[{"data":1,"prerenderedAt":397},["ShallowReactive",2],{"sector-\u002Fservices\u002Fdpo-as-a-service\u002Fsectors\u002Fbpo":3,"sectors-other-\u002Fservices\u002Fdpo-as-a-service\u002Fsectors\u002Fbpo":94},{"id":4,"title":5,"body":6,"citations":76,"description":80,"extension":81,"hook":82,"icon":83,"meta":84,"navigation":85,"order":86,"path":87,"regulators":88,"sector":90,"seo":91,"stem":92,"__hash__":93},"sectors\u002Fsectors\u002Fbpo.md","BPO, IT and outsourcing",{"type":7,"value":8,"toc":69},"minimark",[9,14,18,21,24,28,40,44],[10,11,13],"h2",{"id":12},"sell-it-as-sales-enablement-not-as-compliance","Sell it as sales enablement, not as compliance",[15,16,17],"p",{},"Foreign controllers audit their Philippine processors. That is the whole\ncommercial argument.",[15,19,20],{},"An assurance pack that answers a controller's audit in a week rather than a month\nis a competitive advantage you can actually measure — in deals closed, in\nonboarding time, and in how far into the procurement process you get before\nsomeone asks for documentation you do not have.",[15,22,23],{},"Most Philippine BPOs treat privacy as an overhead. The ones that treat it as part\nof the sales collateral win work from the ones that do not.",[10,25,27],{"id":26},"controller-or-processor-usually-both","Controller or processor — usually both",[15,29,30,31,35,36,39],{},"You are a ",[32,33,34],"strong",{},"Personal Information Processor"," for your clients' data and a\n",[32,37,38],{},"Personal Information Controller"," for your own employees' data. The obligations\ndiffer, and conflating them is the most common structural error in this sector.",[10,41,43],{"id":42},"what-the-overlay-covers","What the overlay covers",[45,46,47,51,54,57,60,63,66],"ul",{},[48,49,50],"li",{},"Outsourcing agreements meeting IRR Rule X §§43–45, in a form a foreign\ncontroller's counsel will accept without redlining",[48,52,53],{},"A standing assurance pack: security measures, sub-processor list, breach\nprocedure, retention, deletion and return-of-data commitments",[48,55,56],{},"Sub-processor management and flow-down obligations",[48,58,59],{},"Cross-border transfer positions — there is no Philippine adequacy regime, so\nthe controller stays accountable under DPA §21, and the NPC's Model Contractual\nClauses under Advisory 2024-01 are voluntary and will not be reviewed or\nendorsed by the Commission",[48,61,62],{},"Breach notification that satisfies both your client's contract and the NPC clock",[48,64,65],{},"Segregation between client data and your own employee data",[48,67,68],{},"Agent-level access controls, and the evidence that they are enforced",{"title":70,"searchDepth":71,"depth":71,"links":72},"",2,[73,74,75],{"id":12,"depth":71,"text":13},{"id":26,"depth":71,"text":27},{"id":42,"depth":71,"text":43},[77,78,79],"Data Privacy Act §21","IRR Rule X §§43–45","NPC Advisory 2024-01","Data privacy compliance for Philippine BPOs, IT service providers and outsourcing firms processing personal data for foreign controllers.","md","For a BPO, privacy compliance is not a cost of regulation. It is a condition of winning work.","i-lucide-headset",{},true,4,"\u002Fsectors\u002Fbpo",[89],"National Privacy Commission","bpo",{"title":5,"description":80},"sectors\u002Fbpo","YsZhoX5TOoFB02OR43qkb4skaBHCN1FKC_0byvEjZzE",[95,191,262,351],{"id":96,"title":97,"body":98,"citations":173,"description":178,"extension":81,"hook":179,"icon":180,"meta":181,"navigation":85,"order":182,"path":183,"regulators":184,"sector":187,"seo":188,"stem":189,"__hash__":190},"sectors\u002Fsectors\u002Fhealth.md","Health",{"type":7,"value":99,"toc":168},[100,104,115,122,126,133,136,138],[10,101,103],{"id":102},"why-health-is-different","Why health is different",[15,105,106,107,110,111,114],{},"Under the Data Privacy Act, health information is ",[32,108,109],{},"sensitive personal\ninformation",". That matters more than it sounds, because sensitive personal\ninformation is governed by ",[32,112,113],{},"Section 13",", not Section 12 — and Section 13 is\nconsiderably narrower.",[15,116,117,118,121],{},"The consequence that surprises people most: ",[32,119,120],{},"performance of a contract is not a\nlawful basis for processing sensitive personal information."," A clinic cannot\nrely on \"we need it to treat the patient\" the way a retailer relies on \"we need\nit to ship the order\". The basis has to come from the Section 13 list.",[10,123,125],{"id":124},"two-clocks-not-one","Two clocks, not one",[15,127,128,129,132],{},"A notifiable breach starts the 72-hour clock to the National Privacy Commission.