Rules on accountability

1. Accountability for Transfer of Personal Data

1) A personal information controller shall be responsible for any personal data under its control or custody, including information that have been outsourced or transferred to a personal information processor or a third party for processing, whether domestically or internationally, subject to cross-border arrangement and cooperation. (Section 50, Rule XII, IRR of the Data Privacy Act)

2) A personal information controller shall be accountable for complying with the requirements of the Act, these Rules, and other issuances of the Commission. It shall use contractual or other reasonable means to provide a comparable level of protection to the personal data while it is being processed by a personal information processor or third party. (Section 50[a], Rule XII, Ibid.)

3) A personal information controller shall designate an individual or individuals who are accountable for its compliance with the Act. The identity of the individual or individuals so designated shall be made known to a data subject upon request. (Section 50[b], Rule XII, Ibid.)

2. Accountability for Violation of the Act, these Rules and Other Issuances of the NPC

Any natural or juridical person, or other body involved in the processing of personal data, who fails to comply with the Act, these Rules, and other issuances of the Commission, shall be liable for such violation, and shall be subject to its corresponding sanction, penalty, or fine, without prejudice to any civil or criminal liability, as may be applicable. (Section 51[a], Rule XII, Ibid.)

a. Indemnity

In cases where a data subject files a complaint for violation of his or her rights as data subject, and for any injury suffered as a result of the processing of his or her personal data, the Commission may award indemnity on the basis of the applicable provisions of the New Civil Code. (Section 51[b], Rule XII, Ibid.)

b. Criminal prosecution

In case of criminal acts and their corresponding personal penalties, the person who committed the unlawful act or omission shall be recommended for prosecution by the Commission based on substantial evidence. If the offender is a corporation, partnership, or any juridical person, the responsible officers, as the case may be, who participated in, or by their gross negligence, allowed the commission of the crime, shall be recommended for prosecution by the Commission based on substantial evidence. (Section 50[c], Rule XII, Ibid.)


Republic Act No. 10173, Data Privacy Act of 2012

2016 IRR of the Data Privacy Act

Content Details

Disclaimer: All information is for educational and general information only. These should not be taken as professional legal advice or opinion. Please consult a competent lawyer to address your specific concerns. Any statements or opinions of the author are solely his own and do not reflect that of any organization he may be connected. Please refer to our full Disclaimer.

For updates: If the legal provisions being discussed have been amended or repealed by legislation or has been the subject of a Supreme Court decision which may have impacted how it is interpreted, do let us know so we can consider for the next update. Reach out via our Contact Us

Top Read

Question B.15, Labor Law, 2019 Bar Exam

On December 1, 2018, GHI Co., an organized establishment, and Union J, the exclusive bargaining agent therein executed a five (5)-year collective bargaining agreement (CBA)

Videos & Podcasts

Legal Maxims

delegatus non potest delegare

Latin maxim. • “that a delegated power may not be further delegated by the person to whom such power is delegated, and that in all

Falsus in uno, falsus in omnibus

• “false in one thing, false in everything” (Frondarina v. Malazarte, G.R. No. 148423, December 6, 2006) NB: 1) Falsus in uno, falsus in omnibus

nemo tenetur seipsum accusare

Latin maxim. • “No one is bound to accuse himself.” (Google Translate; See Villaflor v. Summers, En Banc, G.R. No. 16444, September 8, 1920) •

in dubio pro reo

Latin maxim. • “when in doubt, for the accused” (People v. Salcena, G.R. No. 192261, November 16, 2011)

distingue tempora et concordabis jura

Latin maxim. • “Distinguish times and you will harmonize laws.” (Commissioner of Customs v. Superior Gas and Equipment Co., En Banc, G.R. No. L-14115, May

See more

Law Content