Philippines: Adopted Implementing Rules and Regulation of the Data Privacy Act of 2012 including registration requirement

On 24 August 2016, the Philippine National Privacy Commission adopted the Implementing Rules and Regulations of the Data Privacy Act of 2012. The Rules are applicable to any processing of personal data of Philippine citizens. The Rules specify the need to register personal data processing systems for any data processor with 250 or more employees or for data processors with less employees if the processing entails a risk to the rights and freedoms of data subjects, the processing occurs regularly or sensitive data of at least 1’000 data subjects is processed. Additionally, any automated decision-making must be reported to the National Privacy Commission. The Rules further stipulate the fines for any breaches of the regulations.