Q: What is the T3 Program?
A: In 2018, the National Privacy Commission (NPC or Commission) launched its Data Protection Officer (DPO) Accountability, Compliance and Ethics (ACE) Program with the aim to establish a skills benchmark for DPOs to address the high demand for adequate capacity-building mechanisms for privacy professionals in the Philippines.
With the initial success of the DPO Level 1 Certification, the PHIL-DPO Program now seeks to expand the scope and breath of the DPO ACE Program through the Training the Trainers Program (T3).
Under the T3 Program, the NPC will give special recognition to trainers who are able to demonstrate the capacity, expertise, and qualifications to educate the public on key concepts and correct interpretation of the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations (IRR), and other NPC issuances. The trainers will likewise be regularly guided by the NPC to ensure that they are kept updated of emerging privacy concepts, trends, and developments.
Q: Who may apply under the T3 program?
A: Application for Institutional Privacy Trainers (“IPT”) is open to both private and public institutions, including government-owned and controlled corporations. Application for Accredited Privacy Trainers (“APT”) is likewise available for individual practitioners or trainers.
Q: Before I apply, what must I consider?
A: The special recognition given by the NPC to trainers is based not only on the capacity, expertise, and qualifications of the trainers, but also on demonstrable proof that their students are competent to be Data Privacy professionals. Following this principle, applicants must meet following obligations during their accreditation:
- To submit training curriculum with course description, objectives and syllabi patterned after existing NPC DPO ACE Training and Certification Program;
- To educate, train or instruct at least three hundred (300) individuals within the duration of the accreditation;
- To ensure at least eighty percent (80%) passing rate of trainees who will undergo the DPO ACE Certification Exam to be conducted by the NPC;
- To submit quarterly reports to NPC as to the progress of training and individuals enrolled;
- To provide NPC with training schedules, meeting links and other means to allow NPC to periodically observe training sessions; and
- To undergo trainings, seminars, and other capacity-building activities that NPC may require for Trainers.
Q: How do I apply for accreditation?
A: The application procedure can be summed in four easy steps:
- Submit your Letter of Intent along with the completed Application Forms by email to [email protected]
- Within fifteen (15) days from the submission of the LOI, submit all the documentary requirements. Digital or scanned copies of your documents may be submitted by email to [email protected] In case you submit digital files, you must also submit the hard copies within thirty (30) days from the submission of the LOI.
- Wait patiently as the NPC audits your submissions.
- After passing the audit, you will be granted an Accreditation Certificate.
The steps for application is provided in detail in the T3 Procedural Guidelines which you may access here.
Q: How do I know if I’m qualified?
A: The applicants must possess the following qualifications to be eligible:
1. Business Registration:
- Department of Trade and Industry (DTI) or Bureau of Internal Revenue (BIR) Registration as training instructor or consultant
- Philippine Regulations Commission (PRC) Registration as trainer or instructor as may be applicable
- Updated Business Permit
- DTI or Securities and Exchange Commission (SEC) Certificate of Registration
- Articles of Incorporation or Partnership indicating training services as the purpose of business
- Other supporting documents showing that the applicant conducts training services
* For government entities, including GOCCs and State Universities and Colleges (SUCs), the Charter shall be in lieu of the foregoing
2. Proof of Training Experience:
- At least one (1) year experience as Trainer, Instructor or Teacher
- Calendar of Activities as Trainer or Instructor
- Proof of operations as training provider for at least one (1) year
- Calendar of Annual Course Offerings or Programs
3. Good Moral Character or Legal Standing
- No pending criminal, civil or administrative case(s) before:
- NPC
- DTI
- BIR
- Courts/quasi-judicial agencies
- No pending criminal, civil or administrative case(s) before:
- NPC
- DTI
- Department of Labor and Employment
- Courts/quasi-judicial agencies
4. Technical knowledge on Data Privacy
- At least twenty-five (25) hours of attended trainings, seminars, orientations, or professional experience in the field of Data Privacy whether conducted by the NPC or external providers
*Preference is given to trainings conducted by the NPC
- Trainers, mentors, and educators of the APT must have at least twenty-five (25) hours of attended trainings, seminars, orientations, or professional experience in the field of Data Privacy whether conducted by the NPC or external providers
*Preference is given to trainings conducted by the NPC
5. Curriculum
- Must submit training curriculum with course description, objectives and syllabi patterned after existing DPO ACE Level 1 Training and Certification Program, or NPC’s 5 Pillars of Compliance. Curriculum must contain essential provisions of the Data Privacy Act, IRR, and NPC issuances.
