NPC Orders Unregistered Businesses Processing Personal Data to Comply with the Commission
The National Privacy Commission (NPC) firmly announced that businesses processing personal data to register their Data Protection Officers (DPOs) and Data Processing Systems (DPS). This mandate, outlined in the released circular, affects various organizations operating within the country, subject to certain criteria set forth by the Commission.
Below are the requirements detailed in NPC Circular No. 2022-04.
Key Requirements:
- Scope of Registration:
- Private organizations employing at least 250 individuals.
- Private organizations processing sensitive personal information of at least 1,000 individuals.
- Private entities that process data that will likely pose a risk to the rights and freedoms of data subjects.
- Registration Timeline:
- All covered entities must register their DPOs and DPS within 180 days of the effectivity of NPC Circular 2022-04. .
- All covered entities shall register their newly implemented DPS in the NPC Registration System within twenty (20) days from commencement of such system or the effectivity of such appointment.
- Requirements for Compliance:
- Displaying the NPC Seal of Registration on business premises and online platforms is required.
- Providing detailed information about data processing activities and security measures implemented to protect personal data through the online NPC Registration System (NPC RS).
- Purpose of the Regulation:
- Ensure accountability and transparency in the processing of personal data.
- Enhance the protection of personal data against breaches and misuse.
The NPC has stressed that non-compliance will incur significant penalties. Organizations are strongly urged to comply to avoid legal repercussions and ensure alignment with the Data Privacy Act of 2012. NPC registration can be completed on the commission’s official platform, requiring details about data processing systems and the appointed DPO.
