The Philippines' Data Privacy Act of 2012 (Republic Act 10173) exempts personal information that was originally collected from residents of foreign jurisdictions, under those jurisdictions' laws, and is being processed in the Philippines. That exemption is the reason Philippine outsourcing firms can handle US, Canadian, and Australian customer data without applying Philippine consent rules to it. It does not remove the duty to secure the data, and it does not replace the privacy laws and contracts that bind you at home.
MSP owners and their clients ask a version of the same question when staff in the Philippines will touch client systems: which privacy rules apply, and who is responsible if something goes wrong. This post sets out what the Philippine law says about foreign-resident data, what security measures it expects regardless, what Australian and Canadian regulators expect of the business that sends work offshore, and what the contract between you and your provider should contain. It is general information and not legal advice, and a regulated client or an unusual arrangement warrants advice from counsel in the relevant country.
What the Philippine Law Says About Foreign Data
Section 4 of the Data Privacy Act, published by the National Privacy Commission, lists the categories of information the Act does not apply to. Paragraph (g) covers personal information originally collected from residents of foreign jurisdictions in accordance with the laws of those jurisdictions, including any applicable data privacy laws, which is being processed in the Philippines. For an MSP, that describes the typical case: a US dental practice's patient records, collected under US law, are accessed by a technician in Manila who is fixing a workstation.
The details in the implementing rules matter more than the headline. The Implementing Rules and Regulations, in Section 5, repeat the foreign-resident exemption and add three conditions. First, the burden of proving the foreign law falls on the person or body seeking the exemption, and without proof the Act and the Rules are presumed to apply. Second, the exemption does not extend to controllers or processors, who remain subject to the requirements for implementing security measures to protect personal data. Third, the exempted processing is excused from the Act only to the minimum extent necessary for the specific purpose. Section 6 adds that anyone claiming non-applicability carries the burden of showing it, and that exemptions are interpreted in favor of the data subject.
Put together, these provisions say that you cannot treat Philippine privacy law as irrelevant to your arrangement. The exemption depends on the data having been collected lawfully under the client's home law, you may need to show that, and the security obligations apply either way. The exemption also does not reach data about Philippine residents, which includes the personal data of your own Filipino staff.
The Security Obligations That Apply Either Way
Since the security requirements survive the exemption, it is worth knowing what they are. Rule VI of the Implementing Rules sets out organizational, physical, and technical measures, and they read like the controls an MSP already expects from its own staff. The table below summarizes them and translates each into a question for a provider.
| Measure | What the Philippine rules call for | What to ask about remote technicians |
|---|---|---|
| Organizational | A designated data protection or compliance officer, written data protection policies, records of processing activities, careful selection and supervision of staff with access, confidentiality that continues after employment ends, and training | Who is the accountable person, where are the policies, and can you see training records and signed confidentiality terms |
| Physical | Limits on who can use the workstation, rules for transfer, disposal, and reuse of electronic media, and workstations secured as far as practicable against disasters and power disturbances | What applies to home-based staff, including managed devices, screen privacy, no local storage of client data, and secure disposal |
| Technical | A security policy, network safeguards, regular monitoring for breaches and vulnerabilities, the ability to restore data, regular testing of controls, encryption in storage and in transit, and authentication and access controls | How access is authenticated and logged, whether devices are encrypted, and who reviews the logs |
| Contracts with processors | The party that engages a processor must use contracts to make sure the processor applies the same measures | Whether the contract binds the provider and its staff to the security terms you owe your own clients |
None of this is unusual for a competent MSP. The practical value is that these are the standards a Philippine regulator would point to, so a provider's answers to these questions say something about how it operates.
What Your Home-Country Rules Add
The Philippine layer matters less than the one where your clients live. The business that sends the work offshore is usually the one regulators hold responsible, and the major English-speaking privacy regimes all say so.
In Australia, the Office of the Australian Information Commissioner's guidance on Australian Privacy Principle 8, updated in October 2025, says an entity that discloses personal information to an overseas recipient must take reasonable steps to ensure the recipient does not breach the Australian Privacy Principles, and that it is accountable for the recipient's acts or practices that would breach them. The guidance says that where an entity engages an overseas contractor to perform services on its behalf, providing personal information to that contractor is in most circumstances a disclosure. In limited circumstances it may be a use instead, which applies where the entity keeps effective control, with a binding contract limiting the contractor's handling, matching obligations for any subcontractors, and the entity's continuing ability to access, change, retrieve, and delete the information. The guidance also says accountability can remain even where the entity took reasonable steps, and that the entity is generally expected to have an enforceable contract with the overseas recipient. The OAIC lists exceptions, such as a recipient subject to a substantially similar law or an individual's informed consent, but each carries conditions, and the entity must be able to justify a belief that an exception applies.
