NPC launches online registration platform

MANILA, Philippines — The National Privacy Commission (NPC) has launched an online registration platform aimed at making its services more effective and efficient.

The agency  launched yesterday the NPC Registration System (NPCRS), which aims to provide a secure and seamless portal for government and private organizations to register their data processing systems with the commission.

The NPC said the implementation of the NPCRS would provide ease of monitoring requests/approval of registration applications, and provide a secure portal for the registration monitoring unit to access registration data using role-based access control.

The system will also give real-time visibility in the validation of documentary requirements and provide accurate collection of sectors and subsectors information, accurate verification of active/inactive registration and efficient retrieval of contact details of the Data Protection Officer (DPO) as well as provide easy generation of documents.

“The call for digitalization of government services by the current administration triggered the launching of the NPCRS this February, and the Data Breach Notification Management System (DBNMS) last April 2022,” NPC commissioner John Henry Naga said.

According to the NPC, the new system allows personal information controllers (PICs) and processors (PIPs), through their data protection officers (DPOs), to comply with the registration requirements provided in the Data Privacy Act (DPA) of 2012 and its Implementing Rules and Regulations (IRR).

Naga said information on data processing systems owned by PICs and PIPs allows the NPC to have a more efficient compliance monitoring process.

“Through the NPCRS, the data processing activities of PICs and PIPs will be effectively and efficiently monitored. Through this system, compliance with the Data Privacy Act of 2012 will be ensured and our endeavor to protect the personal data of every Juan and Juana will be fortified,” he said.

Meanwhile, NPC Compliance and Monitoring Division chief Rainier Anthony Milanes said the new circular on registration aims to address the issues encountered in implementing the old circular such as common or multiple DPOs.

“It also provides new regulations such as the requirement to display the NPC Seal of Registration, which will provide data subjects the needed assurance that entities processing their personal data have completed the first level of DPA compliance,” Milanes said.

The NPC Seal of Registration will be issued simultaneously with the Certificate of Registration.

Section 5 of NPC Circular 2022-04 provides for the mandatory registration of a PIC or PIP that employs 250 or more persons, or those processing sensitive personal information of 1,000 or more individuals, or those processing data that will likely pose a risk to the rights and freedoms of data subjects, to register all Data Processing Systems.

Milanes said that adherence to the data privacy principles of transparency, legitimate purpose, and proportionality were one of the cornerstones in developing the NPCRS.

“The registration system was developed using Privacy by Design and Development, Security, and Operations (DevSecOps). Privacy Impact Assessments were conducted during planning, before implementing changes concerning personal data processing, and before the system goes live,” he said.