Philippines: Introduced Amendments to the Data Privacy Act of 2012 (HB No. 898) including cybersecurity regulation

On 1 July 2022, amendments to the Data Privacy Act of 2012 (HB No. 898) were introduced into the Philippine Parliament. The Bill delineates the criteria for the lawful processing of personal and sensitive personal data, introduces a comprehensive framework of penalties for violations that range from fines to imprisonment, and mandates the appointment of Data Protection Officers (DPOs) to ensure compliance. Furthermore, the legislation includes provisions pertaining to the notification of data breaches. It stipulates that organisations must notify the National Privacy Commission and the affected data subjects within 72 hours of discovering a breach.