\nHealth-sector reporting obligations run ",[32,130,131],{},"in addition"," to that, on their own\ntimetable.",[15,134,135],{},"Notifying the NPC does not discharge a separate obligation to notify a sector\nregulator, and the two deadlines are rarely the same.",[10,137,43],{"id":42},[45,139,140,143,150,153,156,159,162,165],{},[48,141,142],{},"Lawful bases mapped to Section 13 rather than Section 12, per processing activity",[48,144,145,146,149],{},"Medical record retention — ",[32,147,148],{},"15 years",", and effectively lifetime where there is\nmedico-legal exposure",[48,151,152],{},"Encryption standards for records at rest and in transit",[48,154,155],{},"Laboratory tiering obligations under DOH AO 2022-0007",[48,157,158],{},"Telemedicine consent and platform assessment under Joint AO 2021-0001",[48,160,161],{},"PhilHealth eClaims record retention",[48,163,164],{},"Consent handling for research, teaching files and case photography",[48,166,167],{},"CCTV in clinical areas, under NPC Circular 2024-02",{"title":70,"searchDepth":71,"depth":71,"links":169},[170,171,172],{"id":102,"depth":71,"text":103},{"id":124,"depth":71,"text":125},{"id":42,"depth":71,"text":43},[174,175,176,177],"Data Privacy Act §13","DOH AO 2020-0030","DOH AO 2022-0007","Joint AO 2021-0001","Data privacy compliance for hospitals, clinics, laboratories, HMOs and telemedicine providers in the Philippines.","Almost everything a health provider holds is sensitive personal information, and the lawful bases for it are narrower than most clinics assume.","i-lucide-stethoscope",{},1,"\u002Fsectors\u002Fhealth",[89,185,186],"Department of Health","PhilHealth","health",{"title":97,"description":178},"sectors\u002Fhealth","VDIU2EikxVUCcT81P2YEGQBh-ywAP-rKUHJnqy1Sot4",{"id":192,"title":193,"body":194,"citations":244,"description":249,"extension":81,"hook":250,"icon":251,"meta":252,"navigation":85,"order":71,"path":253,"regulators":254,"sector":258,"seo":259,"stem":260,"__hash__":261},"sectors\u002Fsectors\u002Ffinance.md","Finance and lending",{"type":7,"value":195,"toc":240},[196,200,203,209,212,214],[10,197,199],{"id":198},"where-the-enforcement-actually-is","Where the enforcement actually is",[15,201,202],{},"If you are a lending or financing company, this is the part to read first.",[15,204,205,208],{},[32,206,207],{},"The contact-list prohibition is absolute."," SEC MC 18-2019 bars accessing a\nborrower's phone contacts for collection purposes. Consent does not cure it. An\napp that requests contacts permission is a finding regardless of what the user\nagreed to, and regardless of whether the permission was ever used.",[15,210,211],{},"Online lending has generated more Philippine data privacy enforcement than any\nother sector, and the pattern is consistent: unfair collection practices,\nexcessive permissions, and disclosure to third parties who had no business\nreceiving the data.",[10,213,43],{"id":42},[45,215,216,219,222,225,228,231,234,237],{},[48,217,218],{},"Lawful basis and consent design for loan-related processing, under NPC\nCircular 20-01 as amended by 2022-02",[48,220,221],{},"Mobile app permission review — contacts, location, storage, camera — against\nwhat the service genuinely requires",[48,223,224],{},"Debt collection practices assessed against SEC MC 18-2019",[48,226,227],{},"Credit scoring and automated decision-making, which is itself an NPC\nregistration trigger",[48,229,230],{},"Outsourcing and service provider agreements meeting BSP expectations",[48,232,233],{},"Financial consumer protection obligations under RA 11765",[48,235,236],{},"Cross-border transfer where processing or storage sits offshore",[48,238,239],{},"AMLA record retention reconciled against data minimization",{"title":70,"searchDepth":71,"depth":71,"links":241},[242,243],{"id":198,"depth":71,"text":199},{"id":42,"depth":71,"text":43},[245,246,247,248],"SEC MC 18-2019","NPC Circular 20-01 as amended by 2022-02","BSP Circular 1160","RA 11765","Data privacy compliance for banks, e-money issuers, fintech, lending and financing companies, and insurers in the Philippines.","The highest-enforcement area in the country. Online lending has produced more Philippine data privacy enforcement