Section 20 of the Data Privacy Act is a provision under Republic Act No. 10173 that mandates personal information controllers to implement reasonable and appropriate organizational, physical, and technical measures to protect personal information against accidental or unlawful destruction, alteration, disclosure, and other forms of unlawful processing.
Key Provisions
Section 20 establishes comprehensive security requirements across multiple dimensions:
- Organizational measures: Security policies, employee training, and confidentiality obligations for personnel handling personal data
- Physical measures: Protection against natural dangers (accidental loss, destruction) and human dangers (unauthorized access, fraudulent misuse)
- Technical measures: Safeguards for computer networks, vulnerability identification processes, and regular security breach monitoring
- Third-party accountability: Controllers must ensure processors implement equivalent security measures
- Breach notification: Mandatory notification to the National Privacy Commission and affected data subjects when sensitive personal information is compromised
Specific Security Requirements
Under Section 20(c), organizations must implement:
- Safeguards protecting computer networks against accidental, unlawful, or unauthorized usage
- A documented security policy for processing personal information
- Processes for identifying and accessing reasonably foreseeable vulnerabilities
- Regular monitoring for security breaches with preventive, corrective, and mitigating action protocols
Who is Affected?
- Real estate brokerages and property management companies handling client data
- Property developers maintaining buyer information databases
- Real estate service practitioners licensed under RA 9646
- Financial institutions processing mortgage and payment information
- Any organization processing personal information of Philippine citizens or residents
Penalties
Failure to comply with Section 20 security requirements can trigger penalties under the Data Privacy Act's Chapter VIII:
| Violation | Imprisonment | Fine (PHP) |
|---|---|---|
| Unauthorized processing | 1-3 years | 500,000 - 2,000,000 |
| Access due to negligence | 1-3 years | 500,000 - 2,000,000 |
| Concealment of security breaches | 1.5-5 years | 500,000 - 1,000,000 |
| Large-scale violations (100+ persons) | Maximum penalty | Maximum fine |
Relevance to Philippine Real Estate
For real estate organizations, Section 20 compliance requires:
- Securing client personal information (names, contact details, valid IDs)
- Protecting sensitive financial data (income statements, bank records for loan applications)
- Implementing access controls for property transaction records
- Maintaining audit trails for data privacy compliance
- Establishing breach notification procedures with the NPC
Real estate platforms must ensure that CRM systems, client management databases, and sales document management tools implement the security measures required under this provision.
Related Terms
- Data Privacy Act of 2012
- National Privacy Commission
- Personal Information Controller
- Data Subject Rights
- Privacy Impact Assessment
References
- Republic Act 10173 - Data Privacy Act of 2012 (Official Text) - LawPhil
- National Privacy Commission - Wikipedia
Looking for another term? Browse the full glossary.
Back to Glossary