical address or electronic mail address with the NPC and serve the notice on all other parties. Service through the physical address or electronic mail address of a party, on record, shall be presumed valid, unless such party notifies the NPC of any change. (n)

SECTION 12. Prohibited pleadings and motions. The following pleadings and motions shall not be allowed in the complaint proceedings:

motions to dismiss the complaint;
motions for a bill of particulars;
motions to declare respondent in default;
dilatory motions for postponement;
replies or rejoinders, except if the preceding pleading incorporates an actionable document;
third-party complaints;
interventions; and
appeals or motions for reconsideration from any interlocutory order of the Investigating Officer.

SECTION 13. Affirmative defenses. In lieu of a motion to dismiss, the respondent may raise in the comment affirmative defenses such as but not limited to:

The NPC has no jurisdiction over the subject matter;
The action is barred by a prior judgment;
There is another action pending between the same parties for the same cause;
The complainant has no legal capacity to sue;
That the pleading asserting the claim states no cause of action or is found to be frivolous, vexatious, or made in bad faith;
The action has otherwise prescribed under the statute of limitations; or
That the claim or demand set forth in the complaint has been paid, waived, abandoned, or otherwise extinguished. (a)

SECTION 14. Authority of the Investigating Officer to rule on motions. The Investigating Officer may directly rule on motions that do not fully dispose of the case on the merits. No appeal or motion for reconsideration may be taken for any interlocutory order made by the Investigating Officer but these may be included as an issue once the case has reached the Commission for adjudication under Rule VIII of these Rules.

RULE V. PRELIMINARY CONFERENCE

SECTION 1. Order to confer for preliminary conference. No later than thirty (30) calendar days from the lapse of the reglementary period to file the comment, the investigating officer shall hold a preliminary conference to determine:

whether alternative dispute resolution may be availed by the parties;
whether discovery is reasonably likely to be sought in the proceeding;
simplification of issues;
possibility of obtaining stipulations or admissions of facts and of documents to avoid unnecessary proof; or
such other matters as may aid in the prompt disposition of the action.

SECTION 2. Referral to alternative dispute resolution or mediation. If alternative dispute resolution is availed by the parties, the investigating officer shall refer the case to the mediation officer, in which case Rule VI of these Rules shall govern.

SECTION 3. Failure of parties to appear, effect. The failure of either of the parties to appear during the preliminary conference without justifiable reason shall cause the conference to be reset once, and upon failure of the party concerned once again to appear, said party shall be deemed to have waived his/her rights to the benefits hereto, including but not limited to mediation, discovery, and/or stipulation of facts.

SECTION 4. Discovery of electronically-stored information, process. If discovery of electronically-stored information is reasonably likely to be sought in the proceeding, the parties shall discuss:

issues relating to the preservation of the information;
the form in which each type of information will be produced;
the period within which the information will be produced;
the method for asserting or preserving claims of privilege or of protection of the information;
the method for asserting or preserving confidentiality and proprietary status of information relating to a party or person not a party to the proceeding;
whether allocation of the expense of production among the parties is appropriate; and
any other issue relating to the discovery of electronically-stored information.

The investigating officer may issue an order governing the discovery of electronically-stored information pursuant to:

a. a motion by a party seeking discovery of the information or from which discovery of the information is sought; or
b. a stipulation of the parties and of any person not a party from which discovery of the information is sought.

Subject to the rules on privileged information, the investigating officer may impose sanctions on a party for failure to provide electronically-stored information, except if the party proves that the information was lost as a result of the routine, good-faith operation of an electronic information system in accordance with existing policies.

Any party may move ex parte to request for the production of electronically-stored information and for permission to inspect, copy, test, or sample such information. The party on which the said request is served must respond within ten (10) calendar days, or in such timely manner as to preserve the integrity of the electronically-stored information. With respect to every item or category in the request, the response must state that inspection, copying, testing, or sampling of the information will be permitted; otherwise, the objection to the request and the reasons therefor.

The requesting party may specify the form in which the electronically-stored information is to be produced. Unless the parties otherwise agree or the investigating officer otherwise orders: (1) if a request for production does not specify a form for producing a type of electronically-stored information, the responding party shall produce the information in the form in which it is ordinarily maintained or in a form that is reasonably usable; and (2) a party need not produce the same electronically-stored information in more than one form.

A party may object to the discovery of electronically-stored information from sources that the party identifies as not reasonably accessible because of undue burden or expense. In its objection, the party shall identify the reason for the undue burden or expense. In a motion to compel discovery or for a protective order relating to the discovery of electronically-stored information, a party objecting to discovery bears the burden of proving that the information is from a source that is not reasonably accessible because of undue burden or expense.

Despite a showing that electronically-stored information would come from a source that is not reasonably accessible because of undue burden or expense, the investigating officer may still order discovery of such information if the party requesting shows that the likely benefit of the proposed discovery outweighs the likely burden or expense, taking into account the amount in controversy, the resources of the parties, the effect of the privacy violation to the data subject, and the importance of the requested discovery in resolving the issues. The investigating officer may set conditions for discovery of the information, including allocation of the expense.

The investigating officer shall limit the frequency or extent of discovery of electronically-stored information, even from a source that is reasonably accessible, if it is found that:

a. it is possible to obtain the information from some other source that is more convenient, less burdensome, or less expensive;
b. the discovery sought is unreasonably cumulative or duplicative;
c. the party seeking discovery has had ample opportunity by discovery in the proceeding to obtain the information sought; or
d. the likely burden or expense of the proposed discovery outweighs the likely benefit, taking into account the amount in controversy, the resources of the parties, the importance of the issues, and the importance of the requested discovery in resolving the issues.

SECTION 5. Discovery of other information. Discovery proceedings outside of the production, inspection and storage of electronically stored information are allowed and subject to the Rules of Court.

SECTION 6. Confidentiality of discovered information. Any party who receives any information, whether electronically stored or not, by result of discovery, is mandated to preserve the confidentiality of such information. Furthermore, any information obtained during discovery may only be used by the parties for legal purposes and by NPC itself for the fulfillment of its mandate. This Section shall apply even if the party chooses not to use the information during the complaint proceedings.

SECTION 7. Preliminary conference order. Within fifteen (15) calendar days from the termination of the preliminary conference, the investigating officer shall issue an order which shall recite in detail the matters taken up.

