Data Privacy Act Security Measures: What the NPC Expects to See

The Data Privacy Act does not hand you a checklist of technical controls. It asks for security measures that are reasonable and appropriate for the personal data you hold, and it expects you to be able to show they work. In Microsoft 365 and Azure, that comes down to a handful of controls you can configure, test and document.

The short answer

The Data Privacy Act of 2012 (RA 10173) requires organisations that handle personal information to put in place organisational, physical and technical security measures. Its implementing rules describe what the technical side must cover: network safeguards, the ability to keep systems confidential, intact and available, monitoring for breaches and vulnerabilities, timely restoration after an incident, regular testing of your controls, and encryption, authentication and access control. NPC Circular 2023-06, in force since 30 March 2024, adds more detailed security rules for both government and private organisations, but it still leaves the choice of specific controls to you.

What decides whether your measures were "reasonable" is evidence: the settings you applied, the logs that prove they work, and a record of what you found and fixed.

Why "reasonable and appropriate" is harder than a checklist

A checklist can be ticked once and filed. "Reasonable and appropriate" is judged later, usually by someone else, and usually at an inconvenient moment.

The first moment is a breach. If sensitive personal information, or information that could enable identity fraud, is likely to have been taken and there is a real risk of serious harm, the National Privacy Commission and the affected people must be notified within seventy-two hours. In the investigation that follows, the question is whether your security was reasonable for what you held. That is very hard to argue without records.

The second moment is a client's procurement team. Larger companies and government agencies increasingly send security questionnaires before they award a contract: how do you control access, do you encrypt, how long do you keep logs, what is your incident process? "We use Microsoft 365" is not an answer to any of those questions.

What the rules ask for on the technical side

Section 28 of the implementing rules lists the technical measures in general terms. In plain language, you are expected to have:

• A security policy covering how personal data is processed.
• Network safeguards against unauthorised use, interference and access.
• Confidentiality, integrity, availability and resilience of the systems that process personal data.
• Regular monitoring for security breaches, and a process for finding and acting on vulnerabilities.
• The ability to restore personal data in a timely way after a physical or technical incident.
• Regular testing and evaluation of whether your security measures actually work.
• Encryption of personal data in storage and in transit, plus authentication and other controls that limit access.

NPC Circular 2023-06 replaced the older circular that covered government agencies only, and now applies to private organisations as well. It covers access control, logs retention, threat monitoring and vulnerability management, privacy by design and by default, and business continuity. The Commission's own FAQ on the Circular notes that a username and password alone may not be sufficient for access to an internal network.

What that looks like in Microsoft 365 and Azure

Microsoft secures its datacentres and the platform. How your tenant is configured, and who can reach what, is your responsibility. These are the areas we check first.

Access control

Multi-factor authentication enforced for every user, not just switched on and left optional. Conditional Access policies that block legacy sign-in methods and risky sign-ins. Separate administrator accounts, a short list of people holding privileged roles, and a regular review of guest accounts. The evidence is your policy configuration, the sign-in logs showing it applied, and a current list of role assignments. Our article on MFA enabled versus MFA enforced covers the most common gap.

Encryption in storage and in transit

Microsoft 365 and Azure Storage encrypt data at rest in Microsoft's datacentres and in transit by default. The gaps sit at the edges: laptops without disk encryption, confidential files that leave the tenant as ordinary attachments, and Azure resources that are reachable from the internet when they should not be. Device compliance reports, sensitivity labels on confidential files, and a review of what is publicly exposed in Azure are the evidence here.

Logging and retention

Microsoft Purview keeps standard audit records for 180 days. Longer retention needs higher licences, and multi-year retention needs an add-on on top of those. Decide how long your organisation needs logs, confirm auditing is on, and make sure the retention you pay for matches the period you decided. The Circular has its own provisions on logs retention, so agree the period with your Data Protection Officer.

Monitoring and vulnerability handling

Security alerts are only useful if a named person reviews them. The same goes for vulnerability reports from endpoint and cloud security tools. The evidence is a record that alerts were reviewed and that findings were patched or accepted with a reason.

Backup and restore

Retention policies and recycle bins are not the same as an independent backup. The rules ask you to restore personal data in a timely way, which you can only show by testing a restore and writing down how long it took.

Incident response

Someone must be able to decide, quickly, whether an incident triggers the seventy-two hour notification, and someone must be named to prepare it. Our one-page incident response plan sets out who decides what.

Turning settings into evidence

The work is the same whether the request comes from the Commission, an auditor or a client:

1. Find where personal data sits. Mailboxes, SharePoint sites, Teams, OneDrive, Azure databases and the laptops that sync them.
2. Assess the configuration against the measures above, area by area.
3. Fix the highest-risk gaps first. Unenforced MFA and broad administrator access usually come before anything else.
4. Record what changed and when. A dated remediation log is often the most persuasive document you have.
5. Test again on a schedule, and after any major change such as a migration, a merger or a new system.
6. Keep a short evidence pack ready so the next questionnaire takes an afternoon, not a fortnight.

Frequently asked questions

Does the Data Privacy Act apply to small businesses?

Yes. Whether you must register with the National Privacy Commission depends on thresholds such as headcount and the volume of sensitive personal information you process, but the duty to protect personal data with reasonable security measures applies whether or not you have to register.

Does using Microsoft 365 make us Data Privacy Act compliant?

No. Microsoft secures the platform, but the configuration of your tenant, who has access, and how your staff use it are your responsibility. A well-configured tenant gives you strong evidence; a default one gives you very little.

Is multi-factor authentication required by the Data Privacy Act?

The Act does not name specific controls. Access control is expressly among the technical measures, and the Commission's FAQ on NPC Circular 2023-06 says a username and password alone may not be sufficient. Enforced multi-factor authentication is the accepted baseline.

Do we need a third-party certification?

The Commission does not accredit third-party auditors, and Circular 2023-06 does not require independent certification. What you need is evidence that you assessed your risks and acted on what you found.

How often should we review our security measures?

The rules ask for regular testing without fixing a frequency. A full review at least once a year, plus a check after any significant change to your systems, is a sensible starting point for most organisations.

This article is general information, not legal advice. Confirm your specific obligations with your Data Protection Officer or legal counsel.

Where to start

Onprem2Cloud IT Solutions Co. is a Microsoft CSP partner based in Muntinlupa City, Metro Manila. We assess Microsoft 365 and Azure environments against the technical measures the National Privacy Commission expects to see: access control, encryption in transit and at rest, logging and retention, and documented incident response. You receive a findings report with specific remediation steps, and a record of what was fixed.

See our cybersecurity services, or contact us to plan an assessment. For more on how an assessment begins, read who has access to what.