Data Privacy Addendum Template for Philippines

The Data Privacy Addendum is essential for organizations operating in or with the Philippines that engage in personal data processing activities. This document is required when one party (typically a service provider) processes personal data on behalf of another party under Philippine jurisdiction. It ensures compliance with the Data Privacy Act of 2012 and its implementing rules and regulations, as enforced by the National Privacy Commission. The addendum should be used whenever there is a primary agreement involving personal data processing, such as service agreements, cloud computing contracts, or outsourcing arrangements. It details critical aspects including security measures, data breach protocols, cross-border transfer requirements, and data subject rights management. The document is particularly important given the strict penalties for non-compliance with Philippine privacy laws and the increasing focus on data protection globally.

1. Parties: Identification of the data controller and data processor, including their registered addresses and authorized representatives

2. Background: Context of the relationship between parties and purpose of the addendum in relation to the main agreement

3. Definitions: Key terms used in the addendum, aligned with definitions from the Philippine Data Privacy Act

4. Scope and Purpose of Processing: Detailed description of the personal data to be processed and the specific purposes for processing

5. Obligations of the Data Processor: Comprehensive list of processor's responsibilities including security measures, confidentiality, and compliance with instructions

6. Obligations of the Data Controller: Controller's responsibilities including providing clear instructions and ensuring lawful basis for processing

7. Data Security Measures: Required technical and organizational security measures in accordance with Philippine regulations

8. Confidentiality: Confidentiality obligations of both parties regarding personal data processed

9. Data Breach Notification: Procedures and timeframes for reporting data breaches as per NPC requirements

10. Audit Rights: Controller's rights to audit processor's compliance and processor's obligation to cooperate

11. Data Subject Rights: Procedures for handling data subject requests and respective responsibilities

12. Term and Termination: Duration of the addendum and conditions for termination

13. Return or Deletion of Data: Obligations regarding personal data upon termination of services

14. Liability and Indemnification: Allocation of liability and indemnification obligations between parties

15. Governing Law and Jurisdiction: Specification of Philippine law as governing law and jurisdiction for disputes