RULE VI. ALTERNATIVE DISPUTE RESOLUTION

(Amended and renumbered pursuant to NPC Circular No. 2024-01)

SECTION 1. Willingness to mediate. During the preliminary conference or at any stage of the proceedings but before endorsement of the case for decision by the Legal and Enforcement Office (LEO) Director or the Commission, as the case may be, the parties, by mutual agreement, may signify their interest to explore the possibility of settling issues by mediation. (a)

SECTION 2. Application for mediation. The parties shall jointly file with the Investigating Officer an Application for Mediation manifesting their earnest commitment to engage in a meaningful settlement process and their willingness to abide by these Rules and the orders issued by the assigned Mediation Officer.

Parties may apply for mediation through their representatives, provided that the latter are duly authorized in accordance with Section 8 of this Rule. Otherwise, no order to mediate shall be issued by the Investigating Officer until and unless such requirements have been completed and substantiated. (n)

No application for mediation shall be approved without payment of the mediation fee.

SECTION 3. Mediation fees. The mediation fee, in an amount prescribed by the Commission in a separate issuance, shall be paid by the parties upon the filing of the Application for Mediation.

Parties may be exempted from the payment of the mediation fee under the same grounds as Section 4, Rule II of these Rules.

SECTION 4. Order to mediate, when issued. The Investigating Officer shall issue an Order to Mediate, which shall state the following: (a) the approval of the Application for Mediation; (b) the suspension of the complaint proceedings for up to ninety (90) calendar days pending the mediation proceedings; (c) the name of the assigned or designated Mediation Officer who shall preside over the mediation proceedings; and (d) the date, time, and place when the parties shall appear before the Mediation Officer for the Preliminary Mediation Conference. Copies of the Order to Mediate shall be furnished to the Mediation Officer and the parties. (a)

SECTION 5. Conduct of Mediation Officers. All Mediation Officers and Mediation Support Officers shall be bound by the NPC Mediation Code of Conduct. (n)

SECTION 6. Preliminary Mediation Conference. The Mediation Officer shall receive the appearances of the parties and inform them of the mediation process and the manner by which the proceedings will be conducted. The Mediation Officer shall reiterate the benefits of an early settlement of the dispute and endeavor to achieve the fairest and most expeditious settlement possible. (a)

Each party shall be allowed to make a brief statement of their respective position and preferred outcome. The Mediation Officer shall assist the parties in exploring common grounds for settlement while respecting party autonomy throughout the process. (a)

When necessary, the parties shall agree on the schedule of the next mediation conference and the Mediation Officer shall issue an order therefor.

SECTION 7. Separate caucuses and subsequent conferences. The Mediation Officer may, with the consent of both parties, hold separate caucuses with each party to enable a determination of their respective real interest in the dispute: Provided, that each party shall be afforded equal time and opportunity to ventilate such interest and motivation. The Mediation Officer may call such conferences or caucuses as may be necessary to facilitate settlement.

The Mediation Officer shall hold in confidence any matter disclosed during the separate caucuses and shall exercise reasonable prudence and discretion in the safeguarding of such information.

SECTION 8. Personal appearance by the parties. Individual parties are required to personally appear during mediation conferences. Representatives may appear on behalf of individual parties: Provided, that they are authorized by a special power of attorney to appear, offer, negotiate, accept, decide, and enter into a mediated settlement agreement without additional consent or authority from the principal. If the party is a juridical person, the representative must be authorized by a Board Resolution contained in a duly notarized Secretary’s Certificate, or any equivalent written authority to offer, negotiate, accept, decide, and enter into a mediated settlement agreement.

No representative shall be allowed to appear in mediation on behalf of a party without proper authorization as verified by the Mediation Officer. (n)

The parties shall inform the LD about changes in representation through a written statement or manifestation along with the corresponding written authority to offer, negotiate, accept, decide, and enter into a mediated settlement agreement submitted to the Mediation Officer prior to the next scheduled mediation conference. The mediation shall not proceed until and unless the representatives are duly authorized in accordance with this Section. (n)

SECTION 9. Failure of parties to appear, effect. If any of the parties fail to appear without justifiable reason for two (2) consecutive mediation conferences at any stage of the proceedings, the Mediation Officer may order its termination and refer the same for the resumption of complaint proceedings: Provided, in case of doubt that the party’s absence is justified, the Mediation Officer may order for another caucus or conference. The Mediation Officer may require the non-appearing party to explain why said party should not be required to pay treble costs incurred by the appearing party, including attorney’s fees, in attending the mediation conferences or caucuses, and be henceforth permanently prohibited from requesting mediation at any other stage of the complaint proceedings before the NPC. (a)

SECTION 10. Presence of lawyers in mediation. Lawyers who act as counsels, upon the discretion of the Mediation Officer, may attend the mediation conferences in the role of an adviser and consultant to their clients and shall cooperate with the Mediation Officer towards securing a settlement of the dispute. They shall help their clients comprehend the mediation process and its benefits and assist in the preparation of a mediated settlement agreement and its eventual enforcement.

Lawyers who act as duly authorized representatives of juridical persons may directly attend the mediation conference with all its concomitant rights and obligations.

SECTION 11. Venue. Mediation proceedings may either be conducted via videoconferencing technology for the remote appearance and testimony of parties, as provided under Rule XIII, Section 7 hereof, or within the NPC premises, as agreed by both parties. Upon request of both parties, the Mediation Officer may authorize the conduct of a mediation conference at any other venue, provided that all related expenses, including transportation, food, and accommodation, shall be borne by both parties. If a change of venue is requested by one party, it must be with the other’s conformity, and they shall agree on the terms of handling the expenses. (a)

SECTION 12. Mediation period and extension. The Mediation Officer shall endeavor to achieve a mediated settlement of the dispute within sixty (60) calendar days from the Preliminary Mediation Conference. (a)

Upon reasonable ground to believe that settlement may yet be achieved beyond the initial mediation period of sixty (60) calendar days, the Mediation Officer may extend the mediation period for another thirty (30) calendar days for good cause shown. In all instances, the mediation period shall not exceed ninety (90) calendar days. (n)

SECTION 13. Mediated Settlement Agreement. A mediated settlement agreement following successful mediation shall be jointly prepared and executed by the parties or their representatives, with the assistance of their respective counsels, if any. Only the parties or their authorized representatives shall have the authority to confirm the provisions of the mediated settlement agreement and execute the agreement. The execution of a mediated settlement agreement shall terminate the mediation proceedings. The Mediation Officer shall certify that the contents of the agreement have been explained, understood, and mutually agreed upon by the parties, and that the provisions are not contrary to law, public policy, morals, or good customs. (a)

SECTION 14. Confirmation Conference. The Mediation Officer shall require the parties to attend a confirmation conference prior to the endorsement of their mediated settlement agreement to the Commission. The parties shall present to the Mediation Officer the signed mediated settlement agreement, as well as the evidence of compliance with the stipulation in the agreement, if applicable.

