ERP strategy & selection
The Data Privacy Act and your business systems: a practical guide
What the Data Privacy Act (RA 10173) means for HR, payroll, CRM and POS systems: sensitive data, access control, DPOs, vendors, breach notification and retention.
The Data Privacy Act of 2012 (RA 10173) governs how organizations in the Philippines collect, use, store, share and dispose of personal information. It is enforced by the National Privacy Commission (NPC). Business systems such as HRIS, payroll, CRM, POS and customer databases hold large amounts of personal data, so how they are configured and used is central to compliance.
This guide explains the practical implications for business systems. It is not legal advice; work with your data protection officer and legal counsel, and check current NPC issuances on the NPC website.
Key concepts
| Concept | Meaning |
|---|---|
| Personal information | Information that identifies or can identify an individual |
| Sensitive personal information | Includes data about health, education, age, marital status, religious and political affiliations, and government-issued identifiers such as SSS numbers, licenses and tax returns |
| Personal information controller (PIC) | The organization that decides why and how data is processed, such as the employer or the business |
| Personal information processor (PIP) | An organization that processes data on behalf of a PIC, such as a payroll provider or cloud software vendor |
| Data subject | The individual whose data is processed: employees, applicants, customers |
HR and payroll systems almost always contain sensitive personal information (government numbers, health data, family details), which requires stronger protection.
Principles applied to systems
- Transparency: tell employees and customers what you collect and why, through privacy notices
- Legitimate purpose: process data only for declared, lawful purposes
- Proportionality: collect and keep only what you need
Practical controls in business systems
| Control | Example in practice |
|---|---|
| Role-based access | Branch HR sees only their branch; payroll data limited to payroll staff (multi-branch payroll) |
| Activity logs | Record who viewed or changed sensitive records |
| Minimal data collection | Do not store fields you do not need |
| Secure sharing | Expiring links instead of email attachments (secure file sharing) |
| Retention and disposal | Delete or anonymize data when retention periods end (digital 201 file) |
| Account lifecycle | Remove access on the last working day (offboarding) |
| Encryption and backups | Protect data in transit, at rest and in backups |
| Device security | Encrypted laptops and phones with screen locks (IT asset management) |
Organizational requirements
- Designate a data protection officer (DPO) responsible for compliance
- Conduct privacy impact assessments for systems processing personal data
- Maintain privacy and security policies and train employees
- Register with the NPC if your organization meets the registration thresholds in current NPC rules
- Have a breach management plan
Vendors and outsourcing
When a software vendor, payroll provider or cloud host processes personal data for you, it acts as a processor. Your agreement should cover the processing purpose, security measures, confidentiality, subcontractors, breach notification and return or deletion of data at the end of the contract. See cloud ERP.
Personal data breaches
Under NPC rules, when a breach involving sensitive personal information or information that may enable identity fraud is likely to cause real risk of serious harm, the PIC must notify the NPC and affected data subjects within 72 hours of knowledge of the breach. Practical preparation:
- An incident response team and contact list
- Logs that show what was accessed
- Templates for notifications
- Regular drills
Data subject rights
Employees and customers have rights including to be informed, to access their data, to object, to correct inaccurate data, to have data erased or blocked under certain conditions, to data portability, and to file complaints. Systems should make it practical to find, export and correct a person's data.
Common gaps in Philippine companies
- Shared logins to HR or POS systems
- Payroll and employee files sent by chat or email
- Former employees still with system access
- Applicant data kept indefinitely
- CCTV and biometric data without privacy notices (biometric attendance)
- No records of who accessed sensitive data
Where Cirquolus fits
Cirquolus supports page permissions and predefined permission groups, and activity logs with log views and permission-based access for oversight. Vault supports sharing with expiry dates and access revocation. Configure access, retention and processing terms with your DPO during implementation.
Frequently asked questions
Does the Data Privacy Act apply to employee data?
Yes. Employee data, including government numbers and health information, is personal or sensitive personal information protected by the law.
What is sensitive personal information under RA 10173?
It includes information about health, education, age, marital status, religious and political affiliations, and government-issued identifiers such as SSS numbers and tax returns, among others.
Do companies need a data protection officer?
Organizations that process personal data are required to designate a DPO under NPC rules.
How fast must a data breach be reported?
Qualifying breaches must be notified to the NPC and affected individuals within 72 hours of knowledge of the breach, under NPC rules.
Bring this workflow to a Cirquolus demo.
Show us your current process, companies and branches. We will map it to the modules you need and propose a realistic rollout.