Data Privacy Policy Template Philippines

DATA PRIVACY POLICY AND DATA PROCESSING AGREEMENT

This Data Privacy Policy and Data Processing Agreement (the "Agreement") is entered into as of [Effective Date] (the "Effective Date") by and between:

[Company Name], a corporation duly organized and existing under the laws of the Republic of the Philippines, with principal office address at [Company Address] (hereinafter referred to as the "Company"); and

[Counterparty Name], a [Entity Type] duly organized and existing under the laws of [Jurisdiction], with principal office address at [Counterparty Address] (hereinafter referred to as the "Data Processor/Partner").

RECITALS

WHEREAS, the Company, in the course of its business operations, processes Personal Information and Sensitive Personal Information;

WHEREAS, the Company is committed to complying with the Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations (IRR), and the issuances of the National Privacy Commission (NPC);

WHEREAS, the Parties desire to define their respective roles, obligations, and responsibilities regarding the collection, processing, and protection of Data;

NOW, THEREFORE, in consideration of the mutual covenants contained herein, the Parties agree as follows:

---

1. OPERATIONAL DEFINITIONS

1.1. "Data Subject" refers to an individual whose personal, sensitive personal, or privileged information is processed by the Company.

1.2. "Personal Information" refers to any information, whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.

1.3. "Sensitive Personal Information" refers to personal information as defined under Section 3(l) of the DPA, including but not limited to race, ethnic origin, marital status, age, color, religious/philosophical/political affiliations, health, education, genetic or sexual life, and government-issued identification numbers.

1.4. "Processing" refers to any operation or any set of operations performed upon personal information including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure, or destruction of data.

1.5. "Personal Information Controller (PIC)" refers to a person or organization who controls the collection, holding, processing, or use of personal information.

1.6. "Personal Information Processor (PIP)" refers to any natural or juridical person qualified to act as such to whom a personal information controller may outsource the processing of personal information.

---

2. SUBSTANTIVE TERMS AND OBLIGATIONS

2.1. Compliance with Law. The Parties warrant that they shall at all times comply with the provisions of the DPA, the IRR, and all circulars issued by the NPC.

2.2. Purpose Limitation. The Processor shall process Personal Information only upon the documented instructions of the Company and strictly for the purposes specified in the Service Agreement dated [Service Agreement Date].

2.3. Security Measures. The Processor shall implement appropriate organizational, physical, and technical security measures to protect Personal Information against unauthorized access, alteration, disclosure, or destruction.

2.4. Confidentiality. The Processor shall ensure that its employees, agents, and representatives authorized to process the Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

2.5. Data Breach Notification. In the event of a Personal Data Breach, the Processor shall notify the Company within twenty-four (24) hours from the time of discovery, providing all necessary details to assist the Company in fulfilling its notification obligations to the NPC and the Data Subjects.

---

3. DEFAULT, TERMINATION, AND REMEDIES

3.1. Material Breach. A material breach of this Agreement includes, but is not limited to, the unauthorized disclosure of Sensitive Personal Information or a failure to implement mandated security protocols.

3.2. Notice and Cure. Upon the occurrence of a breach, the non-breaching party shall provide written notice to the breaching party. The breaching party shall have thirty (30) business days from receipt of such notice to cure the breach to the satisfaction of the non-breaching party.

3.3. Termination. If the breach is not cured within the specified thirty (30) business day period, the non-breaching party may terminate this Agreement immediately upon written notice without prejudice to any other legal remedies available under the laws of the Philippines.

3.4. Indemnification. The Processor shall indemnify and hold the Company harmless from any and all claims, damages, fines, or penalties arising from the Processor’s failure to comply with the DPA or this Agreement, up to a maximum liability of [Dollar Amount].

---

4. BOILERPLATE LEGAL PROVISIONS

4.1. Severability. If any provision of this Agreement is held to be invalid or unenforceable, such provision shall be severed and the remaining provisions shall continue in full force and effect.

4.2. Entire Agreement. This Agreement constitutes the entire agreement between the Parties concerning the subject matter hereof and supersedes all prior agreements or understandings.

4.3. Force Majeure. Neither party shall be liable for any failure to perform its obligations where such failure results from any cause beyond the party’s reasonable control, including acts of God, war, or governmental regulation.

4.4. Governing Law. This Agreement shall be governed by and construed in accordance with the laws of the Republic of the Philippines.

4.5. Dispute Resolution. Any dispute, controversy, or claim arising out of or relating to this Agreement shall be settled through friendly consultation. If no settlement is reached within thirty (30) days, the dispute shall be submitted to the exclusive jurisdiction of the competent courts of [City/Municipality], Philippines.

---

5. FORMAL EXECUTION BLOCK

IN WITNESS WHEREOF, the Parties have caused this Agreement to be executed by their duly authorized representatives as of the Effective Date.

FOR: [Company Name]

Signature: ___________________________ Name: _______________________________ Title: ________________________________ Date: ________________________________

FOR: [Counterparty Name]

Signature: ___________________________ Name: _______________________________ Title: ________________________________ Date: ________________________________