In case of failure of any of the parties to appear for two (2) consecutive confirmation conferences, the Mediation Officer may resolve to submit the parties’ mediated settlement agreement to the Commission for confirmation: Provided, that the appearing party has agreed to proceed, that the parties have fully complied with all the obligations arising from the provisions of the mediated settlement agreement, that the parties have submitted all the necessary documents, and the LD has duly notified the non-appearing party. In such cases, the non-appearing party’s right to amend, object, or revoke specific provisions in the mediated settlement agreement shall be deemed waived.

When the agreement involves future obligations or obligations susceptible to partial fulfillment beyond the mediation period, the party responsible shall submit proof of compliance to the Enforcement Division (EnD). (n)

SECTION 15. Confirmation by the Commission. The Mediation Officer shall issue a resolution submitting the signed mediated settlement agreement to the Commission within thirty (30) calendar days from the date of the confirmation conference. The Commission shall issue a resolution confirming the mediated settlement agreement within thirty (30) calendar days from submission of the resolution and mediated settlement agreement. Copies of the resolution issued by the Commission shall be furnished to the parties, the Investigating Officer, and the Mediation Officer. (a)

SECTION 16. Effect of confirmed Mediated Settlement Agreement. A confirmed mediated settlement agreement shall have the effect of a decision or judgment on the complaint but without prejudice to Rule X of these Rules and shall be enforced in accordance with the NPC’s rules and issuances. (a)

SECTION 17. Failure to reach settlement. If the parties are unable to arrive at a settlement of their dispute, or it becomes apparent that a settlement, given the disparity of the respective positions of the parties, is not likely or achievable within the sixty (60) calendar day mediation period or the reasonable extension of such period under Section 12 of this Rule, the Mediation Officer may declare the mediation unsuccessful and terminate the proceedings by issuing a Notice of Non-Settlement of Dispute and furnishing copies to the Investigating Officer and the parties. (a)

Parties may be allowed to re-apply for mediation despite a prior failure to reach settlement, unless otherwise permanently prohibited in accordance with Section 9 of this Rule: Provided, that the application is filed before the endorsement of the case for decision by the Commission: Provided further, that the application is done in compliance with this Rule. (n)

SECTION 18. Resumption of complaint proceedings. Upon receipt of the Notice of Non-Settlement of Dispute issued by the Mediation Officer, the Investigating Officer shall issue an order lifting the suspension of the complaint proceedings, which shall resume as a matter of course. Copies of the order, including the notice of the next hearing date of the complaint proceedings, shall be furnished to all the parties. (a)

SECTION 19. Confidentiality of proceedings. The mediation conferences shall be held in private. Persons other than the parties, their representatives, counsel, and the Mediation Officer may attend only with the consent of the parties and upon approval by the Mediation Officer. Anyone present during a mediation conference shall not disclose any information obtained during the conference to any other person, nor utter the same through other means.

The mediation proceedings and all related incidents shall be kept strictly confidential, and all admissions or statements shall be inadmissible for any purpose in any proceeding, unless otherwise specifically provided by law. However, evidence or information that is otherwise admissible or subject to discovery does not become inadmissible or protected from discovery solely by reason of its use in mediation.

No transcript or minutes of the mediation proceedings shall be taken, and the personal notes of the Mediation Officer, if any, shall likewise be inadmissible nor cognizable in any court, tribunal, or body for whatever purpose and shall be securely destroyed upon termination of the mediation proceedings.

RULE VII. INVESTIGATION PHASE

SECTION 1. Examination of systems and procedures. Upon termination of the preliminary conference, the investigating officer shall decide whether there is a necessity to further investigate the circumstances surrounding the privacy violation or personal data breach.

The investigating officer shall not be limited to the pleadings, allegations, issues and evidence submitted before him or her. Investigations may include on-site examination of systems and procedures, subject to the issuance of a proper authority from the NPC. Upon request of the investigating officer, on-site examination of systems and procedures may be undertaken by technical personnel who shall be authorized by the Commission to conduct highly technical and highly sensitive forensic examinations.

In the course of the investigation, the complainant and/or respondent may be required to furnish additional information, document or evidence, or to produce additional witnesses. The parties shall have the right to examine the evidence submitted, which they may not have been furnished, and to copy them at their expense.

SECTION 2. Submission of simultaneous memoranda. The investigating officer shall require the parties to submit simultaneous memoranda discussing and summarizing their respective causes of action, claims, and defenses within fifteen (15) calendar days from written notice. The memoranda must also include, in simple tabular form, a list of all the evidence presented by the party and purpose to his/her claim or defense. Failure to submit the memorandum within the period provided shall be considered a waiver of such opportunity.

SECTION 3. Fact-Finding Report. Within thirty (30) calendar days from the last day of the reglementary period to file memoranda, the Investigating Officer shall submit to the Commission a Fact-Finding Report, including the results of the investigation, the evidence gathered, and recommendations. Within ten (10) calendar days from submission of the Fact-Finding Report to the Commission, both parties shall be furnished with a notice that the case has been submitted for decision to the Commission.

For cases recommended for outright dismissal under Rule IV, Section 1 of these Rules, the Investigating Officer shall submit to the LEO Director a Fact-Finding Report, including the basis and recommendation for outright dismissal of the complaint. (n)

SECTION 4. Withdrawal of the complaint. At any period before the submission of the Fact-Finding Report, the complainant may withdraw the complaint upon approval of the investigating officer and upon such terms and conditions as the latter may deem proper. The investigating officer may recommend either the dismissal of the case, with or without prejudice, or the application of the Commission’s power to initiate sua sponte investigations.

RULE VIII. DECISION

(Amended and renumbered pursuant to NPC Circular No. 2024-01)

SECTION 1. Action on the recommendations of the Investigating Officer. The Commission shall review the evidence presented, including the Fact-Finding Report and evidence on record. On the basis of the review, the Commission may: (1) promulgate a Decision; (2) issue interlocutory orders on matters affecting personal data; or (3) order the conduct of a clarificatory hearing or the submission of additional documents, if in its discretion, additional information is needed to make a decision. No motion for clarificatory hearing shall be entertained. In case the Commission finds that a clarificatory hearing is necessary, the following shall be observed:

a. The parties shall be notified of the scheduled clarificatory hearing at least five (5) calendar days before the schedule;
b. The Commission may require additional information and compel attendance of any person involved in the complaint;
c. The parties shall not directly question the individuals called to testify but may submit their questions to the Commission for its consideration;
d. The Commission may require the parties to submit their respective memoranda containing their arguments on the facts and issues for resolution. (a)

SECTION 2. Additional issues to be raised before the Commission. Upon motion, both parties may raise as an issue during adjudication any interlocutory order or decision issued by the Investigating Officer, Evaluating Officer, special committee, or task force, as the case may be. The Commission, in its discretion, may resolve the issues separately or jointly with the merits of the case.

