Data Privacy Policy Sample Philippines

DATA PRIVACY POLICY SAMPLE PHILIPPINES

1. DOCUMENT PREAMBLE & RECITALS

THIS DATA PRIVACY POLICY AND BINDING AGREEMENT (the "Agreement") is entered into and made effective as of the [Insert Date] day of [Insert Month], [Insert Year] (the "Effective Date"), by and between:

[Insert Company Name], a corporation duly organized and existing under the laws of the Republic of the Philippines, with principal place of business at [Insert Complete Business Address] (hereinafter referred to as the "Company", "Data Controller", or "Party of the First Part");

and

[Insert Data Subject/Counterparty Name], of legal age, with residential or principal business address at [Insert Complete Address] (hereinafter referred to as the "Data Subject", "User", or "Party of the Second Part").

RECITALS

WHEREAS, the Company is engaged in [Insert Brief Description of Business Operations] and in the regular course of its operations, collects, processes, stores, and shares Personal Data;

WHEREAS, the Republic of the Philippines has enacted Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 ("DPA"), along with its Implementing Rules and Regulations ("IRR") and the issuances of the National Privacy Commission ("NPC"), which mandate strict compliance and adherence to the principles of transparency, legitimate purpose, and proportionality in the processing of Personal Data;

WHEREAS, the Parties intend by this Agreement to formalize, govern, and bind their legal relationship regarding the collection, use, retention, protection, and disposal of Personal Data in strict compliance with Philippine law;

NOW, THEREFORE, for and in consideration of the mutual covenants, terms, and conditions set forth herein, and other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:

---

2. OPERATIONAL DEFINITIONS

For the purposes of this Agreement, the following terms shall be understood, construed, and defined as follows:

1. "Consent" refers to any freely given, specific, informed, and unambiguous indication of Will, whereby the Data Subject agrees to the collection and processing of personal, sensitive personal, or privileged information relating to them, signified in writing, through electronic mail, or other verifiable means.
2. "Data Privacy Act" or "DPA" means Republic Act No. 10173, including its Implementing Rules and Regulations, and all subsequent circulars, advisories, and orders promulgated by the National Privacy Commission (NPC).
3. "Data Subject" refers to an individual whose personal, sensitive personal, or privileged information is processed by the Company pursuant to this Agreement.
4. "National Privacy Commission" or "NPC" refers to the independent regulatory body created under Republic Act No. 10173 mandated to administer and implement the provisions of the DPA and to monitor and ensure compliance of the country with international standards set for data protection.
5. "Personal Data" collectively refers to Personal Information, Sensitive Personal Information, and Privileged Information as defined under Sections 3(g), 3(l), and 3(k) of the DPA, respectively.
6. "Personal Information" refers to any information, whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.
7. "Processing" refers to any operation or any set of operations performed upon Personal Data including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure, or destruction of data.
8. "Sensitive Personal Information" refers to Personal Data:
   • About an individual's race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations;
   • About an individual's health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings;
   • Issued by government agencies peculiar to an individual which includes, but is not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns; and
   • Specifically established by an executive order or an act of Congress to be classified.

---

3. SUBSTANTIVE TERMS & OBLIGATIONS

3.1. Lawful Basis and Collection of Personal Data

1. The Company shall collect Personal Data only for explicit, specified, and legitimate purposes, and shall not process the same in a manner incompatible with said purposes.
2. Collection of Personal Data shall be transparent, adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed.
3. The Company warrants that it shall secure valid, specific, and informed Consent from the Data Subject prior to or at the time of collection, except in instances where processing is directly authorized by the DPA or its IRR without the need for consent.

3.2. Scope of Processing and Use

1. The Personal Data collected by the Company shall be utilized exclusively for [Insert Specific Business Purposes, e.g., customer account management, employment processing, fulfillment of contractual obligations, and regulatory compliance].
2. The Company shall not sell, rent, lease, or otherwise disclose Personal Data to third parties for commercial or marketing purposes without the explicit, opt-in Consent of the Data Subject, except as required by law or judicial mandate.

3.3. Security Measures and Data Protection Standards

1. The Company shall implement reasonable and appropriate physical, technical, and organizational security measures to protect Personal Data against accidental or unlawful destruction, alteration, and disclosure, as well as against any other unlawful processing.
2. Such security measures shall include, but not be limited to:
   • Encryption of Personal Data during transmission and at rest;
   • Implementation of strict access control policies, ensuring that only authorized personnel with a legitimate business need may access Personal Data;
   • Regular security audits, vulnerability assessments, and penetration testing of the Company’s information technology infrastructure; and
   • Comprehensive data privacy and security awareness training for all employees, agents, and contractors handling Personal Data.

3.4. Rights of the Data Subject

Pursuant to Chapter IV of the DPA, the Data Subject is entitled to the following rights, which the Company shall honor, facilitate, and enforce upon formal written request:

1. Right to be Informed: The right to be notified whether Personal Data pertaining to them is being, or has been processed, including the identity of the data controller, purpose of processing, categories of data, and recipients.
2. Right to Access: The right to reasonable access, upon demand, to the contents of their Personal Data and the manner by which they were processed.
3. Right to Object: The right to object to the processing of their Personal Data, including processing for direct marketing, automated processing, or profiling.
4. Right to Erasure or Blocking: The right to suspend, withdraw, or order the blocking, removal, or destruction of their Personal Data from the Company's filing system upon discovery of substantial proof of incompleteness, falsity, unlawful acquisition, or unauthorized purpose.
5. Right to Damages: The right to be indemnified for any damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of Personal Data.
6. Right to Data Portability: The right to obtain from the Company a copy of such data in an electronic or structured format commonly used, where Personal Data is processed by electronic means and in a structured and commonly used format.

