NPC Reminds Public To Register Their Data Protection Officer and Data Processing System
The NPC Circular No. 2022-04, issued last December 5, 2022, prescribed a mandatory registration clause for all Data Processing Systems directed to all Personal Information Controller (PIC) and Personal Information Processor (PIP) that employs two hundred fifty (250) or more persons, or those processing sensitive personal information of one thousand (1,000) or more individuals, or those processing data that will likely pose a risk to the rights and freedoms of data subjects. Those not covered by the mandatory registration clause can opt to voluntarily register following the process outlined in the same Circular.
Section 7 of the Circular provides that a covered PIC or PIP shall register its newly implemented Data Processing System or inaugural Data Protection Officers (DPO) in the National Privacy Commission’s official registration platform within twenty (20) days from the commencement of such system or the effectivity of such appointment. For minor amendments to existing registration information, the PIC or PIP shall update the system within ten (10) days from the system update or effectivity of appointment of the new DPO.
Despite the aforesaid deadlines, Section 39 of the Circular provides that all covered PICs and PIPs shall complete their Data Processing System and DPO registration within one hundred eighty (180) days from the effectivity of the Circular which ends on July 10, 2023. However, the National Privacy Commission clarifies that the NPC Registration System (NPCRS) remains open even after July 10, 2023, but non-compliance may constitute a violation thereof which may be subjected to enforcement action by the NPC.
In line with this, certificates of registration with validity period until March 8, 2023 are only extended until July 10, 2023. New certificates of registration issued through the NPCRS will carry a one year validity period.
The full NPC Circular No. 2022-04 can be accessed here.
The full NPC article can be accessed here.