Once a given case has reached the Commission for adjudication, the Investigating Officer, Evaluating Officer, special committee, or task force shall transmit to the Commission any pleadings, motions, and other submissions erroneously filed subsequent to the endorsement of the main case to the Commission. Subject to the discretion of the Commission, these pleadings, motions, and other submissions may form part of the main case.

SECTION 3. Decision for Cases Dismissed Outright. The LEO Director shall review the evidence presented, including the Fact-Finding Report and the evidence on record. Based on the review, the LEO Director may: (1) promulgate a decision dismissing the case outright based on the grounds in Rule IV, Section 1 of these Rules; or (2) remand the complaint for investigation and require the respondent to file a verified comment to the complaint and appear for preliminary conference. Provided, the dismissal shall be without prejudice to the refiling with the NPC in accordance with the Rules, or filing of appropriate civil, criminal, or administrative cases against the respondent before any other forum or tribunal, if any. (n)

SECTION 4. Decision for Cases where Complainant files an Affidavit of Desistance. The LEO Director shall review the evidence presented, including the Fact-Finding Report, evidence on record, and any other supporting documents. Based on the review, the LEO Director shall promulgate a decision. The dismissal shall be with prejudice to the refiling with the NPC, but without prejudice to the filing of appropriate civil, criminal, or administrative cases against the respondent before any other forum or tribunal, if any. (n)

SECTION 5. Refiling of complaint or motion for reconsideration on the decision issued by the Legal and Enforcement Office. The complainant may refile the complaint with the NPC or file with the LEO a motion for reconsideration of the decision dismissing the case outright. Otherwise, the decision of the LEO Director shall become final and executory within fifteen (15) calendar days from notice thereof with proof of service on the adverse party. If the complainant files a motion for reconsideration, the motion for reconsideration shall be endorsed to the Commission for its resolution within fifteen (15) calendar days from the LEO Director’s receipt of such motion. (n)

SECTION 6. Rendition of decision. The decision of the Commission shall resolve the issues on the basis of all the evidence on record and its own consideration of the law. The decision may include enforcement orders on the following:

a. an award of indemnity on matters affecting personal data protection, or rights of the data subject, where the indemnity amount to be awarded shall be determined based on the provisions of the Civil Code;
b. a permanent ban on the processing of personal data;
c. a recommendation to the Department of Justice for the prosecution and imposition of penalties specified in the DPA;
d. an order to conduct a sua sponte investigation under Rule X such as in cases when the responsible officer of a juridical entity must be determined for recommendation to the Department of Justice for prosecution;
e. an order to compel or petition any entity, government agency, or instrumentality to abide by its orders or take action on a matter affecting data privacy;
f. an imposition of fines for violations of the DPA or NPC issuances; or
g. any other order to enforce compliance with the DPA. (a)

SECTION 7. Motion for reconsideration on the decision issued by the Commission. The decision of the Commission shall become final and executory fifteen (15) calendar days from notice thereof with proof of service to the adverse party. One motion for reconsideration may be filed, which shall suspend the running of the period. Any appeal from the decision shall be to the proper courts, in accordance with law and the rules. (a)

SECTION 8. Entry of judgments and final orders. If no appeal or motion for reconsideration is filed within the time provided in these Rules, the judgment shall attain finality, and an entry of judgment shall be issued to the parties. The date when the judgment becomes executory shall be deemed as the date of its entry. The entry of judgment shall contain the dispositive portion of the judgment with a certificate that such judgment has become final and executory. (a)

RULE IX. BAN ON PROCESSING OF PERSONAL DATA

SECTION 1. Temporary ban on processing of personal data. Upon filing of the complaint or at any time before the decision of the Commission becomes final and executory, a complainant may apply for the imposition of a temporary ban on respondent’s processing of personal data through motion.

SECTION 2. Suspension of complaint proceedings. An application for a temporary ban on processing of personal data shall have the effect of suspending the complaint proceedings until such application has been finally resolved.

SECTION 3. Requisites for temporary ban. A temporary ban on processing of personal data may be granted only when:

it is necessary in order to preserve the rights of the complainant or to protect national security or public interest, or if it is necessary to preserve and protect the rights of data subjects;
the motion shows facts entitling the complainant to the relief demanded;
unless exempted from the payment of filing fees as provided for in these Rules, the complainant shall file with the NPC a bond in an amount to be fixed by the investigating officer executed in favor of the party or person so banned from processing personal data; and
the parties are heard in a summary hearing.

SECTION 4. Notice of summary hearing. Upon receipt of the motion, the investigating officer shall issue a notice of hearing to the parties. The notice to respondent shall include a copy of the receipt of the bond, if applicable.

The notice of hearing shall indicate the scheduled date and venue for the hearing, and a statement that respondent may appoint a duly authorized representative to appear at the hearing in order to protect its interests. The complainant shall shoulder the cost of personal service and ensure that the notice of hearing is received by respondent at least five (5) calendar days before the scheduled date. If personal service is impracticable, the notice of hearing shall be sent by complainant to respondent through private courier. Upon service, the complainant shall file with the investigating officer an affidavit of service attesting that service was properly made upon the respondent or respondents, as the case may be.

SECTION 5. Summary hearing. The summary hearing shall consist of the personal submission by the parties and their witnesses of their respective judicial affidavits in accordance with Sections 3 and 4 of A.M. No. 12-8-8-SC dated 4 September 2012 (Judicial Affidavit Rule).

The parties shall identify and mark as exhibit their documentary or object evidence. Should the parties or their witnesses desire to keep the original document or object evidence in their possession, after the same have been identified, compared with the original, marked as exhibit, and authenticated, they may state for the record that the copy or reproduction attached to the judicial affidavit is a faithful copy or reproduction of the original.

SECTION 6. Submission of position papers or other pleadings as alternative summary hearing. The investigating officer may, upon motion or in its discretion, compel the parties to submit simultaneous position papers in lieu of a summary hearing.

SECTION 7. Decision on the temporary ban. Within thirty (30) calendar days from the conclusion of the summary hearing, the investigating officer shall decide on the application for a temporary ban on processing of personal data.

SECTION 8. Duration of temporary ban. When issued, the temporary ban on processing of personal data shall remain in effect until the final resolution of the main case, or upon further orders by the Commission or other lawful authority.

