Law Reviewer
Law Reviewer
(e) Suspend, withdraw or order the blocking, removal or RULE X. OUTSTANDING AND SUBCONTRACTING
destruction of his or her personal information from the AGREEMENTS
personal information controller’s filing system upon Section 43. Subcontract of Personal Data. A personal
discovery and substantial proof that the personal information controller may subcontract or outsource
information are incomplete, outdated, false, unlawfully the processing of personal data: Provided, that the
personal information controller shall use contractual or RULE XI REGISTRATION AND COMPLIANCE
other reasonable means to ensure that proper REQUIREMENT
safeguards are in place, to ensure the confidentiality, Section 46. Enforcement of the Data Privacy Act.
integrity and availability of the personal data processed, Pursuant to the mandate of the Commission to
prevent its use for unauthorized purposes, and administer and implement the Act, and to ensure the
generally, comply with the requirements of the Act, compliance of personal information controllers with its
these Rules, other applicable laws for processing of obligations under the law, the Commission requires the
personal data, and other issuances of the Commission. following:
Section 44. Agreements for Outsourcing. a. Registration of personal data processing systems
Processing by a personal information processor shall be operating in the country that involves accessing or
governed by a contract or other legal act that binds the requiring sensitive personal information of at least one
personal information processor to the personal thousand (1,000) individuals, including the personal
information controller. data processing system of contractors, and their
a. The contract or legal act shall set out the subject- personnel, entering into contracts with government
matter and duration of the processing, the nature and agencies;
purpose of the processing, the type of personal data
and categories of data subjects, the obligations and b. Notification of automated processing operations
rights of the personal information controller, and the where the processing becomes the sole basis of making
geographic location of the processing under the decisions that would significantly affect the data
subcontracting agreement. subject;
b. The contract or other legal act shall stipulate, in c. Annual report of the summary of documented
particular, that the personal information processor security incidents and personal data breaches;
shall:
1. Process the personal data only upon the documented d. Compliance with other requirements that may be
instructions of the personal information controller, provided in other issuances of the Commission.
including transfers of personal data to another country
or an international organization, unless such transfer is Section 47. Registration of Personal Data Processing
authorized by law; 2. Ensure that an obligation of Systems.
confidentiality is imposed on persons authorized to The personal information controller or personal
process the personal data; information processor that employs fewer than two
3. Implement appropriate security measures and hundred fifty (250) persons shall not be required to
comply with the Act, these Rules, and other issuances of register unless the processing it carries out is likely to
the Commission; pose a risk to the rights and freedoms of data subjects,
4. Not engage another processor without prior the processing is not occasional, or the processing
instruction from the personal information controller: includes sensitive personal information of at least one
Provided, that any such arrangement shall ensure that thousand (1,000) individuals.
the same obligations for data protection under the
contract or legal act are implemented, taking into
account the nature of the processing;
5. Assist the personal information controller, by
appropriate technical and organizational measures and
to the extent possible, fulfill the obligation to respond
to requests by data subjects relative to the exercise of
their rights;
6. Assist the personal information controller in ensuring
compliance with the Act, these Rules, other relevant
laws, and other issuances of the Commission, taking
into account the nature of processing and the
information available to the personal information
processor;
7. At the choice of the personal information controller,
delete or return all personal data to the personal
information controller after the end of the provision of
services relating to the processing: Provided, that this
includes deleting existing copies unless storage is
authorized by the Act or another law;
8. Make available to the personal information controller
all information necessary to demonstrate compliance
with the obligations laid down in the Act, and allow for
and contribute to audits, including inspections,
conducted by the personal information controller or
another auditor mandated by the latter;
9. Immediately inform the personal information
controller if, in its opinion, an instruction infringes the
Act, these Rules, or any other issuance of the
Commission.