- Must submit training curriculum with course description, objectives and syllabi patterned after existing DPO ACE Level 1 Training and Certification Program, or NPC’s 5 Pillars of Compliance. Curriculum must contain essential provisions of the Data Privacy Act, IRR, and NPC issuances.
Q: What are the documents that I need to submit?
A: The following documents must be completely submitted to ensure the processing of your application:
- One (1) original, fully accomplished APT Application Form (T3 Form No. 1a S. 2020)
- One (1) original, notarized APT Deed of Undertaking (T3 Form No. 3a S. 2020)
- Photocopies of Business Registration Documents
- Photocopies of documents proving training experience
- One (1) original, notarized Affidavit of Good Moral Character (T3 Form No. 2a s. 2020)
- Two (2) testimonials of good moral character made by two disinterested parties (T3 Form No. 2b s. 2020)
- Photocopies of certificates, documents, and other proof that applicant has at least twenty-five (25) hours of attended trainings, seminars, or orientations relative to data privacy and the Data Privacy Act of 2012, whether conducted by the NPC or external providers
- Original training curriculum with course description, objectives and syllabi patterned after existing DPO ACE Level 1 Training and Certification Program, or NPC’s five (5) Pillars of Compliance which may be reviewed by the NPC. It must contain essential provisions of the Data Privacy Act, its IRR, and NPC issuances (circulars, advisories, bulletins, et.al.)
- Original Proposed Calendar of Training Programs and Activities for DPO ACE Level 1 Program
- Original Proposed schedule of training fees and list of training partners and/ or institutions
- Proof of Technical Capability to train including facilities, relevant subscriptions, software, and other support mechanisms.
- One (1) original, fully accomplished IPT Application Form (T3 Form No. 1b S. 2020)
- One (1) original, notarized IPT Deed of Undertaking (T3 Form No. 3b S. 2020)
- Photocopies of Business Registration Documents
- Photocopies of documents proving training experience
- Original, notarized Secretary Certificate on no pending cases with the agencies mentioned in Section 2
- Photocopies of certificates, documents, and other proof that trainers, educators, mentors assigned by the IPT must have at least twenty (25) hours of attended trainings, seminars, or orientations relative to data privacy and the Data Privacy Act of 2012, whether conducted by the NPC or external providers
- Original training curriculum with course description, objectives and syllabi patterned after existing DPO ACE Level 1 Training and Certification Program, or NPC’s five (5) Pillars of Compliance which may be reviewed by the NPC. It must contain essential provisions of the Data Privacy Act, its IRR, and NPC issuances (circulars, advisories, bulletins, et.al.)
- Proposed Calendar of Training Programs and Activities for DPO ACE Level 1 Program
- Original Proposed schedule of training fees and list of training partners and/ or institutions
- Company profile, list of clients, and list of Speakers, mentors, educators
- Proof of Technical Capability to train including facilities, relevant subscriptions, software, and other support mechanisms.
Q: What is the existing DPO ACE Curriculum?
A: Applicants must submit a training curriculum with course description, objectives and syllabi patterned after NPC’s DPO ACE Level 1 Certification as follows:
Aspects of Informational Privacy
Definition
Policy, Scope, Mandate and Functions
Key Terms
Data Privacy Principles
Security Measures (Organizational, Technical, Physical)
Rights of the Data Subject
Consequences of Complaints Filed
Transparency; Right to Information
Privacy Notice
Role of DPO in Transparency
Right to Access
Principle of Legitimate Purpose
Consent
Legitimate Purpose in Processing including SPI
Compliance Framework
Data Subject’s Rights
Principle of Proportionality
Legal Basis
General Qualifications
COP
Instances where a PIC or PIP is allowed to designate a COP
Position of a DPO or a COP in the Organization
Conflict of Interest
Confidentiality
Subcontracting
Independence and Autonomy
Duties and Responsibilities
Supporting the DPO
Definition and Scope
Objectives of Conducting a PIA
When is PIA Necessary?
Is PIA Required?
Benefits of PIA
Components of PIA
Stakeholder Involvement in PIA
Records of Processing Activities
PIA and Privacy By Design
PIA Provides an Initial Step Towards Accountability
Data Life Cycle
Determination of Security Measures
Identifying and Rating Privacy Risks
Privacy Risk Mapping
Approaches to Risk Management
Duty of DPO in Relation to PIA
PIA Process
Five Pillars of NPC
The Data Privacy Accountability and Compliance Framework
Compliance with the DPA
What is PMP?