SECTION 9. Permanent ban on processing of personal data. If, after the termination of the complaint proceedings, it appears that complainant is entitled to have a permanent ban on respondent’s processing of personal data, the investigating officer shall include in their Fact-Finding Report a recommendation to the Commission for the issuance of an order for a permanent ban on processing of personal data.

RULE X. SUA SPONTE INVESTIGATION

(Amended and renumbered pursuant to NPC Circular No. 2024-01)

SECTION 1. Commencement. The NPC, through the CID or a special committee or task force assigned for such purpose, may initiate an investigation on the circumstances surrounding a possible data privacy violation or data breach in cases of, but not exclusive to, matters that arose from pending cases before the NPC, including those that have resulted in a confirmed mediated settlement agreement, reports from the daily news, trends or academic studies, information gathered from corroborated and substantiated anonymous tips, or reports from other offices of the NPC or government agencies. (a)

SECTION 2. Temporary and permanent ban on processing of personal data. A temporary or permanent ban on processing of personal data may be imposed on the subject of a sua sponte investigation in order to protect national security or public interest, or if it is necessary to preserve and protect the rights of data subjects, in accordance with Rule IX of these Rules.

SECTION 3. Assignment of Investigating Officer or special committee or task force. The Commission may, when it deems proper, assign an Investigating Officer, or create a special committee or task force which shall be specifically assigned to conduct the investigation.

SECTION 4. Conduct of sua sponte investigation. The Investigating Officer or special committee or task force shall investigate the circumstances surrounding the privacy violation or data breach, subject to due process requirements under the law. Investigations may include on-site examination of systems and procedures. In the course of the investigation, the parties subject of the investigation may be required to furnish additional information, document, or evidence, or to produce additional witnesses, or to appear for an investigation hearing or clarificatory conference before the Investigating Officer, special committee, or taskforce, or the Commission, in accordance with Rule VIII, Section 1. (a)

SECTION 5. Request for case files during the conduct of a sua sponte investigation. Within fifteen (15) calendar days upon receipt of a request for case files by the parties-in-interest subject of the investigation, or their representative, legal heirs and assigns, or successors-in-interest, the CID shall release the requested case files to the requesting party. The representative shall be authorized by a special power of attorney. In case a party is a juridical person, the representative shall be authorized to appear and act on behalf of the juridical person by a Board Resolution contained in a duly notarized Secretary’s Certificate or its equivalent for a government agency⁹.

The requested case files may be in the form of a physical copy or an electronic copy. For physical copies, the same be in the form of a copy only or a certified true copy, at the option and cost of the requesting party. For electronic copies, the same be issued to the requesting party and duly protected by a password.

The requested case files shall include documents and communications between the requesting party and the NPC, together with its attachments. Documents that are internal in nature, such as, but not limited to, Technical Reports, Minutes of the Meeting, and Memorandum within the NPC, shall be excluded. Third-party reports and submissions shall also be excluded. (n)

SECTION 6. Sua Sponte Fact-Finding Report. Within thirty (30) calendar days from the termination of the investigation, the Investigating Officer or special committee or task force shall submit to the Commission a Fact-Finding Report, which shall include the results of the investigation, the evidence gathered, and any recommendations. In a sua sponte investigation, the Fact-Finding Report serves as the complaint, with the CID as the nominal complainant. (a)

SECTION 7. Order to comment. Upon receipt by the Commission of the Fact-Finding Report, the respondent identified after the conduct of the preceding investigation shall be provided a copy of the Fact-Finding Report and its annexes and given an opportunity to submit a comment or other pleadings, if necessary. In cases where the respondent or respondents fail without justification to submit a comment or appear before the NPC when so ordered, the Commission shall render its decision on the basis of available information under Rule VIII of these Rules. (a)

SECTION 8. Existence of a complaint during sua sponte investigation and vice versa, effect. If, during the proceedings of a sua sponte investigation, a formal complaint relating to the same act or omission for violation of the DPA is filed against the respondent, the complaint proceedings shall follow the normal procedure under these Rules: Provided, that the complaint proceedings shall not suspend the sua sponte proceedings, or vice versa: Provided further, that discovery and mediation proceedings under Rule V shall be available to the parties of the complaint proceedings: Provided finally, that a mediated settlement agreement shall only terminate the complaint proceedings but not the sua sponte investigation.

The preceding paragraph shall likewise apply if the complaint proceedings occurred first, and the NPC wishes to initiate a sua sponte investigation thereafter. (a)

RULE XI. BREACH INVESTIGATION

(Amended and renumbered pursuant to NPC Circular No. 2024-01)

SECTION 1. Procedure for data breach notification. The procedure for data breach notification and other requirements shall be governed by the DPA, its IRR, and NPC issuances pertaining to data breach management. These Rules shall apply in a suppletory character. (a)

SECTION 2. Receipt of data breach notifications. The CMD shall be the initial recipient of data breach notifications and shall immediately assign an Evaluating Officer to review the data breach notification. (a)

SECTION 3. Preliminary requests that shall be resolved by CMD. Upon receipt of the data breach notification, the Evaluating Officer shall recommend to resolve preliminary requests from the PIC or PIP for (a) extensions to notify data subjects or (b) extensions to file full breach report. The preliminary requests for extensions granted by the CMD shall be for a period of twenty (20) calendar days counted from the date of the request. (a)

SECTION 4. Preliminary requests and related Motions that must be endorsed to the Commission. The CMD shall endorse to the Commission the following requests from the PIC or PIP:

a. On notification of data subjects:
- i Request for exemption;
- ii Request for postponement;
- iii Request for extension beyond twenty (20) calendar days; or
- iv Request for use of alternative modes of notification.
b. On submission of full report:
- i Request for extension beyond twenty (20) calendar days; or
- ii Subsequent request for extension.
c. Other preliminary requests not covered by the preceding Section.
d. Motion for Reconsideration filed by the PIC or PIP on their preliminary request and other related pleadings.

