Republic Act No. 10173

Tags: Data Privacy Act , Implementing Rules and Regulations , Laws , National Privacy Commission , RA 10173 , Republic Acts , Rodrigo Roa Duterte \n Republic of the Philippines \n\n NATIONAL PRIVACY COMMISSION \n\n Implementing Rules and Regulations of Republic Act No. 10173, known as the "Data Privacy Act of 2012" \n\n Pursuant to the mandate of the National Privacy Commission to administer and implement the provisions of the Data Privacy Act of 2012, and to monitor and ensure compliance of the country with international standards set for data protection, the following rules and regulations are hereby promulgated to effectively implement the provisions of the Act: \n\n Rule I. Preliminary Provisions \n\n1. Title \n\n2. Policy \n\n3. Definitions \n\nRule II. Scope of Application \n\n4. Scope \n\n5. Special Cases \n\n6. Protection afforded to data subjects \n\n7. Protection afforded to journalists and their sources \n\nRule III. National Privacy Commission \n\n8. Mandate \n\n9. Functions \n\n10. Administrative Issuances \n\n11. Reports and Public Information \n\n12. Confidentiality of Personal Data \n\n13. Organizational Structure \n\n14. Secretariat \n\n15. Effect of Lawful Performance of Duty \n\n16. Magna Carta for Science and Technology Personnel \n\nRule IV. Data Privacy Principles \n\n17. General Principles \n\n18. Principles of Transparency, Legitimate Purpose and Proportionality \n\n19. Principles in Collection, Processing and Retention a. Collection must be for a specified and legitimate purpose b. Personal Data shall be processed fairly and lawfully c. Processing should ensure data quality d. Personal data shall not be retained longer than necessary e. Any authorized further processing shall have adequate safeguards \n\n20. Principles for Data Sharing \n\nRule V. Lawful Processing of Personal Data \n\n21. Lawful Processing of Personal Information \n\n22. Lawful Processing of Sensitive Personal Information and Privileged Information \n\n23. Extension of Privileged Communication \n\n24. Surveillance of Subjects and Interception of Recording of Communications \n\nRule VI. Security Measures for Protection of Personal Data \n\n25. Data Privacy and Security \n\n26. Organizational Security \n\n27. Physical Security \n\n28. Technical Security \n\n29. Appropriate Level of Security \n\nRule VII. Security of Sensitive Personal Information in Government \n\n30. Responsibility of Heads of Agencies \n\n31. Requirements Relating to Access by Agency Personnel to Sensitive Personal Information \n\n32. Implementation of Security Requirements \n\n33. Applicability to Government Contractors \n\nRule VIII. Rights of Data Subject \n\n34. Rights of the Data Subject a. Right to be informed b. Right to object c. Right to access d. Right to correct e. Right to rectification, erasure or blocking \n\n35. Transmissibility of Rights of the Data Subject \n\n36. Right to Data Portability \n\n37. Limitation on Rights \n\nRule IX. Data Breach Notification. \n\n38. Data Breach Notification \n\n39. Contents of Notification \n\n40. Delay of Notification \n\n41. Breach Report \n\n42. Procedure for Notification \n\nRule X. Outsourcing and Subcontracting Agreements. \n\n43. Subcontract of Personal Data \n\n44. Agreements for Outsourcing \n\n45. Duty of Personal Information Processor \n\nRule XI. Registration and Compliance Requirements \n\n46. Enforcement of the Data Privacy Act \n\n47. Registration of Data Processing Systems \n\n48. Notification for Automated Processing Operations \n\n49. Review by the Commission \n\nRule XII. Rules on Accountability \n\n50. Accountability for Transfer of Personal Information \n\n51. Accountability for Violation of the Act, these Rules and other issuances \n\nRule XIII. Penalties \n\n52. Unauthorized Processing of Personal Information and Sensitive Personal Information \n\n53. Accessing Personal Information and Sensitive Personal Information Due to Negligence \n\n54. Improper Disposal of Personal Information and Sensitive Personal Information \n\n55. Processing of Personal Information and Sensitive Personal Information for Unauthorized Purposes \n\n56. Unauthorized Access or Intentional Breach \n\n57. Concealment of Security Breaches Involving Sensitive Personal Information \n\n58. Malicious Disclosure \n\n59. Unauthorized Disclosure \n\n60. Combination or Series of Acts \n\n61. Extent of Liability \n\n62. Large-Scale \n\n63. Offense Committed by Public Officer \n\n64. Restitution \n\n65. Fines and Penalties \n\nRule XIV. Miscellaneous Provisions \n\n66. Appeal \n\n67. Period for Compliance \n\n68. Appropriations Clause \n\n69. Interpretation \n\n70. Separability Clause \n\n71. Repealing Clause \n\n72. Effectivity Clause \n\n Resources \n\n [PDF] To continue reading, Implementing Rules and Regulations of RA 10173 "Data Privacy Act of 2012"