In brief
The Philippine National Privacy Commission (NPC) released on its official Facebook page two announcements regarding the soon-to-be launched eRehistro system. The NPC announced: (1) the system’s process and requirements for account creation, data processing systems (DPS) inventory; and (2) the amendment of registration information for covered personal information controllers (PIC) and personal information processors (PIP).
Recommended actions
While we monitor further NPC announcements on the launch date and formal guidelines of eRehistro, we continue to encourage covered PICs and PIPs to commence preparing, reviewing and updating their compliance and registration information for both Phase 1: Data Protection Officer (DPO) renewal of registration, and Phase 2: Data Processing System (DPS) registration.
We also recommend that clients keep themselves updated of further developments from the NPC, either through the NPC’s website or its social media channels. For additional guidance on the various announcements made by the NPC on the eRehistro system, you may refer to our previous alerts in the following links:
- Philippines: National Privacy Commission announces new online registration platform and extends validity of DPO registrations to 30 June 2021
- Philippines: eRehistro updates from the National Privacy Commission
- Philippines: More updates on eRehistro from the National Privacy Commission
Our firm will provide more updates in due course.
In more detail
Overview of eRehistro account creation and DPS registration
The creation of an eRehistro account involves a two-step process: (1) uploading a duly accomplished and notarized eRehistro form; and (2) registering all of the PIC or PIP’s DPS — both of which should be done once the eRehistro system is available to the public.
In the meantime, the NPC recommends conducting a DPS inventory by completing the following information:
- name of the DPS
- type of DPS (i.e., paper-based, manual, electronic/automatic, or both)
- purpose(s) of the DPS
- whether the registrant is a PIC or PIP
- whether the DPS involves automated decision-making
- whether data processing is outsourced or subcontracted
- categories of the data subject and personal data involved
- number of staff in the PIC or PIP’s data protection office
- number of individuals to whom the personal data will be or may be disclosed
- whether personal data will be transferred outside the Philippines
Amendment of registration information
Amendments or updates to a PIC or PIP’s registration information may likewise be made using the eRehistro system. Under current NPC regulations, amendments or updates to a covered PIC or PIP’s registration information should be made within two (2) months from the date of effectivity of the change.1
Specifically, an amendment or updating of registration information is required if it involves any of the following information:
- name or contact details of the PIC or PIP
- name or contact details of the head of the agency or organization
- name or contact details of the DPO
Prior to the availability of the eRehistro system, the covered PIC or PIP should send by email any amendment or update on its registration information to [email protected], which submission will be validated by the NPC within three to seven days.