The Commission may delegate to the CMD the resolution of Section 4 (a)(iii) and (b) as deemed necessary. (a)

SECTION 5. Initial breach notification evaluation and monitoring. The Evaluating Officer shall review the completeness of the data breach notification and determine the other documents needed to assess the PIC or PIP’s breach management. The PIC or PIP may be directed to submit additional documents through an order. (a)

Further, the CMD shall monitor the compliance of the PIC or PIP with the periods provided in the NPC issuances on data breach and the subsequent extensions allowed under the preceding sections. (a)

In case of non-compliance, the CMD may apply for a Cease-and-Desist Order in accordance with the NPC issuances pertaining to the matter. (n)

SECTION 6. Final breach notification evaluation. Upon receipt of all the documents required to assess the PIC or PIP’s breach management, the Evaluating Officer shall prepare a Breach Notification Evaluation Report based on information available on record. (a)

The report may contain a recommendation of a possible violation of the DPA arising from the breach matter and a recommendation for the imposition of administrative fines on other infractions. (n)

Upon the finding of a possible data privacy violation that requires further investigation, the CMD shall endorse the Final Breach Notification Evaluation Report to the Commission for the resolution of the breach case while endorsing the matter to the CID for further investigation for a possible data privacy violation. (a)

SECTION 7. Conduct of breach investigation. Upon receipt of the Final Breach Notification Evaluation Report, an Investigating Officer shall determine if there is a necessity to conduct an on-site or technical investigation. The Investigating Officer shall request proper authority from the NPC before conducting any on-site or technical investigation. The Investigating Officer may also request assistance from the technical personnel of the NPC. In the course of the investigation, the complainant and respondent may be required to furnish additional information, document, or evidence, or to produce additional witnesses. (a)

SECTION 8. Fact-Finding Report The Investigating Officer shall submit to the Commission a Fact-Finding Report within thirty (30) calendar days from the termination of the on-site or technical investigation or receipt of the Final Breach Notification Evaluation Report, whichever is applicable. (a)

SECTION 9. Order to comment. Upon receipt by the Commission of the Fact-Finding Report, the respondent identified after the conduct of the preceding investigation shall be provided with a copy of the Fact-Finding Report and its annexes and given an opportunity to submit a comment or other pleadings, if necessary. In cases where the respondent fails without justification to submit a comment or other pleadings, or appear before the NPC when so ordered, the Commission shall render its decision on the basis of available information under Rule VIII of these Rules. (a)

SECTION 10. Failure to submit breach notification. Should the NPC receive information that a possible data breach occurred, but the PIC or PIP did not submit any notification to the NPC, the CID may use this information to initiate a sua sponte investigation under Rule X. (a)

During the sua sponte investigation, if a breach notification is submitted by the PIC or PIP, the CID shall continue with its sua sponte investigation on violations of the DPA and NPC issuances for possible recommendations for prosecution with the Department of Justice or imposition of administrative fines. The CMD shall, for its part, evaluate the breach matter submitted and recommend the imposition of administrative fines, if warranted. (n)

SECTION 11. Post-breach monitoring and compliance. The CMD shall monitor compliance of PICs or PIPs with the orders and resolutions issued by the Commission during its evaluation of the data breach matter. (a)

The EnD shall ensure the enforcement and monitoring of compliance of all other judgments, resolutions, decisions, or orders issued by the Commission. (n)

RULE XII. COMPLIANCE CHECKS

(Rule added pursuant to NPC Circular No. 2024-01)

SECTION 1. Procedure for Compliance Checks. The procedure for Compliance Checks and other requirements shall be governed by the DPA, its IRR, and NPC issuances pertaining to Compliance Checks. These Rules shall apply in a suppletory character. (n)

SECTION 2. Conduct of Privacy Sweep. The CMD shall conduct a Privacy Sweep of all publicly available or accessible information, including, but not limited to websites, mobile applications, raffle coupons, brochures, privacy notices, social media pages or accounts, and physical or digital forms of a PIC or PIP. (n)

SECTION 3. On-the-spot Privacy Sweep. The CMD may also conduct on-the-spot Privacy Sweep on the premises, pop-up stores, kiosks, or stalls of a PIC or PIP where personal data is processed. The Privacy Sweep shall be limited to public areas and publicly available or accessible information. The CMD may verify the PIC or PIP’s compliance by examining all physical or digital forms, including, but not limited to data processing systems, logbooks, raffle coupons, brochures, and posters used in the PIC or PIP’s operations. (n)

SECTION 4. Issuance of Warning Letter or Notice of Documents Submission.

a. Warning Letter: when applicable – The CMD shall issue a Warning Letter in the following instances:
- i. If after a Privacy Sweep, the CMD discovers data privacy issues involving a PIC or PIP who has not yet registered or whose registration has expired in accordance with the relevant NPC Circular on Registration; or
- ii. If the CMD determines that the risk to the rights and freedoms of a data subject is present, and requires the PIC or PIP’s urgent and immediate action.
b. Notice of Documents Submission: when applicable – The CMD shall issue a Notice of Document Submission in the following instances:
- i. If after a Privacy Sweep, the CMD discovers that the PIC or PIP has failed to demonstrate substantial compliance with the DPA, its IRR, and other NPC issuances;
- ii. If the CMD requires additional information to fully determine the PIC or PIP’s level of compliance; or
- iii. If the CMD requires further verification to determine if the PIC or PIP has embedded data privacy policies and data protection measures in its operations. (n)

SECTION 5. Review and assessment of documents submitted by the PIC or PIP. The Evaluating Officer shall review the sufficiency of the documents submitted by the PIC or PIP and determine other documents necessary to assess the PIC or PIP’s compliance. The PIC or PIP may be directed to submit additional documents.

The CMD shall monitor all compliance of the PIC or PIP, including the submission within the periods provided in the NPC’s issuances on compliance checks and the subsequent extensions allowed under Section 6 of this Rule. (n)

SECTION 6. Request for extension that shall be resolved by CMD. If the PIC or the PIP requests for additional time to comply with the Warning Letter, Notice of Documents Submission, Deficiency Report, or other orders issued by the CMD, the CMD may grant the request: Provided, that the PIC or PIP shall submit a formal letter with a justification for the extension, signed by the Data Protection Officer (DPO) or head of the organization, requesting for additional time which shall not exceed a cumulative period of thirty (30) calendar days counted from the date of the initial request. In case of refusal of the request for extension, the CMD shall send the denial of the request for extension and order the PIC or PIP to submit the same immediately. (n)

SECTION 7. Failure of the PIC or PIP to comply with the Warning Letter. If the PIC or PIP fails to comply within seven (7) calendar days from receipt of the Warning Letter, the CMD shall order the PIC or PIP to show valid cause why it should not be subject to the NPC’s issuance on administrative fines and other actions that the Commission may deem proper to ensure compliance with the law. (n)

SECTION 8. Failure of the PIC or PIP to comply with the Notice of Documents Submission. If the PIC or PIP fails to comply within fifteen (15) calendar days from receipt of the Notice of Documents Submission, the CMD shall order the PIC or PIP to show valid cause why it should not be subject to the NPC’s issuance on administrative fines and other actions the Commission may deem proper to ensure compliance with the law. (n)

SECTION 9. Show cause order for non-compliance with the mandatory registration requirement of the NPC. If based on the findings in the Privacy Sweep conducted by the CMD, the PIC or PIP is subject to mandatory registration but has failed to register, the CMD shall issue a show cause order for non-registration directing the PIC or PIP to register its DPO and Data Processing Systems within five (5) calendar days from receipt of the order. Non-compliance with the show cause order may subject the PIC or PIP to administrative fines and other actions the Commission may deem proper to ensure compliance with the law. (n)

SECTION 10. Conduct of On-Site Visit (OSV). The CMD shall conduct an OSV to the PIC or PIP’s principal place of business or where personal data is processed in cases where there are persistent issues¹⁰ or substantial findings of non-compliance with the obligations indicated in the DPA and NPC issuances.

