Philippines: Latest eRehistro updates from the National Privacy Commission

In brief

The Philippine National Privacy Commission (NPC) released on its official Facebook page two announcements regarding the soon-to-be launched eRehistro system. The NPC announced: (1) the system's process and requirements for account creation, data processing systems (DPS) inventory; and (2) the amendment of registration information for covered personal information controllers (PIC) and personal information processors (PIP).


Contents

Recommended actions

While we monitor further NPC announcements on the launch date and formal guidelines of eRehistro, we continue to encourage covered PICs and PIPs to commence preparing, reviewing and updating their compliance and registration information for both Phase 1: Data Protection Officer (DPO) renewal of registration, and Phase 2: Data Processing System (DPS) registration.

We also recommend that clients keep themselves updated of further developments from the NPC, either through the NPC’s website or its social media channels. For additional guidance on the various announcements made by the NPC on the eRehistro system, you may refer to our previous alerts in the following links:

Our firm will provide more updates in due course.

In more detail

Overview of eRehistro account creation and DPS registration

The creation of an eRehistro account involves a two-step process: (1) uploading a duly accomplished and notarized eRehistro form; and (2) registering all of the PIC or PIP’s DPS -- both of which should be done once the eRehistro system is available to the public.

In the meantime, the NPC recommends conducting a DPS inventory by completing the following information:

  • name of the DPS
  • type of DPS (i.e., paper-based, manual, electronic/automatic, or both)
  • purpose(s) of the DPS
  • whether the registrant is a PIC or PIP
  • whether the DPS involves automated decision-making
  • whether data processing is outsourced or subcontracted
  • categories of the data subject and personal data involved
  • number of staff in the PIC or PIP’s data protection office
  • number of individuals to whom the personal data will be or may be disclosed
  • whether personal data will be transferred outside the Philippines

Amendment of registration information

Amendments or updates to a PIC or PIP’s registration information may likewise be made using the eRehistro system. Under current NPC regulations, amendments or updates to a covered PIC or PIP's registration information should be made within two (2) months from the date of effectivity of the change.1

Specifically, an amendment or updating of registration information is required if it involves any of the following information:

  • name or contact details of the PIC or PIP
  • name or contact details of the head of the agency or organization
  • name or contact details of the DPO

Prior to the availability of the eRehistro system, the covered PIC or PIP should send by email any amendment or update on its registration information to dpo.registration@privacy.gov.ph, which submission will be validated by the NPC within three to seven days.


1 See Section 15, NPC Circular No. 17-01.

 

LOGO Philippines_QuisumbingTorres_Manila

*Authored by Quisumbing Torres, a member firm of Baker & McKenzie International, a Swiss Verein. Please contact QTInfoDesk@quisumbingtorres.com for inquiries.

VISIT QUISUMBING TORRES SITE

Contact Information

© 2021 Baker & McKenzie. Ownership: This site (Site) is a proprietary resource owned exclusively by Baker McKenzie (meaning Baker & McKenzie International and its member firms, including Baker & McKenzie LLP). Use of this site does not of itself create a contractual relationship, nor any attorney/client relationship, between Baker McKenzie and any person. Non-reliance and exclusion: All information on this Site is of general comment and for informational purposes only and may not reflect the most current legal and regulatory developments. All summaries of the laws, regulation and practice are subject to change. The information on this Site is not offered as legal or any other advice on any particular matter, whether it be legal, procedural or otherwise. It is not intended to be a substitute for reference to (and compliance with) the detailed provisions of applicable laws, rules, regulations or forms. Legal advice should always be sought before taking any action or refraining from taking any action based on any information provided in this Site. Baker McKenzie, the editors and the contributing authors do not guarantee the accuracy of the contents and expressly disclaim any and all liability to any person in respect of the consequences of anything done or permitted to be done or omitted to be done wholly or partly in reliance upon the whole or any part of the contents of this Site. Attorney Advertising: This Site may qualify as “Attorney Advertising” requiring notice in some jurisdictions. To the extent that this Site may qualify as Attorney Advertising, PRIOR RESULTS DO NOT GUARANTEE A SIMILAR OUTCOME. All rights reserved. The content of the this Site is protected under international copyright conventions. Reproduction of the content of this Site without express written authorization is strictly prohibited.