PMP Objectives
Importance of a PMP
PMP Guide
Key Components
WHAT DOES A PMP LOOK LIKE?
Governance, DPO, Records of Processing Activities, Risk Assessment, Registration, Policies and Procedures, Data Security, Capacity Building, Breach Management, Notification, Third Party Management, Communication, Understanding of Privacy Ecosystem, Oversight and Review Plan, Assess and Revise Program Controls
Supporting Documents of a PMP
Security Measures
Organizational Security Measures: Examples, Compliance Officers, Data Protection Policies, Records of Processing Activities, Management of Human Resources, Processing of Personal Data, and Contracts with PIPs
Physical Security Measures
Technical Security Measures
Examples involving Consent and DSA (NPC Circ 16-02)
Managing Third Party Risks
General Principles for Data Sharing
When Consent of Data Subject is Required
Contents of a DSA
When is a DSA Considered Terminated
Outsourcing/Subcontracting
Outsourcing Agreement
Definition of Terms
Personal Data Breach Management Guidelines
Security Incident Management Policy
Data Breach Response Team
Implementation of Security Measures and Privacy Policies
Mandatory Notification/Requirements
Contents of the Notice
Full Report
Concealment or Failure to Disclose
Annual Security Incident Report
How to File an Annual Report
NPC Circular 18-01
NPC Circular 18-02
Q: Can we add data privacy topics other than those provided by NPC?
A: Yes, trainers may add topics to their training module in addition to the DPO ACE Level 1 curriculum provided the main topics in DPO ACE level 1 are reflected in the submitted training modules. The NPC will also review the additions to determine whether these are aligned with NPC standards.
Q: What do I need to prepare and submit to NPC?
A: As part of NPC’s function to continuously assess your performance, you are required to:
- Submit a quarterly report to be submitted within 30 days into the new quarter. The report should contain, among others, the following details:
- Name of Training Provider
- Accreditation Number
- Date(s) and Venue(s)
- Attendance sheets
- Group photo(s)
- Speakers, Mentors, Educators who conducted the training
- Prepare a summary report of the speaker’s evaluation of each training session which should be made available to NPC upon request.
Q: Can we transfer authority of provisional accreditation to other persons/entities?
A: No. Provisional accreditation awarded by is exclusive to the accreditee. It may not be transferred or assigned and you should not allow other individuals, entities, or organizations to benefit from the accreditation afforded by NPC.
Q: How long is my accreditation valid?
A: The recognition is valid for a period of one (1) calendar year counted from the date of accreditation
Q: Do we need to file for renewal? When?
A: Yes. Renewal should be within 60 business days before expiration of the current provisional accreditation. If you do not renew, your accreditation will automatically expire.
Q: Is the T3 Program meant to prohibit or exclude other Training Providers from holding their respective Data Privacy Trainings?
A: No. We, at NPC, acknowledge capacity-building as a powerful approach to create the critical mass of data privacy professionals and advocates who, in turn, will promote the culture of privacy nationwide. The recognition accorded by the NPC through the T3 Program encourages harmony of all training providers with the DPO ACE and is not intended to create exclusivity.
Q: Is the T3 Program meant to replace the NPC DPO ACE Program?
A: No. The T3 Program is a complementary and adjunct program to the NPC DPO ACE Program. The training that will be conducted by trainers recognized under the T3 Program will conform with existing curricula provided by the NPC DPO ACE Level 1. The T3 Program will also be opened to trainers of DPO ACE Levels 2 and 3 in the near future. This ensures that trainings conducted by the accredited trainers are aligned with NPC standards. Moreover, the NPC DPO ACE will regularly train the accredited trainers to ensure that they are kept updated of emerging privacy concepts, trends, and developments.
Q: Will NPC still conduct free PHIL-DPO ACE Level 1 Trainings in view of the T3 Program?
A: The NPC will continue to conduct DPO ACE Level 1 Trainings for the government sector. This is in line with NPC’s enhanced drive to increase government compliance, competitiveness, and privacy culture as the government moves towards the digitization of public services.
Q: I want to learn more.
A: If you want to learn more about the T3 Program and its specific provisions, you may download the T3 Procedural Guidelines in this link: T3 Procedural Guidelines.
