Data Processing System is a documented structure and procedure that describes how personal data is collected, stored, processed, and managed within an information and communications system or filing system. In the Philippine context, Personal Information Controllers (PICs) and Personal Information Processors (PIPs) must register their data processing systems with the National Privacy Commission under Republic Act No. 10173 (Data Privacy Act of 2012).
Key Components
A compliant data processing system documentation includes:
- Personal data inventory — Categories of data subjects and types of personal data collected
- Purpose specification — Clear statement of why data is being processed
- Data flow documentation — How personal data moves through the organization
- Security measures — Technical and organizational safeguards for data protection
- Retention policies — How long personal data is stored and disposal procedures
- Third-party disclosures — Recipients or categories of recipients who may access the data
- Cross-border transfers — Documentation of any international data transfers
How it Works
For real estate brokerages in the Philippines, implementing a data processing system follows this workflow:
- Data mapping — You identify all personal data you collect from clients, agents, and property owners (names, contact details, financial records, government IDs)
- Purpose definition — You document why each type of data is collected (property transactions, commission processing, regulatory compliance)
- Security implementation — You establish access controls, encryption, and backup procedures
- Policy creation — You draft data governance policies covering privacy, security, and breach response
- NPC registration — You submit your system details through the NPC Registration System with a designated Data Protection Officer
Pros & Cons
Advantages:
- Legal compliance with DPA 2012 and NPC regulations
- Reduced risk of data breaches and associated penalties
- Improved client trust through transparent data handling
- Streamlined audit processes with documented procedures
Disadvantages:
- Initial setup requires time and organizational resources
- Registration fees apply (PHP 500 to PHP 2,500 depending on organization scope)
- Ongoing maintenance needed as processes change
- Requires dedicated personnel (DPO) for compliance monitoring
Who is Required to Register?
Registration with the NPC is mandatory if your real estate brokerage meets any of these criteria:
- Processes sensitive personal information of at least 1,000 individuals
- Employs 250 or more persons
- Employs fewer than 250 persons but processing is not occasional, or poses risk to data subjects' rights
Real-World Application
For Philippine real estate brokerages using property management software, a data processing system ensures you handle client information lawfully. When collecting buyer details for a reservation fee transaction, your system should document:
- What personal data you collect (valid IDs, TIN, contact information)
- How agents access this data through role-based access controls
- Where data is stored (cloud servers, local databases)
- Who can view sensitive documents like TCT copies
- How long you retain records after transaction completion
This documentation also supports your brokerage during DHSUD or NPC compliance audits.
Related Terms
- Data Privacy Act of 2012
- Data Protection Officer
- Personal Information Controller
- Sensitive Personal Information
- National Privacy Commission
References
Looking for another term? Browse the full glossary.
Back to Glossary