NPC: Phase II of automated registration system to be launched in July 2020

The National Privacy Commission (“NPC”) has announced last 6 March 2020 that its targeted automated registration system for Phase II registration is targeted to be launched in July 2020.

The validity of registrations of Personal Information Controllers (“PICs”) and Personal Information Processors (“PIPs”) who were able to complete their initial Phase I registration are valid until 31 August 2020. This comes following the announcement of the NPC last 22 January 2019 that PICs and PIPs who have obtained their registration with the NPC last 2018 were not required to renew their registrations for 2019.

The Data Privacy Act of 2012 mandated the registration of data processing systems for PICs and PIPs falling under specific categories. This requirement was fully implemented by NPC through NPC Circular No. 17-01, which states that mandatory registration of data processing systems shall apply if the PIC or PIP fall under any of the following conditions:

  1. The PIC or PIP employs at least 250 employees;
  2. The processing includes sensitive personal information of at least 1,000 individuals;
  3. The processing is likely to pose a risk to the rights and freedoms of the subjects, such as:
    • Information that would likely affect national security, public safety, public order, or public health;
    • Information required by applicable laws or rules to be confidential;
    • Vulnerable data subjects like minors, the mentally ill, asylum seekers, the elderly, patients, those involving criminal offenses, or in any other case where there is an imbalance in the relationship between the data subject and the PIC or PIP;
    • Automated-decision making; or
    • Profiling.
  1. Processing is not occasional or is regularly performed.

Annex A of NPC Circular No. 17-01 further provides specific types of industries falling under Item (4) above. A copy of the list may be accessed through the following link:

Phase I of the mandatory registration involves the registration of the PIC’s or PIP’s Data Protection Officer (DPO).

The extension on validity of registration is available only to those that have successfully registered their DPOs. For those that have yet to do so, the NPC encourages the immediate registration of their DPOs to avoid possible liabilities. Registration may be commenced online through the following link:


Image by Pete Linforth from Pixabay