Data Processing Contract Template for the Philippines

A Data Processing Contract is a legally binding agreement required under Philippine law when organizations engage third parties to handle personal data on their behalf. Under the Data Privacy Act of 2012 (Republic Act No. 10173), this contract establishes the relationship between a data controller (the organization that owns or controls the data) and a data processor (the service provider processing the data), ensuring compliance with strict national privacy regulations.

When do you need this document?

You need this contract whenever your organization outsources any personal data processing activities to external service providers. This includes engaging cloud storage providers, payroll processing companies, customer service centers, IT support services, marketing agencies, or accounting firms that will handle personal information. The contract is also required when working with sub-processors, such as when your primary data processor engages additional third parties. Philippine law mandates this agreement before any personal data processing begins, making it essential for legal compliance and avoiding penalties from the National Privacy Commission.

Key legal considerations

The contract must clearly define the scope and purpose of data processing, specifying exactly what personal data will be processed and for what purposes. You must include robust data security measures, confidentiality obligations, and detailed procedures for data breach notification. The agreement should establish audit rights, allowing you to verify the processor's compliance with Philippine privacy laws. Data retention and deletion requirements must be explicitly stated, along with procedures for returning or destroying data when the contract ends. The contract must also address sub-processor arrangements, requiring your written consent before any additional parties handle your data. Cross-border data transfer provisions are crucial if data will be processed outside the Philippines.

Legal requirements in Philippines

Under the Data Privacy Act of 2012 and its Implementing Rules and Regulations, the contract must ensure the data processor implements appropriate technical and organizational security measures to protect personal data. The processor must assist you in responding to data subject requests, including access, correction, and deletion requests. The agreement must include provisions for immediate breach notification, typically within 72 hours of discovery. The contract should specify that the processor will only process data according to your documented instructions and will not use the data for its own purposes. Philippine law also requires that the processor maintains records of all processing activities and makes these available for regulatory inspection. The National Privacy Commission may require specific contractual clauses, and failure to include mandatory provisions can result in significant penalties ranging from PHP 500,000 to PHP 5,000,000 for serious violations.