Philippines: Data Privacy Act vs. EO 119 on Data Residency Requirements

The Philippines is navigating a complex landscape regarding data storage, with the Data Privacy Act of 2012 (DPA) and Executive Order No. 119 (EO 119) issued in 2026 presenting distinct requirements. The DPA, enacted to protect individuals' data, regulates the collection, processing, use, and disposition of personal and sensitive personal information. It places accountability on Personal Information Controllers (PICs) and Processors (PIPs) for implementing safeguards. Crucially, the DPA does not mandate that personal data collected in the Philippines must be stored on servers located within the country. Data can generally be stored and processed abroad, with PICs responsible for ensuring comparable protection levels through contractual means when data is transferred to third parties, domestically or internationally. However, EO 119 introduces a Data Residency Framework specifically for government data. This order extends to private entities handling government data on behalf of agencies, including those in public-private partnerships, public services, critical infrastructure, or strategic projects. EO 119 categorizes government data into "Restricted Access Data" (related to national security) and "Open Access Data." For Restricted Access Data, domestic storage within the Philippines is generally required, subject to Philippine laws and jurisdiction. Cross-border transfers are permitted only within the EO's framework, and must include adequate protection standards by the PIC if personal or sensitive personal information is involved. This divergence means that entities, particularly those involved with government projects or handling sensitive personal data, must carefully assess which regulations apply to their data storage practices. As the Philippines advances in digitalization, balancing data privacy with national security through clear guidelines remains a key challenge.