About

A small practice that says what it is

Nexthread Solutions provides data protection consultancy, web development and IT services to Philippine organizations. The pages below describe how we work and, just as importantly, where we stop.

What we set out to do

Provide customized, secure and well-built digital solutions for organizations that need professional web and IT support — and, for those handling personal data, a compliance program that is real rather than filed.

Why data privacy

Because it is the part most Philippine organizations get wrong in the same way: they treat a legal obligation as a document to be purchased. The Data Privacy Act has been in force since 2012, the National Privacy Commission has issued more than forty circulars and advisories since, and almost none of that is satisfied by a manual sitting in a folder.

A compliance program needs someone accountable for running it. That is a service, not a deliverable, and it is what this practice sells.

How we work

Four phases, twelve steps, and a published methodology you can read before you commit to anything. The first four steps — the call, the NDA, the discovery questionnaire and the written fixed-fee proposal — are free.

What we will tell you plainly

Stating the limits up front tends to save everyone a month.

We are not a law firm
We work alongside your counsel, and we will tell you plainly when a question needs a lawyer.
We do not issue certifications
The Philippine Privacy Mark and ISO/IEC 27701 certificates are issued by accredited certification bodies. We prepare you for the audit; we do not conduct it.
We do not do the security engineering we specify
Penetration testing, hardening and network architecture. We specify what is required and verify it was done. Where we are your DPO of record, that work must be performed by someone else.
Filings with other regulators
Anything outside the National Privacy Commission is separately scoped.

The limit we impose on ourselves

Where Nexthread Solutions serves as your Data Protection Officer of record, it will not also supply, build, host or administer the systems that process your personal data. That would place us in a position to determine the means of processing we are appointed to supervise, which NPC Advisory 2017-01 treats as a conflict of interest. You can have either service. You cannot have both on the same systems, and we will say so before you ask.

The first conversation costs nothing

Thirty minutes, and an honest answer about which obligations reach you.