Philippines Data Privacy Act and DPO Training

Opens with a readiness check: what personal data you hold, why, who sees it, and who decides on notifying the National Privacy Commission. Walks through the October 2019 order stopping 26 online lending apps from processing data after contact-list shaming, and the September 2023 PhilHealth ransomware attack, with the Commission's notice to explain, on-site investigation and 13 to 20 million members affected. Turns them into three questions on purpose, provable controls and 72-hour breach reporting. Introduces CDE Customer Care, a worked example of a Makati BPO with about 1,800 staff acting as both personal information controller and processor. Contrasts a paper DPO with an involved one, explains section 21 accountability, follows a week of DPO work, sets out the four practice exercises and final exam, and clears away four common myths about privacy compliance.

What you will be able to do

• Explain what the lending app and PhilHealth cases show about the NPC's expectations
• Describe how section 21 accountability leads to the role of the data protection officer
• Distinguish when a BPO acts as personal information controller and when as processor

Why it matters

Shows DPOs and compliance officers what the NPC expects in practice, so the work produces evidence, not paper compliance that fails at the first question.

Practice: Practice: Why privacy work matters, and the DPO's role · 3 questions

Starts with a CDE Customer Care manager who says Philippine law cannot apply to Australian insurance members' data, and the DPO's answer that the security duty stays. Covers Republic Act 10173, approved on 15 August 2012, its section 2 policy and the section 38 rule that doubts favour the data subject. Explains the four layers a DPO reads: the Act, the 2016 implementing rules as amended, NPC circulars such as Circular 20-03 on data sharing, and advisories and decisions. Describes the National Privacy Commission's structure and powers, the section 4 and section 6 reach, and the special cases, including foreign residents' data processed in the Philippines. Applies them in a role table for CDE's bank, insurer, retailer and staff data. Defines personal, sensitive personal and privileged information, controller, processor and six more terms, and corrects the BPO myth that processors carry no duties.

What you will be able to do

• Identify the four layers of Philippine privacy rules a DPO must read before answering
• Assess whether a special case applies to foreign residents' data and what duties remain
• Classify personal, sensitive personal and privileged information, including age and civil status

Why it matters

Lets DPOs and BPO managers decide which rules apply to each client programme and record why, instead of trusting the myth that processors have no duties.

Practice: Practice: The law, its reach and its key terms · 3 questions

Begins with CDE Customer Care choosing its first DPO and rejecting the IT manager, who would review his own decisions. Explains that every controller and processor must designate a DPO or compliance officer, under the implementing rules, the March 2017 advisory and the December 2022 registration circular. Covers expertise and reliability, a full-time or organic post, fixed terms of at least two years, one DPO per organisation and a dedicated e-mail address. Defines independence and conflict of interest, then groups the duties into monitoring compliance, privacy impact assessments, rights and complaints, and breach management and awareness, prioritised by risk. Describes compliance officers for privacy in branches or related companies, what the organisation owes its DPO, protection from penalty, outsourcing limits and published contact details. Ends with CDE's one-page designation record and three checks that the role is real.

What you will be able to do

• Assess whether a proposed DPO has a conflict of interest under the NPC advisory
• Describe the four groups of DPO duties and how a compliance officer for privacy differs
• List what the organisation must give its DPO, from resources to published contact details

Why it matters

Helps management set up a DPO role that is independent, resourced and involved early, the first thing the NPC, auditors and clients check.

Practice: Practice: The DPO and the compliance officer · 3 questions

Opens with CDE Customer Care's recruitment team wanting to reuse staff ID photos in a brochure, a new purpose needing its own basis. Covers the three section 11 principles and the implementing rules on collection, accuracy, retention, secure disposal and further processing for statistical or research use. A Dubai food delivery app with a Manila support team shows that consent does not make excessive collection lawful. Sets out the section 12 criteria for personal information, from consent and contract to legitimate interest, and the section 13 prohibition and exceptions for sensitive and privileged information. Explains consent under Circular 2023-04, effective 29 November 2023, and the purpose, necessity and balancing tests of Circular 2023-07 on legitimate interest. Builds CDE's lawful-basis register for payroll, CCTV, recruitment and a newsletter, corrects a Singapore employer's blanket consent form, and sets a practice exercise building a lawful-basis register.

What you will be able to do

• Apply transparency, legitimate purpose and proportionality to a proposed processing activity
• Choose the correct section 12 criterion or section 13 exception for each activity
• Document a legitimate interest assessment using the purpose, necessity and balancing tests

Why it matters

Lets the DPO show the NPC a lawful basis for every activity, avoiding blanket consent forms whose records contradict how data is really used.

