Deadline for NPC Compliance is still on July 2, 2018

The National Privacy Commission has DENIED with finality the petition of the various medical subspecialty societies to exempt individual doctors from registering their data processing systems.

Registration of Data Processing Systems by Physicians

NOT ALL PHYSICIANS ARE REQUIRED TO REGISTER.

The registration of data processing systems is required for those personal information controllers (PIC), such as individual physicians, falling under any of the following condition(s):

  1. those physicians who employ at least two hundred fifty (250) or more employees; or
  2. those physicians who process sensitive personal information of at least one thousand (1,000) individuals;

Note: Processing under the Data Privacy Act refers to any operation or set of operations performed upon personal information including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data.

            Should a physician fall under any of the above criteria, he or she is required to register his data processing systems at the NPC website, privacy.gov.ph/registration/ on or before 2 July 2018. The registration process involves two (2) phases:

             Phase 1 of the registration of data processing systems involves the designation of the PIC’s Data Protection Officer (“DPO”). In this case, the individual physician as a PIC is the de facto DPO. The form for the registration is available here.

  1. Fill up the pdf form using Abode Acrobat.
  2. for PROFESSION, type PHYSICIAN, and input your PRC license number
  3. complete demographic data
  4. email address and cellphone number will be used as official contact channels
  5. save file as <last name><firstname><middle initial>_dpo.pdf (eg. delossantosmariaclarap_dpo)
  6. print out and sign the document
  7. scan and save the signed document using the syntax <last name><firstname><middle initial>_dpo_scanned.pdf (eg. delossantosmariaclarap_dpo_scanned)
  8. email both files to: This email address is being protected from spambots. You need JavaScript enabled to view it.

             Phase 2 of the registration involves the actual registration of a physician’s data processing systems online. After the Phase 1 registration, he or she will receive an email from the NPC, as well as instructions on how to register his or her data processing systems.

            We note that physicians who do not meet any of the aforementioned criteria for mandatory registration but decide to register are encouraged to do so under the voluntary registration option.

Additional information available at the National Privacy Commission website

www. privacy.gov.ph/registration

DATA PROTECTION OFFICER REGISTRATION FORM

TFI Series