The Philippine National Privacy Commission (NPC) released on its official Facebook page two announcements regarding the soon-to-be launched eRehistro system. The NPC announced: (1) the system's process and requirements for account creation, data processing systems (DPS) inventory; and (2) the amendment of registration information for covered personal information controllers (PIC) and personal information processors (PIP).
Recommended actions
While we monitor further NPC announcements on the launch date and formal guidelines of eRehistro, we continue to encourage covered PICs and PIPs to commence preparing, reviewing and updating their compliance and registration information for both Phase 1: Data Protection Officer (DPO) renewal of registration, and Phase 2: Data Processing System (DPS) registration.
We also recommend that clients keep themselves updated of further developments from the NPC, either through the NPC’s website or its social media channels. For additional guidance on the various announcements made by the NPC on the eRehistro system, you may refer to our previous alerts in the following links:
Philippines: eRehistro updates from the National Privacy Commission
Philippines: More updates on eRehistro from the National Privacy Commission
Our firm will provide more updates in due course.
In more detail
Overview of eRehistro account creation and DPS registration
The creation of an eRehistro account involves a two-step process: (1) uploading a duly accomplished and notarized eRehistro form; and (2) registering all of the PIC or PIP’s DPS -- both of which should be done once the eRehistro system is available to the public.
In the meantime, the NPC recommends conducting a DPS inventory by completing the following information:
name of the DPS
type of DPS (i.e., paper-based, manual, electronic/automatic, or both)
purpose(s) of the DPS
whether the registrant is a PIC or PIP
whether the DPS involves automated decision-making
whether data processing is outsourced or subcontracted
categories of the data subject and personal data involved
number of staff in the PIC or PIP’s data protection office
number of individuals to whom the personal data will be or may be disclosed
whether personal data will be transferred outside the Philippines
Amendment of registration information
Amendments or updates to a PIC or PIP’s registration information may likewise be made using the eRehistro system. Under current NPC regulations, amendments or updates to a covered PIC or PIP's registration information should be made within two (2) months from the date of effectivity of the change.1
Specifically, an amendment or updating of registration information is required if it involves any of the following information:
name or contact details of the PIC or PIP
name or contact details of the head of the agency or organization
name or contact details of the DPO
Prior to the availability of the eRehistro system, the covered PIC or PIP should send by email any amendment or update on its registration information to dpo.registration@privacy.gov.ph, which submission will be validated by the NPC within three to seven days.