Practice: Practice: Principles and lawful processing · 3 questions

At CDE Customer Care, an agent e-mails a caller's account data without checking identity or routing the request to the bank as controller. Explains the right to be informed and what a notice must contain, and uses a London company's twelve-page notice to show why a layered notice in clear and plain language works better. Covers the right to object and its three exceptions, the eight kinds of information under the section 16 right of access, rectification, erasure or blocking, portability, damages, and rights of heirs. Sets out the narrow limits for research and investigations, automated decisions and notifying the Commission, and verification that is neither too weak nor too strict. Builds a rights procedure, notes the January 2021 advisory and the September 2026 draft circular, walks through CDE's rights log and ends with a practice exercise on access and erasure requests.

What you will be able to do

• Write a layered privacy notice that covers every required item in clear and plain language
• Explain each data subject right under the Act and the narrow limits that apply to it
• Handle an access or erasure request as controller or as processor, with proportionate verification

Why it matters

Prepares DPOs and contact centre teams to answer rights requests correctly and safely, so a request never becomes a breach or a complaint to the NPC.

Practice: Practice: Privacy notices and data subject rights · 3 questions

Opens with a CDE Customer Care team lead sending holiday overflow chats to a partner agency on a shared login without the retailer's agreement. Explains accountability under the Act and section 20, then section 14 outsourcing, choosing processors that can show sufficient security measures, and the contract clauses the implementing rules list, from location and documented instructions to audits, deletion of copies and no new processor without prior instruction. The DPO reviews the Australian insurer's contract and closes four gaps. Covers subcontractors in four steps, when a processor must speak up, including a Sydney client asking for full card numbers in a spreadsheet, and CDE's third-party register. Distinguishes outsourcing from data sharing, sets out data sharing agreements under Circular 20-03 of December 2020, transfers abroad resting on the contract, foreign residents' data, and the mistake of filing a contract nobody in operations runs.

What you will be able to do

• Review an outsourcing contract against the clauses the implementing rules require
• Distinguish outsourcing from data sharing and apply Circular 20-03 to a sharing arrangement
• Control subcontractors through prior instruction, assessment, flow-down terms and oversight

Why it matters

Helps BPOs and their clients keep control of personal data passed to third parties, close contract gaps before a client audit finds them, and win trust.

Practice: Practice: Outsourcing, data sharing and transfers · 3 questions

Opens with the Australian insurer's auditors asking CDE Customer Care for a record of processing that turns out to be two years old. Sets out the general obligations of Circular 2023-06, dated 1 December 2023: register the DPO and systems, keep an inventory, run privacy impact assessments, build a programme and train staff. Describes the three building blocks of leadership, a control framework and ongoing oversight, and how CDE assigns owners so the DPO avoids a conflict of interest. Covers data protection policies, the contents of a record of processing activities and a sample entry for the insurer's claims work, and why one current record serves registration, assessments, rights requests and breaches. Explains people controls and the acceptable use policy, required procedures, privacy by design and by default, retention schedules and a monthly, quarterly and yearly oversight rhythm, and warns against a Toronto firm's renamed policy pack.

What you will be able to do

• Describe the general obligations of NPC Circular 2023-06 and the three programme blocks
• Write a record of processing activities entry with purpose, data, flow, retention and security
• Set an oversight rhythm that keeps policies and records true to the real work

Why it matters

Gives the DPO a programme whose records match reality, so client auditors and the NPC get current answers within the day instead of outdated spreadsheets.

Practice: Practice: Privacy programme and records · 3 questions

Begins with a screen recording tool for the bank's card line at CDE Customer Care, which would have captured card numbers for every reviewer to see. Explains where the PIA duty comes from in Circular 2023-06, the DPO advisory and the breach management circular, and that the assessment must be available to the Commission on request. Lists the triggers, from new vendors and off-the-shelf software to profiling and cloud moves, and who contributes. Sets out the five parts the circular asks for and an eight-step method, then six harms to data subjects, from identity fraud to harassment. Shows CDE's chosen likelihood and impact scale, the data flow map for the recording tool and a scored extract, with masking, 30-day deletion and a controlled QA room. Covers sign-off, review, a Sydney insurer's fraud-scoring chatbot, a Mumbai company's after-launch PIA, and a practice exercise on a recruitment portal.

What you will be able to do

• Identify the triggers that require a privacy impact assessment before a system goes live
• Map a data flow and score risks to data subjects for likelihood and impact
• Plan controls with owners and dates, and record management sign-off of residual risk

Why it matters

Lets the DPO find and fix privacy problems before launch, when changes are cheap, and show the NPC or a client that risks were managed in time.