In Canada, the Office of the Privacy Commissioner's guidelines on processing personal data across borders explain that PIPEDA does not prohibit transferring personal information to another jurisdiction for processing, but holds organizations accountable for the information under each outsourcing arrangement. Principle 4.1.3 requires contractual or other means to provide a comparable level of protection while a third party processes the information, and the OPC says contract is the primary means. The United States has no single general privacy statute, so your obligations come mainly from sector rules such as HIPAA for health data, state laws, and the contracts your clients sign. For a US MSP, the client agreement and any business associate agreement are usually the controlling documents.
| Jurisdiction | What the guidance says | What it means for an MSP with offshore staff |
|---|---|---|
| Philippines | Foreign-resident data collected under foreign law is exempt, the party claiming the exemption must prove the foreign law, and security measures still apply | Keep a record that client data was collected under home-country law, and expect your provider to meet the security rules |
| Australia | The entity must take reasonable steps and remains accountable for an overseas recipient's breaches | Use an enforceable contract, keep effective control of the data, and cover subcontractors |
| Canada | Transfers for processing are allowed, and the organization remains accountable and must provide comparable protection by contract or other means | Put the protections in the contract and keep records of oversight |
| United States | No single general privacy statute, so sector rules, state laws, and client contracts govern | Read each client agreement and business associate agreement for restrictions on offshore access |
The rules also change. The OAIC's guidance notes an exception for recipients in countries prescribed by regulation, introduced by the Privacy and Other Legislation Amendment Act 2024 and applying to information disclosed from 11 December 2024. That is one reason to treat the contract and your own controls as the stable foundation, and the legal analysis as something to refresh when the rules move.
What the Contract Should Contain
The Philippine Implementing Rules set out in Section 44 what an outsourcing agreement between a controller and a processor must stipulate, and the list is a useful reference even where the foreign-data exemption applies, because it overlaps with what Australian and Canadian guidance expect. First, the contract should state the subject matter and duration of the processing, its nature and purpose, the types of data and categories of people involved, and the geographic location of the processing. Second, it should require the processor to act only on documented instructions, including on any transfer of the data to another country, and to keep the data confidential through staff who are bound by confidentiality obligations.
Third, it should require appropriate security measures and prohibit engaging another processor without prior instruction, with the same obligations passing down to any approved subcontractor. Fourth, it should require help with data subject requests and with demonstrating compliance, and give the controller audit rights. Fifth, it should require the processor to delete or return the data when the services end, and to tell the controller if an instruction would breach the law. The OAIC adds two items that are worth including whatever your home country: a privacy complaint-handling process, and a data breach response plan that includes notifying you when a breach is suspected. Whoever drafts the paperwork, the point is that the obligations you owe your clients should reach the people doing the work.
Controls That Reduce Exposure Whatever the Law Says
Legal analysis tells you what you owe. Technical design reduces what can go wrong, and it also supports the argument that you kept effective control of the data, which the OAIC treats as relevant. Give each technician a named account with multi-factor authentication and the minimum permissions the role needs. Keep client data in systems you administer rather than on personal devices, and use managed laptops with disk encryption and no local storage of client data. Log activity in your PSA and RMM and review it, retain the ability to revoke access immediately, and run a same-day offboarding procedure. Require signed confidentiality terms that survive the end of employment, which the Philippine rules also call for, and keep training records.
These measures cost little compared with a breach, and they are the same ones Konnect's guide to data security in outsourcing and its piece on managing risk when hiring offshore teams discuss from the operational side. In the Konnect model, placed technicians work inside your existing tools, so access control and logging stay in systems you administer. That helps, but it does not replace the contract or your own review.
Questions to Ask Any Provider
These apply to any provider, including us. First, who is the employer of the technician, and who is accountable for data protection, including a named person responsible for compliance. Second, how do you handle client data, what controls apply to home-based staff, and can you show them. Third, what do your confidentiality terms say, and do they continue after employment ends. Fourth, how quickly will you tell me about a suspected incident, and what does your breach response plan involve. Fifth, do you use subcontractors or additional processors, and how do you control them. Sixth, what happens to my data and access when the engagement ends, and how do you evidence deletion. Seventh, will you accept audit rights and flow down the security terms in my client contracts.
Where This Does Not Fit
Some arrangements fall outside what contracts and controls can fix. A client agreement may prohibit processing or access from outside the home country, or require approval before offshore access, and a regulated sector may add its own conditions. Some government and defense work has residency or citizenship requirements. If a client's contract forbids it, no amount of security design changes the answer, and you should not give offshore staff access to that client's data. Where a client is covered by a regime you have not reviewed, such as health or financial rules, check the business associate or equivalent terms before assigning anyone. And if you cannot show effective control over how your staff handle client data, for example because the work happens on unmanaged personal devices with no logging, fix that before the legal question becomes relevant.
A Short Verification Before the First Day
Before a technician starts, write down what data the role will touch and where it lives, then compare that to what each client contract allows. Confirm you have the contract terms above in writing, with security obligations that reach the individual. Check the technical setup by having the technician sign in from a test device, confirming multi-factor authentication works, that permissions match the role, and that logs show the activity. Then review the offboarding procedure by walking through how you would remove access in one hour. Revisit the whole analysis when you add a client in a regulated sector or when a regulator updates its guidance.
📅 Book a 20-minute call: https://meet.brevo.com/konnectph
✉️ Email us: hello@konnect.ph
If a client or an insurer has asked how you protect their data when staff work from the Philippines, bring the client agreement or questionnaire to the call and we will go through the controls and contract terms that answer it.
About the Author
Vilbert Fermin is the founder of Konnect, a remote staffing company connecting North American and Australian businesses with top Filipino talent. With deep expertise in IT support and remote team management, Vilbert helps MSPs access skilled technical professionals without the overhead of full-time domestic IT staff. His mission is to showcase Filipino excellence while helping businesses stay protected, productive, and competitive through strategic remote staffing.