Authorized personnel of the NPC shall conduct a focused inspection on the relevant issues within the premises of a PIC or PIP that may include presentation of documents or records, visits to selected departments or units wherein processing of personal information are undertaken, taking of photos and videos for monitoring purposes, and interviews of relevant personnel tasked to handle personal information processed by the PIC or PIP subject to the Compliance Check.

The CMD may, in its discretion, directly conduct an OSV if it determines that the totality of circumstances warrant such action, taking into account the succeeding provision. (n)

SECTION 11. Considerations for the conduct of Compliance Checks. A PIC or PIP may be subject to a Compliance Check based on any of the following considerations:

a) Level of risk to the rights and freedoms of data subjects posed by personal data processing by a PIC or PIP;
b) Reports received by the NPC against the PIC or PIP, or its sector;
c) Non-registration of a PIC or PIP that is subject to the mandatory registration requirement as provided under NPC Circular on Registration of Data Processing System;
d) Unsecured or publicly available personal data found on the premises and on the internet that may be traced to a PIC or PIP;
e) Other considerations that indicate non-compliance with the DPA, IRR, or NPC issuances; and
f) When, in the discretion of the CMD, there is an urgent need to ensure the protection of voluminous personal data records and the same can only be done by actual physical inspection of said records within the PIC’s or PIP’s office premises.

In cases where the CID is investigating or commencing an investigation against a PIC or PIP undergoing or scheduled for a Compliance Check, the Compliance Check shall be held in abeyance and the investigation shall be given precedence until such investigation has been concluded or submitted further for adjudication. (n)

SECTION 12. Service of orders. The CMD shall send an order to a PIC or PIP on the conduct of a Compliance Check through the electronic mail address used at the time it registered with the NPC. Such order shall be deemed received on the next business day: Provided, for unregistered organizations, the order shall be sent to any publicly available email address that may be found on websites or other social media pages or accounts and it shall be addressed to the head of the organization.

A PIC or PIP shall take the necessary steps to ensure that its registered e-mail address is working and able to receive the order promptly. (n)

SECTION 13. Notice of On-Site Visit. A notice of OSV shall be issued by the CMD to the PIC or PIP at least five (5) days before such visit. The notice shall include a list of required documents to be submitted by the PIC or PIP at least three (3) days prior to the OSV.

The CMD shall present the physical copy of the notice and provide the list of authorized personnel of the NPC to conduct the OSV. The authorized NPC personnel shall wear their identification cards at all times. (n)

SECTION 14. Issuance of Deficiency Report. The CMD shall issue a Deficiency Report based on the determination from the OSV that there are existing gaps in the PIC or PIP’s compliance with the DPA, its IRR, and NPC issuances. (n)

SECTION 15. Issuance of Notice of Deficiencies. If the PIC or PIP fails to address the issues raised in a Deficiency Report or is determined to be non-compliant with the DPA, its IRR, and other issuances of the NPC after being subjected to any of the modes of Compliance Checks, the CMD shall issue the Notice of Deficiencies indicating the period of time within which to correct the identified deficiencies, which shall not be less than ten (10) days from receipt of the Notice. (n)

SECTION 16. Issuance of Compliance Order. The Commission shall issue a Compliance Order in any of the following instances:

a) After the lapse of the period provided in the Notice of Deficiencies and no action was taken by the PIC or PIP to correct the identified deficiencies;
b) After the lapse of the period provided in the Notice of Deficiencies and such identified deficiencies persist;

If the persistence of the deficiencies is due to the considerable period of time or resources needed to implement the necessary remediation measures, the timeline to complete such measures, as approved by the Commission, shall be embodied in a Compliance Order;
c) In the course of the conduct of an OSV, the PIC or PIP refuses or fails to provide access to premises, records or prevents the conduct of the inspection; or
d) In the course of the conduct of the on-the-spot Privacy Sweep, the PIC or PIP refuses or prevents the conduct of the inspection on otherwise publicly available areas or information.

Compliance Orders shall state the deficiencies remaining or actions to be taken, the period within which to undertake the corrections ordered by the Commission, and the period to report such actions. (n)

SECTION 17. Issuance of other orders. The Commission, through the CMD, may issue pertinent orders in connection with the conduct or furtherance of a Compliance Check or the assessment of any PIC or PIP’s compliance with any orders in relation thereto. (n)

SECTION 18. Refusal to undergo Compliance Check. A PIC or PIP who, without good reason and despite due notice, refuses or prevents the CMD from performing a Compliance Check may be subject to appropriate penalties and sanctions as may be allowed by law. In case of refusal, the following provisions shall govern:

A. Action to be taken upon refusal or failure to comply with documents submission. Refusal or failure to submit the requested documents or policies within the period stated in the notice or order shall subject a PIC or PIP to an OSV from the CMD, enforcement actions, and imposition of fines in accordance with the NPC’s issuance on administrative fines and other actions the Commission may deem proper to ensure compliance with the law.
B. Action to be taken upon refusal or failure to provide access to premises or records during an OSV and on-the-spot Privacy Sweep. Refusal or failure to provide access to premises or records during an OSV and on-the-spot Privacy Sweep shall subject a PIC or PIP to a Compliance Order, enforcement actions, and imposition of fines in accordance with the NPC’s issuance on administrative fines and other actions the Commission may deem proper to ensure compliance with the law.
C. Failure or refusal to provide an explanation to Compliance Orders. Refusal or failure to submit an explanation to the order cited in the preceding paragraphs, or if the explanation does not present a compelling reason to justify such refusal or failure, may subject a PIC or PIP to contempt proceedings, as may be permitted by law, before the appropriate court, or such other actions as may be available to the Commission. (n)

SECTION 19. Certificate of No Significant Findings. The CMD shall issue a Certificate of No Significant Findings to a PIC or PIP that has undergone document submission or an OSV, where no substantial deficiencies were found, or the deficiencies identified in the Deficiency Report or Notice of Deficiencies have already been addressed to the satisfaction of the NPC.