Practice: Practice: Privacy impact assessment · 3 questions

Begins with a collections supervisor losing an unencrypted USB drive of cardholder balances, and how CDE Customer Care now prevents it. Explains the section 20 duty to implement reasonable and appropriate organisational, physical and technical measures, and the factors that size them. Walks through the physical measures, from controlled rooms to electronic media rules, and the technical measures, including monitoring, restoration, testing and encryption, which also matters when the Commission considers exemption from notifying data subjects. Covers Circular 2023-06 on access control, security clearances, multi-factor authentication, device and USB restrictions, secure e-mail, the ban on fax, continuity plans, telecommuting, secure disposal and security logs, threat monitoring and acceptance of independent verification such as ISO 27001. Shows CDE's monthly control check, a Singapore client's evidence request answered through an ISO 27001 system, the records security leaves behind, and the mistake of protecting client data but not staff HR files.

What you will be able to do

• Distinguish the organisational, physical and technical measures the implementing rules require
• Check an organisation's controls against the specific requirements of NPC Circular 2023-06
• Keep security records, such as access reviews and restore tests, that show controls work

Why it matters

Helps DPOs and IT teams show the NPC and client auditors specific, tested security controls, and avoid breaches like an unencrypted drive or exposed HR files.

Practice: Practice: Security measures under the NPC circular · 3 questions

Starts with an Ortigas BPO that grows from 180 to 400 staff without registering, until a client asks for its certificate and seal. Explains who must register under Circular 2022-04, dated 5 December 2022: organisations with 250 or more employees, those processing sensitive personal information of 1,000 or more people, likely-risk processing, and every system with automated decision-making or profiling. Covers what is registered, the 20-day, 10-day and 30-day clocks, one-year validity and the renewal window, the four registration steps through the online system, and what the certificate and seal mean. Addresses foreign organisations with a Philippine office, using a Hong Kong firm's Manila branch, then automated decision notification and sanctions, including fines of 50,000 to 200,000 pesos for failing to register or update. Ends with the yearly incident summary and Advisory 18-01 templates, CDE's one-page registration file and four triggers that keep registration current.

What you will be able to do

• Assess whether an organisation must register with the NPC under Circular 2022-04
• Plan registration updates within the 20, 10 and 30-day deadlines and the renewal window
• Prepare the yearly summary of security incidents and personal data breaches for the NPC

Why it matters

Keeps the organisation's NPC registration and seal current as it grows, avoiding fines and orders and answering client due diligence before it is asked.

Practice: Practice: Registration and reporting to the NPC · 3 questions

Opens with a CDE Customer Care payroll officer e-mailing a whole department's payslips to the department list, and contrasts a slow and a fast response. Defines a security incident and a personal data breach, with availability, integrity and confidentiality breaches. Covers the incident management policy, a breach response team with someone who can decide at once, yearly review and preventive measures. Walks through the response procedure, then the three conditions that require notification and the factors weighed, including 100 or more individuals. Sets out notice to the Commission within 72 hours, the full report within five days, notice to data subjects, exemption and postponement requests, and Advisory 2026-02 of May 2026 on conflicting requests. Explains that processors report to controllers, revisits the PhilHealth investigation of September 2023, follows CDE's payslip timeline, covers documentation and the section 30 offence of concealment, and sets a breach assessment exercise.

What you will be able to do

• Distinguish a security incident from a personal data breach and its three types
• Assess whether a breach meets the three conditions that require notification to the NPC
• Build a notification timeline that meets the 72-hour and five-day deadlines

Why it matters

Prepares DPOs and response teams to decide and notify on time, meeting NPC deadlines and avoiding the criminal offence of concealing a breach.

Practice: Practice: Security incidents and personal data breaches · 3 questions

Returns to the October 2019 ban on 26 lending apps whose operators did not appear before the Commission. Sets out the Commission's powers, from investigations and cease and desist orders to bans, fines, indemnity and referral to the Department of Justice. Covers the criminal penalties for unauthorised processing, negligent access and unauthorised purposes, liability of responsible officers under section 34 and the maximum penalty under section 35 where 100 or more people are affected. Explains administrative fines under Circular 2022-01, from a percentage of annual gross income to a five million peso cap, and indemnity for data subjects. Shows how to prepare for a compliance check and handle a complaint, then joins it all up with a Philippine e-wallet client at CDE Customer Care, the DPO's yearly calendar, a 90-day plan for a new DPO, five quarterly measures and the final exam.

What you will be able to do

• Explain the NPC's enforcement powers, criminal penalties and administrative fine ranges
• Prepare a compliance check file and respond to a data subject complaint on time
• Plan a DPO's yearly calendar and first 90 days in the role

Why it matters

Lets a DPO run privacy as a steady programme, ready for an NPC compliance check or complaint, and gives management five numbers to track it.

Practice: Practice: Enforcement, penalties and the DPO's year · 3 questions