At the time of writing, however, please note that the NPC has not published any guidance on the process for submission of the sworn declaration. We will provide a separate update once the same has been released by the NPC.

Registration procedure

Covered PICs and PIPs are required to register their respective DPO and existing DPS within 180 days from the effectivity of the Circular, or until 10 July 2023, via the NPCRS. On the other hand, DPS that have yet to operate before said date are required to be registered within 20 days from the commencement of such system. The registration will be valid for a period of one year from the date of issuance of the certificate of registration and must be renewed 30 days before the date of expiration.

Under the Circular, the following information must be submitted via the NPCRS:

1. Details of the PIC or PIP, head of agency or organization, and the DPO (including the documentary requirements mentioned in the Circular)
2. Brief description of each DPS:
   • Name of the system
   • Lawful basis for the processing of personal data
   • Purpose or purposes of the processing
   • Whether processing is being performed as a PIC or PIP (if an organization uses the same system as a PIC and as a PIP, then it must register such usage separately)
   • Whether the system is outsourced or subcontracted, and if so, the name and contact details of the PIP
   • Description of the category or categories of data subjects and their personal data or categories thereof
   • Recipients or categories of recipients to whom the personal data might be disclosed
   • Description of security measures
   • General information on the data life cycle (i.e., time, manner, or mode of collection, retention period, and disposal/destruction/deletion procedure)
   • Whether personal data is transferred outside of the Philippines
   • Existence of data sharing agreements with other parties
3. All publicly facing online mobile or web-based applications, including internal apps with PIC or PIP employees as clients
4. Notification regarding any automated decision-making operation or profiling
   • Lawful basis for the processing of personal data
     1. Other relevant information pertaining to the specified lawful basis specifying the specific law or regulation, among others
     2. If consent is used as the basis for processing, the PIC or PIP must submit either: (a) the consent form used; or (ii) other manner of obtaining consent.
   • Retention period for the processed personal data
   • Methods and logic utilized for automated processing
   • Possible decisions relating to the data subject based on the processed data, particularly if the decisions would significantly affect the data subject’s rights and freedoms

At the time of writing, however, please note that the NPCRS is not yet available to the public. We will provide a separate update once the same has been launched by the NPC.

Seal of registration

In addition to the certificate of registration, the NPC will also issue a downloadable seal of registration. Under the Circular, PICs and PIPs who receive such seal are required to display the same at the main entrance of their place of business, office, or at the most conspicuous place to ensure visibility to all data subjects.

Moreover, the NPC requires that the seal be displayed on the PIC’s or PIP’s main website, or at least the webpage specifically pertaining to the Philippines for global websites, and only as either: (i) a clickable link leading to the privacy notice; or (ii) displayed directly on the privacy notice page.

As of writing, however, please note that the NPC has not revealed to the public the actual seal of registration. We will provide a separate update once the same has been released by the NPC.

Enforcement and penalties

The NPC may impose administrative penalties on PICs and PIPs covered by the requirements under the Circular but fail to comply with the same. Penalties include compliance and enforcement orders, cease and desist orders, temporary or permanent bans on the processing of personal data, or payment of administrative fines.

Recommended actions

Clients are advised to evaluate their current data processing activities to determine whether they are covered by the requirement to register or to submit a sworn declaration with the NPC. Clients covered by the registration requirement are strongly encouraged to prepare for the registration of their respective DPO and DPS by preparing the information and documents listed above while waiting for the launch of the NPCRS. On the other hand, clients covered by the Circular but are not subject to the mandatory registration requirement are advised to further monitor developments to be issued by the NPC about the submission of the required sworn declaration.

Clients are likewise encouraged to stay tuned to further updates from the NPC on its implementation of the Circular. Our Firm is closely monitoring developments on this important compliance matter and will provide more updates as soon as they arise.