Data Privacy Notice Sample Philippines

DATA PRIVACY NOTICE AND AGREEMENT

THIS DATA PRIVACY NOTICE AND AGREEMENT (the "Agreement") is entered into this [Day] of [Month], [Year] (the "Effective Date") by and between:

[Company Name], a corporation duly organized and existing under the laws of the Republic of the Philippines, with principal office address at [Company Address] (hereinafter referred to as the "Data Controller");

AND

[Individual/Entity Name], with principal office/residential address at [Address] (hereinafter referred to as the "Data Subject").

RECITALS

WHEREAS, the Data Controller is engaged in [Nature of Business] and in the course of its operations, processes Personal Data;

WHEREAS, the Data Subject wishes to engage with the Data Controller and acknowledges that such engagement necessitates the processing of Personal Data;

WHEREAS, the Parties desire to formalize their understanding regarding the collection, processing, storage, and protection of such Personal Data in compliance with Republic Act No. 10173, otherwise known as the "Data Privacy Act of 2012," and its Implementing Rules and Regulations.

---

1. OPERATIONAL DEFINITIONS

1.1. "Data Privacy Act" refers to Republic Act No. 10173 and all subsequent amendments, issuances, and circulars by the National Privacy Commission (NPC).

1.2. "Personal Data" refers to all personal information, sensitive personal information, and privileged information as defined under Section 3 of the Data Privacy Act.

1.3. "Processing" refers to any operation or any set of operations performed upon personal data including, but not limited to, the collection, recording, organization, storage, updating, modification, retrieval, consultation, use, consolidation, blocking, erasure, or destruction of data.

1.4. "Data Subject" refers to an individual whose personal, sensitive personal, or privileged information is processed.

1.5. "Personal Information Controller" (PIC) refers to a person or organization who controls the collection, holding, processing, or use of personal information.

---

2. SUBSTANTIVE TERMS AND OBLIGATIONS

2.1. Scope of Consent. The Data Subject hereby grants the Data Controller express, written consent to collect, use, and process Personal Data for the following purposes: [Specify Purposes, e.g., service fulfillment, marketing, legal compliance].

2.2. Data Minimization. The Data Controller shall collect only such Personal Data as is reasonably necessary to fulfill the purposes set forth in Section 2.1.

2.3. Security Measures. The Data Controller warrants that it shall implement reasonable and appropriate organizational, physical, and technical security measures to protect Personal Data against accidental or unlawful destruction, alteration, and disclosure, as well as against any other unlawful processing.

2.4. Retention Policy. Personal Data shall be retained only for as long as necessary for the fulfillment of the purposes for which the data was obtained or for the establishment, exercise, or defense of legal claims, or as provided by law. Upon expiry of said period, the data shall be securely disposed of.

2.5. Rights of the Data Subject. The Data Controller acknowledges the Data Subject’s rights under the Data Privacy Act, including the right to be informed, the right to access, the right to object, the right to erasure or blocking, and the right to damages.

---

3. DEFAULT, TERMINATION, AND REMEDIES

3.1. Breach. Any unauthorized processing, failure to protect, or misuse of Personal Data by the Data Controller shall constitute a material breach of this Agreement.

3.2. Cure Period. In the event of a breach, the aggrieved party shall provide written notice to the breaching party. The breaching party shall have a period of thirty (30) business days from the receipt of such notice to rectify the breach to the reasonable satisfaction of the aggrieved party.

3.3. Termination. If the breach remains uncured after the lapse of the 30-business-day period, the non-breaching party may terminate this Agreement immediately upon written notice, without prejudice to any other legal remedies available under Philippine law.

3.4. Indemnity. The Data Controller shall hold the Data Subject harmless from any liability arising from the Data Controller’s gross negligence or willful misconduct in the processing of the Data Subject’s Personal Data, up to a maximum amount of [Dollar Amount].

---

4. BOILERPLATE LEGAL PROVISIONS

4.1. Severability. If any provision of this Agreement is held to be invalid or unenforceable, such provision shall be severed and the remaining provisions shall continue in full force and effect.

4.2. Entire Agreement. This document constitutes the entire agreement between the Parties and supersedes all prior discussions, representations, or agreements, whether written or oral.

4.3. Force Majeure. Neither party shall be held liable for any failure to perform its obligations where such failure results from any cause beyond the reasonable control of that party, including acts of God, war, or governmental regulations.

4.4. Governing Law. This Agreement shall be governed by and construed in accordance with the laws of the Republic of the Philippines.

4.5. Dispute Resolution. Any dispute arising out of or in connection with this Agreement shall first be settled through amicable negotiation. If no settlement is reached within thirty (30) days, the dispute shall be submitted to the exclusive jurisdiction of the competent courts of [City/Jurisdiction], Philippines.

---

5. FORMAL EXECUTION BLOCK

IN WITNESS WHEREOF, the parties have executed this Agreement as of the date first written above.

[COMPANY NAME] (Data Controller)

By: ___________________________ Name: [Signatory Name] Title: [Signatory Title]

[INDIVIDUAL/ENTITY NAME] (Data Subject)

By: ___________________________ Name: [Signatory Name] Title: [Signatory Title/Capacity]

SIGNED IN THE PRESENCE OF:

---