5 Pillars of Data Privacy Compliance (Blog Series) – Pillar 3: Write your Privacy Management Program and Privacy Manual

Privacy Management Program (PMP)
A PMP is a holistic approach to privacy and data security protection, important for all agencies, companies or other organization involved in processing of personal data.

Purpose of Establishing a Privacy Management Program
Organization should treat data privacy and protection as part of their corporate governance responsibilities and not just merely a legal compliance requirement. Hence, the formulation of a comprehensive Privacy Management Program is vital to the organization.
The PMP will reduce the risks of privacy breaches its impact to the organization. Effective implementation of the PMP will help you in identifying the root cause of the problems in relation to data privacy.

Key Components of a Privacy Management Program
Summarized Checklist based on the National Privacy Commission (NPC) Toolkit:
A Guide for Management & Data Protection Officers

1. Organizational Commitment
   1. Management Buy In
   2. Accountable and Responsible Persons
   3. Reporting Mechanisms

2. Program Controls
   1. Records of Processing Activities
   2. Risk Assessment
   3. Policies and Procedures
   4. Security Measures
   5. Capacity Building
   6. Registration and Notification
   7. Breach Management
   8. Personal Information Processor and Third Party Management (for PICs)
   9. Communication

3. Continuing Assessment and Development
   1. Oversight and Review Plan
   2. Assess and Revise Program Controls

What is a Privacy Manual?
The Privacy Manual is a document that help ensure organizations that process personal data comply with the requirements for data privacy. The manual should contain policies, procedures and measures for the safety and security of personal data. The PIC (Personal Information Controller) or PIP (Personal Information Processor) is in-change to produce and implement the appropriate measures in protecting personal data as written in the manual.
In the Privacy Manual, it should reflect that it is written and being implemented in compliance with Republic Act No. 10173 or the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations, and other relevant policies, including issuances of the National Privacy Commission.
You can consider including the following sections below in your Privacy Manual as its outline, among others, based on NPC’s website section – Creating a Privacy Manual.

1. Background
2. Introduction
3. Definition of Terms
4. Scope and Limitations
5. Processing of Personal Data
   1. Collection
   2. Use
   3. Storage, Retention and Destruction
   4. Access
   5. Disclosure
6. Security Measures
   1. Organization Security Measures
   2. Physical Security Measures
   3. Technical Security Measures
7. Breach and Security Incidents
   1. Creation of a Data Breach Response Team
   2. Measures to prevent and minimize occurrence of breach and security incidents
   3. Procedure for recovery and restoration of personal data
   4. Notification protocol
   5. Documentation and reporting procedure of security incidents or a personal data breach
8. Inquiries and Complaints
9. Effectivity
10. Annexes

The Privacy Manual, when written properly, will aid you in successful implementation and compliance with Data Privacy Act.

About the Author:

Sarah Vasquez is an experienced ISMS and Data Privacy Practitioner with comprehensive knowledge and extensive expertise gained in both multinational semiconductor manufacturing and information and communications technology industries. She currently holds the lead role in ECC International’s IT Excellence domain.

Know more about her here: https://www.linkedin.com/in/sarahrvasquez

Sources:

1. https://privacy.gov.ph/wp-content/files/attachments/ppt/DPOGOV_PMP.pdf
2. https://www.pcpd.org.hk/pmp/pmp.html
3. https://privacy.gov.ph/creating-a-privacy-manual/
4. https://privacy.gov.ph/wp-content/files/attachments/Privacy-Toolkit-compressedAug152017a.pdf
5. https://privacy.gov.ph/creating-a-privacy-manual/
6. https://privacy.gov.ph/implementing-rules-and-regulations-of-republic-act-no-10173-known-as-the-data-privacy-act-of-2012/