3.5. Data Retention and Disposal

1. The Company shall retain Personal Data only for as long as necessary for the fulfillment of the purposes for which the data was collected, or for the establishment, exercise, or defense of legal claims, or as necessitated by legitimate business purposes, or as required by applicable laws and regulations.
2. Upon expiration of the retention period, the Company shall securely dispose of, shred, delete, or anonymize all Personal Data in its custody in a manner that prevents further processing, reconstruction, or retrieval.

---

4. DEFAULT, TERMINATION, AND REMEDIES

4.1. Classification of Breach

The occurrence of any of the following events shall constitute a material breach ("Default") of this Agreement:

1. Unauthorized access, acquisition, alteration, disclosure, or destruction of Personal Data resulting from the gross negligence, willful misconduct, or security failure of a Party.
2. Failure to implement, maintain, or update the mandatory organizational, physical, and technical security measures prescribed under Section 3.3 hereof.
3. Processing of Personal Data outside the scope of the explicit purposes defined in this Agreement without lawful justification under the DPA.
4. Refusal or failure to honor the statutory rights of the Data Subject as enumerated in Section 3.4 without legal basis.
5. Failure to notify the NPC and affected Data Subjects of a personal data breach within the mandatory statutory periods provided by law.

4.2. Notice and Cure Period

1. In the event of a material breach, the non-defaulting Party shall issue a written Notice of Default specifying the exact nature of the violation with reasonable particularity.
2. The defaulting Party shall have a period of thirty (30) business days from receipt of the Notice of Default to cure the breach, mitigate any resulting damage, and provide satisfactory written proof of remediation to the non-defaulting Party.

4.3. Legal Recourse and Remedies

1. If the defaulting Party fails to cure the breach within the thirty (30) business day cure period, the non-defaulting Party may immediately terminate this Agreement upon written notice, without prejudice to any other rights or remedies available under equity or law.
2. The non-defaulting Party reserves the right to institute administrative, civil, or criminal complaints before the National Privacy Commission (NPC) or the appropriate courts of law in the Philippines for violations of the Data Privacy Act of 2012.
3. The defaulting Party shall indemnify, defend, and hold harmless the non-defaulting Party, its directors, officers, employees, and assigns from and against any and all claims, liabilities, penalties, fines, losses, damages, and reasonable attorney's fees arising out of or resulting from the defaulting Party's breach of its data privacy obligations.

---

5. BOILERPLATE LEGAL PROVISIONS

5.1. Severability

If any provision of this Agreement is held to be invalid, illegal, or unenforceable by a court of competent jurisdiction or the National Privacy Commission, such provision shall be modified to the minimum extent necessary to make it valid and enforceable, and the remaining provisions of this Agreement shall remain in full force and effect.

5.2. Entire Agreement

This Agreement constitutes the entire understanding and agreement between the Parties with respect to the subject matter hereof and supersedes all prior or contemporaneous oral or written representations, understandings, negotiations, or agreements between the Parties concerning data privacy.

5.3. Force Majeure

Neither Party shall be held liable for any failure or delay in the performance of its obligations under this Agreement if such failure or delay arises from acts of God, natural disasters, war, insurrection, civil unrest, terrorism, epidemics, pandemics, government restrictions, massive power failures, or cyber-attacks originating from state-sponsored entities or catastrophic system failures beyond the reasonable control of the affected Party ("Force Majeure Event"). The affected Party shall promptly notify the other Party in writing upon the occurrence of a Force Majeure Event and shall use commercially reasonable efforts to resume performance as soon as practicable.

5.4. Governing Law

This Agreement shall be interpreted, construed, governed, and enforced in accordance with the laws of the Republic of the Philippines, without regard to its conflict of laws principles, with specific primary application given to Republic Act No. 10173 (Data Privacy Act of 2012) and its IRR.

5.5. Dispute Resolution

1. Any dispute, controversy, or claim arising out of or relating to this Agreement, including its formation, breach, termination, or validity, shall be settled in the first instance through amicable good-faith negotiations between the designated compliance officers of the Parties within thirty (30) days from receipt of written notice of dispute.
2. If the dispute remains unresolved through negotiation, it shall be submitted to binding arbitration in [Insert City, e.g., Makati City], Philippines, in accordance with the Arbitration Rules of the Philippine Dispute Resolution Center, Inc. (PDRCI) then in force.
3. Notwithstanding the foregoing, nothing in this section shall prevent either Party from seeking injunctive relief or provisional remedies from the appropriate courts of [Insert City, e.g., Makati City], Philippines, to protect its intellectual property or confidential Personal Data.

---

6. FORMAL EXECUTION BLOCK

IN WITNESS WHEREOF, the Parties hereto have caused this Data Privacy Policy and Binding Agreement to be executed by their duly authorized representatives as of the Effective Date first written above.

DATA CONTROLLER / COMPANY:
[Insert Company Name]

By:

---

[Insert Signatory Name]
[Insert Title, e.g., Chief Executive Officer / Data Protection Officer]
Date: [Insert Date]

---

DATA SUBJECT / COUNTERPARTY:
[Insert Data Subject/Counterparty Name]

By:

---

[Insert Signatory Name if Entity / Leave blank if Individual]
[Insert Title if Entity / Data Subject]
Date: [Insert Date]

---

SIGNED IN THE PRESENCE OF:

---

[Insert Witness Name 1]

---

[Insert Witness Name 2]