The issuance of this certificate is without prejudice to any other recommendation being made by the CMD for the improvement of the PIC or PIP’s compliance with the DPA, IRR, and NPC issuances. The issuance of this certificate does not bar an investigation for any possible liability arising from complaints and/or personal data breaches filed before the NPC. (n)

RULE XIII. MISCELLANEOUS PROVISIONS

(Amended and renumbered pursuant to NPC Circular No. 2024-01)

SECTION 1. Transitory provision. These Rules shall apply to all complaints filed after its effectivity. It shall also apply to pending proceedings, except to the extent that their application would not be feasible or would work injustice.

SECTION 2. Procedure for Cease-and-Desist Orders. Procedure for the issuance of Cease-and-Desist Orders shall be governed by NPC issuances pertaining to the matter. (a)

SECTION 3. Procedure for breach notification. Procedure for data breach notification to the Commission shall be governed by the NPC issuances pertaining to the matter. (n)

SECTION 4. Request for case files. Copies of the case files may be requested by any party to the complaint or their authorized representative, lawful heirs, and assigns, in accordance with Section 17 of the DPA, or successors-in-interest, by filling-out the request form before the General Records Unit of the NPC. The request for case files may be in the form of a physical copy or an electronic copy, at the option and cost of the requesting party. Provided, that the representative is authorized by a special power of attorney. Provided further, that in case where a party is a juridical person, the representative is authorized by a Board Resolution contained in a duly notarized Secretary’s Certificate or its equivalent for a government agency¹¹. Provided finally, that in case where the files are requested by the heirs, assigns, or successors-in-interest, proof of authority or relationship must be presented. (n)

SECTION 5. Procedure for requests for advisory opinion. Procedure for requests for advisory opinion shall be governed by NPC issuances pertaining to the matter. (a)

SECTION 6. Procedure for enforcement of administrative fines. Procedure for the enforcement of administrative fines shall be governed by NPC issuances pertaining to the matter. (n)

SECTION 7. Procedure for videoconferencing technology. Procedure for the use of videoconferencing technology for the remote appearance and testimony of parties before the NPC shall be governed by NPC issuances pertaining to the matter. Notwithstanding any provision of these Rules, the conduct of preliminary conferences, summary hearings, mediation conferences, investigations, clarificatory hearings, and all other hearings may be conducted through videoconferencing technology at the discretion of the concerned division or Commission. (a)

SECTION 8. Repealing clause. NPC Circulars No. 2016-04 and 2018-03 are hereby repealed. All other issuances by the Commission which are contrary to the provisions of these Rules are also hereby repealed or amended accordingly.

SECTION 9. Amendments. These Rules or any of its portion may be amended or supplemented by the Commission.

SECTION 10. Application of Rules of Court. The Rules of Court shall apply in a suppletory character and whenever practicable and convenient.

SECTION 11. Effectivity. These Rules shall take effect fifteen (15) days after publication in a newspaper of general circulation.

Legend:

Code	Meaning
(a)	Amended provision
(n)	New provision

Source

Official source PDF: https://privacy.gov.ph/wp-content/uploads/2024/03/2021-Rules-of-Procedure-of-the-NPC-As-Amended.pdf
Original 2021 rules: 2021 Rules of Procedure of the National Privacy Commission (Original 2021 Version)
Amendment circular: NPC Circular No. 2024-01
OCR used during extraction: no

Version Note

This page contains the complete consolidated text of the 2021 NPC Rules of Procedure, as amended by NPC Circular No. 2024-01. For the original text, see 2021 Rules of Procedure of the National Privacy Commission (Original 2021 Version).

Rules on Electronic Evidence, A.M. No. 01-7-01-SC, Rule 2, § 1(e) [July 17, 2001]. ↩
Id. Rule 2, § 1(h). ↩
An Act to Ordain and Institute the Civil Code of the Philippines, [CIVIL CODE OF THE PHILIPPINES], Republic Act No. 386, Art. 44 (1949). ↩
2019 Amendments to the 1997 Rules of Civil Procedure (A.M. No. 19-10-20-SC), [RULES OF COURT], Rule 3, § 2 (May 1, 2020). ↩
An Act to Establish Periods of Prescription for Violations Penalized by Special Acts and Municipal Ordinances and to Provide when Prescription shall begin to Run, Act No. 3326. (1926) ↩
This includes a department, bureau, office, instrumentality, government-owned or controlled corporation, local government, state university and college, or a distinct unit in it. ↩
RULES OF COURT, Rule 3, § 8. ↩
This includes a department, bureau, office, instrumentality, government-owned or controlled corporation, local government, state university and college, or a distinct unit in it. ↩
This includes a department, bureau, office, instrumentality, government-owned or controlled corporation, local government, state university and college, or a distinct unit in it. ↩
Persistent issues pertain to the inadequate implementation of security measures to address the heightened risk to the rights and freedoms of data subjects. ↩
This includes a department, bureau, office, instrumentality, government-owned or controlled corporation, local government, state university and college, or a distinct unit in it. ↩

NPC Issuance Wiki

Corpus

2021 Rules of Procedure of the NPC, as Amended (Current Version)

Issuance Text

RULE I. GENERAL PROVISIONS

RULE II. COMPLAINTS

RULE III. FILING AND SERVICE

RULE IV. PRE-INVESTIGATION PHASE

RULE V. PRELIMINARY CONFERENCE

RULE VI. ALTERNATIVE DISPUTE RESOLUTION

RULE VII. INVESTIGATION PHASE

RULE VIII. DECISION

RULE IX. BAN ON PROCESSING OF PERSONAL DATA

RULE X. SUA SPONTE INVESTIGATION

RULE XI. BREACH INVESTIGATION

RULE XII. COMPLIANCE CHECKS

RULE XIII. MISCELLANEOUS PROVISIONS

Source

Version Note

Table of Contents

Backlinks

NPC Issuance Wiki

Corpus

2021 Rules of Procedure of the NPC, as Amended (Current Version)

Issuance Text

RULE I. GENERAL PROVISIONS

RULE II. COMPLAINTS

RULE III. FILING AND SERVICE

RULE IV. PRE-INVESTIGATION PHASE

RULE V. PRELIMINARY CONFERENCE

RULE VI. ALTERNATIVE DISPUTE RESOLUTION

RULE VII. INVESTIGATION PHASE

RULE VIII. DECISION

RULE IX. BAN ON PROCESSING OF PERSONAL DATA

RULE X. SUA SPONTE INVESTIGATION

RULE XI. BREACH INVESTIGATION

RULE XII. COMPLIANCE CHECKS

RULE XIII. MISCELLANEOUS PROVISIONS

Source

Version Note

Footnotes

Table of Contents

Backlinks