EO 119: Government Data Classification and Data Residency Framework
Legal question
What is a data residency framework, and does it require government data to be stored only in the Philippines?
Applicable laws and rules to discuss
- Executive Order No. 119, establishing the Data Residency Framework
- Republic Act No. 10173, the Data Privacy Act of 2012
- Republic Act No. 11934, the SIM Registration Act (related data-handling context)
The two classes, and the four tiers inside one of them
Government data is classified into Restricted Access Data and Open Access Data. Restricted Access Data — official matters requiring protection in the interest of national security — carries one of four designations in descending order: Top Secret, Secret, Confidential, and Restricted. Open Access Data is everything not falling within Restricted Access Data and not involving national security; it may be designated Unclassified or Open.
The answer to "must it stay in the Philippines?" is tier-by-tier
All government data remains subject to Philippine law and jurisdiction wherever it is stored. Beyond that: Top Secret data must be stored within Philippine territory or places where the Philippines exercises sovereignty or jurisdiction, such as embassies and consulates. Confidential data must as a general rule be stored in those same places, but may go offshore with the express prior approval of the Joint Oversight Committee for Data Classification and adequate safeguards. Restricted data may sit on a secured cloud platform subject to encryption and cybersecurity requirements. All other data, including Open Access Data, may be stored on secure cloud platforms regardless of the platform's physical location or ownership.
Classification is risk-based, and over-classifying is prohibited
The originating agency determines the classification of data in its custody through a risk-based methodology: inventory of its data, risk and impact assessments including privacy impact assessments where applicable, classification at the highest assessed level of risk, and continuing review with downgrading or declassification when warranted. The Order separately prohibits overclassification, and all classifications, legal bases, and risk assessments must be recorded in a Government Data Classification Registry System developed and maintained by the DICT.
Cross-border transfers and personal data
Cross-border transfers follow the classification framework and implementing guidelines. Where the data contains Personal Information or Sensitive Personal Information, the Principle of Accountability under Section 21 of the Data Privacy Act applies: the Personal Information Controller must guarantee a standard of protection comparable to what RA 10173 requires. The Order also creates administrative liability for violations.
Ask PHLaw.AI
Try: "Does the Data Residency Framework under Executive Order No. 119 require all government data to stay in the Philippines?"