than any other sector.","i-lucide-landmark",{},"\u002Fsectors\u002Ffinance",[89,255,256,257],"Bangko Sentral ng Pilipinas","Securities and Exchange Commission","Insurance Commission","finance",{"title":193,"description":249},"sectors\u002Ffinance","JP7i0FOSzMMDfhfvWR9u2fZiMArCMZf75E9ISfWaNOs",{"id":263,"title":264,"body":265,"citations":335,"description":338,"extension":81,"hook":339,"icon":340,"meta":341,"navigation":85,"order":342,"path":343,"regulators":344,"sector":347,"seo":348,"stem":349,"__hash__":350},"sectors\u002Fsectors\u002Feducation.md","Education",{"type":7,"value":266,"toc":330},[267,271,274,277,281,284,308,310],[10,268,270],{"id":269},"why-this-sector-is-harder-than-it-looks","Why this sector is harder than it looks",[15,272,273],{},"Schools hold sensitive personal information about minors, which is the most\nscrutinised category of processing there is — and they receive less\nsector-specific guidance than health or finance.",[15,275,276],{},"That combination cuts both ways. There is less prescriptive detail to comply\nwith, and correspondingly more room to get it wrong. A written program that\nstates clearly how the school handles each situation is worth more here than\nalmost anywhere else, because there is no regulator template to fall back on.",[10,278,280],{"id":279},"the-situations-that-come-up","The situations that come up",[15,282,283],{},"Most of a school's privacy risk sits in ordinary daily practice, not in systems:",[45,285,286,289,292,299,302,305],{},[48,287,288],{},"Honor rolls, awards lists and photographs published without a consent basis",[48,290,291],{},"Learning management systems and video conferencing adopted quickly, with no\nPrivacy Impact Assessment behind them",[48,293,294,295,298],{},"Requests for records from a ",[32,296,297],{},"non-custodial parent",", where a policy decision\nhas to be made under pressure",[48,300,301],{},"Alumni and marketing communications using data collected for enrollment",[48,303,304],{},"Classroom and corridor CCTV, under NPC Circular 2024-02",[48,306,307],{},"Third-party providers — bus operators, canteen concessionaires, photographers,\nyearbook publishers — receiving student data with no agreement in place",[10,309,43],{"id":42},[45,311,312,315,318,321,324,327],{},[48,313,314],{},"Transparency written for children as well as for parents, per NPC Advisory 2024-03",[48,316,317],{},"Consent and legitimate interest mapped for each publication and communication type",[48,319,320],{},"PIAs for the learning platform, the student information system and video conferencing",[48,322,323],{},"A records retention schedule spanning enrollment through alumni relations",[48,325,326],{},"A written procedure for parental and student access requests",[48,328,329],{},"Staff training pitched at teachers and registrars rather than at IT",{"title":70,"searchDepth":71,"depth":71,"links":331},[332,333,334],{"id":269,"depth":71,"text":270},{"id":279,"depth":71,"text":280},{"id":42,"depth":71,"text":43},[174,336,337],"NPC Circular 2024-02","NPC Advisory 2024-03","Data privacy compliance for schools, colleges and universities in the Philippines, covering student records, learning platforms and campus CCTV.","The sector with the least regulator-specific guidance — which is exactly why a clear, written program is worth so much here.","i-lucide-graduation-cap",{},3,"\u002Fsectors\u002Feducation",[89,345,346],"Department of Education","Commission on Higher Education","education",{"title":264,"description":338},"sectors\u002Feducation","Kmsd1Eegw5N7FoPO13mmbT2es5jpPJGqXBSsXA1P6n8",{"id":4,"title":5,"body":352,"citations":393,"description":80,"extension":81,"hook":82,"icon":83,"meta":394,"navigation":85,"order":86,"path":87,"regulators":395,"sector":90,"seo":396,"stem":92,"__hash__":93},{"type":7,"value":353,"toc":388},[354,356,358,360,362,364,370,372],[10,355,13],{"id":12},[15,357,17],{},[15,359,20],{},[15,361,23],{},[10,363,27],{"id":26},[15,365,30,366,35,368,39],{},[32,367,34],{},[32,369,38],{},[10,371,43],{"id":42},[45,373,374,376,378,380,382,384,386],{},[48,375,50],{},[48,377,53],{},[48,379,56],{},[48,381,59],{},[48,383,62],{},[48,385,65],{},[48,387,68],{},{"title":70,"searchDepth":71,"depth":71,"links":389},[390,391,392],{"id":12,"depth":71,"text":13},{"id":26,"depth":71,"text":27},{"id":42,"depth":71,"text":43},[77,78,79],{},[89],{"title":5,"description":80},1785320187282]