Complying with the Data Privacy Act of 2012
1. Register On Your Own
- For all CGHMC doctors who process patient information.
- Each doctor must register individually with the National Privacy Commission (NPC).
Steps to Register:
-
Create an NPCRS Account:
https://npcregistration.privacy.gov.ph/ - Designate Your DPO: You can be your own DPO or appoint someone else.
- List All Data Processing Systems (DPS): EMR, paper charts, billing, etc. Template examples from SeriousMD
- Prepare Required Information: Clinic details, DPO info, system descriptions, data types, sharing practices, retention periods.
- Complete Registration: Enter details in NPCRS portal.
- Download Certificate & Seal: Display in your clinic.
- Annual Responsibilities: Submit annual reports, conduct Privacy Impact Assessments, update documents, renew registration.
Tip: Approval takes 7–15 days. If you don’t receive feedback, email registration@privacy.gov.ph with your reference number.
2. Appoint Me as Your DPO (Free DPO-as-a-Service)
- Exclusive for CGHMC doctors who want help with NPC compliance.
- Free Service – offered on my own time, after work hours.
- Up to 20 doctors per day (first come, first served; please be patient).
How the Service Works:
- Sign Up: Online registration form (link available on Monday, November 10).
- Prepare & Upload Info: Clinic details, systems, data types, sharing, retention.
- Complete Privacy Impact Assessment: Online form for a tailored privacy policy.
- Appoint Me as DPO: In your NPCRS application.
- Access Online LMS: Self-paced Data Privacy Certification module (optional).
- Receive Updates: I’ll notify you about your registration status and renewal reminders.
What You Get: NPC Certificate & Seal, custom privacy policy, annual reporting, renewal reminders—all handled for you.
Quick Checklist for Both Options
- DPO designated (yourself or me)
- List of all clinics and systems prepared
- Privacy Impact Assessment completed
- NPCRS registration submitted
- NPC Certificate & Seal displayed
- Privacy policy and consent forms updated
- Annual report and renewal reminders set
Useful Links & Resources
Manage Consent
Functional Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.
The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.