Employer guidelines on data privacy

Republic Act No. 10173, also known as the Data Privacy Act (DPA), was enacted on 15 August 2012. Subsequently, the National Privacy Commission (NPC) promulgated the Implementing Rules and Regulations (IRR) on 24 August 2016, and they took effect on 9 September 2017.

Although the DPA is not a labour or social legislation per se, it has several provisions that pertain, or have an impact on, the employer-employee relationship. For one, it is necessary for an employer to collect, store, update and in some instances share personal information, especially sensitive personal information of its employees, in relation to human resources management.

From the application of prospective employees until their severance from employment, employers collect and update personal information to process employee benefits, payment of salaries, filing of tax returns, remittance of contributions to government agencies, etc. Such collection and updating of personal information is within the scope of “processing”, which, in simple terms, is defined by the IRR as any operation performed upon personal data.

Neptali B Salvanera is a partner in the Labour and Employment Department of ACCRA Law Offices