Employee Data Protection In Philippines

All questions

Data protection

i Requirements for registration

The collection and processing of personal information, including employee data, is governed by the Data Privacy Act of 2012. Data privacy regulations are implemented by the National Privacy Commission (NPC).

An employer is a personal information controller under the Data Privacy Act when it is involved in controlling the collection, holding, processing and use of the information of its employees. It is required to implement 'reasonable and appropriate organizational, physical, and technical security measures for the protection of personal data'. Employers must register with the NPC if any of the following conditions are met: it employs at least 250 employees; the processing includes sensitive personal information (as defined in subsection iii, below) of at least 1,000 individuals; the processing is likely to pose a risk to the rights and freedoms of data subjects; or the processing is