In more detail
The Circular applies to all PICs and PIPs that will seek certification under the PPM Certification Program.
Originally launched in 2021, the PPM Certification Program is a voluntary program that aims to increase trust and confidence in organizations engaged in the processing of personal data, as the Privacy Mark offers the highest level of assurance on data privacy compliance and secure cross-border data transfers.1 It will also enable organizations to reduce risks and demonstrate data privacy compliance. The Privacy Mark helps data subjects identify organizations they can entrust their personal data with.2
The certification process will evaluate an organization's demonstration of operational compliance with the Data Privacy Act through risk management and assess an organization's demonstration of having the proper security measures to ensure data protection.
Prerequisites for PICs or PIPs
Prior to applying for certification under the PPM Certification Program, a PIC or PIP must be certified with the following standards:
ISO/IEC 27001 - information security management system (ISMS): specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system within the context of the organization
ISO/IEC 27701 – privacy information management system (PIMS): specifies the requirements and guides for establishing, implementing, maintaining, and continually improving a PIMS in the form of an extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy management within the context of the organization
Failure to comply with the prerequisites shall result in disqualification to apply for certification under the PPM Certification Program.
The NPC will soon release additional guidelines pertaining to the certification scheme.
Recommended action
Clients interested to apply for certification under the PPM Certification Program are advised to first meet the ISO requirements. The NPC Privacy Mark is recommended for organizations with public-facing data processing systems and those processing large volumes of sensitive personal information.
Please feel free to reach out to Quisumbing Torres' Intellectual Property, Data, and Technology Practice Group for assistance or for further information on the Circular.
1 See https://privacy.gov.ph/npc-launches-ph-privacy-trust-mark-to-add-value-to-business-boost-trust-in-cross-border-data-transfers/.
2 Id.
* * * * *
Please contact QTInfoDesk@quisumbingtorres.com for inquiries.
VISIT QUISUMBING TORRES SITE
