UPKLYAK/FREEPIK
Since the promulgation of the Implementing Rules and Regulations for the Data Privacy Act (DPA) on Aug. 24, 2016, the National Privacy Commission (NPC) has always emphasized that one of the guiding principles of the DPA is the empowerment of individuals to have reasonable control over the flow of their personal data.
To address frequently recurring questions regarding the rights of data subjects under the DPA, the NPC issued Advisory No. 2021-01 on Jan. 29 this year. The Advisory now explicitly provides that Personal Information Controllers (PICs) are required to implement a clear, simple, straight-forward, and convenient procedure to allow data subjects to exercise their rights, including the use of request forms and measures to verify the identity of the requesting data subjects. PICs are also not allowed to charge any fee to fulfill the exercise of data subject rights, (except reasonable fees for requests for copies of personal information), and must comply with requests within a period not exceeding 30 working days.