Data Center Decommissioning in the Philippines: A Data Privacy Guide

Data center decommissioning in the Philippines is not just an infrastructure exercise; it is a data privacy event. Under the Data Privacy Act of 2012 and its Implementing Rules and Regulations, decommissioning involves the erasure or destruction of personal data, which the rules expressly treat as a form of processing. Before hardware is pulled, wiped, resold, or scrapped, the operator must ensure that personal data is disposed of lawfully, that processing stops only in accordance with the law, and that the rights of data subjects are upheld throughout.

What the law covers

The Data Privacy Act of 2012, or Republic Act No. 10173, governs the processing of personal data by any natural or juridical person in the government or private sector. Under Section 4 of the IRR, the law applies even to acts done outside the Philippines if the entity is found or established in the country, if the processing relates to a Philippine citizen or resident, if the processing is done in the Philippines, or if the entity has links to the country such as maintaining an office, branch, or agency here, or using equipment located in the country for processing personal data.

A data center operator is typically a personal information controller — the entity that controls what information is collected and the purpose or extent of its processing — or a personal information processor acting on another controller's instructions. Either way, the obligations on disposal attach to whoever holds the data.

Why decommissioning counts as processing

Section 3 of the IRR defines processing broadly. It includes the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data. Decommissioning sits squarely within that list. The same section defines a personal data breach as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data. A careless decommissioning — a server sold with live disks, a backup tape left unaccounted for — can therefore be a breach, not merely an operational lapse.

Retention and lawful disposal

Section 19 of the IRR sets out principles for collection, processing, and retention. Among them: personal data must not be retained longer than necessary, and any authorized further processing must have adequate safeguards. Decommissioning is the point at which the retention obligation is discharged. Data that is no longer needed for the purpose for which it was collected should be erased or destroyed rather than left on media that is being retired.

The IRR also addresses improper disposal. Rule XIII of the IRR is titled Penalties and includes a provision on improper disposal of personal information and sensitive personal information. The firm rule for operators: disposal must be deliberate, documented, and resistant to reconstruction.

Security measures during decommissioning

Rule VI of the IRR requires security measures for the protection of personal data, covering organizational security, physical security, and technical security. Section 29 speaks of an appropriate level of security, taking into account the nature of the data and the risks of processing.

In a decommissioning context, that translates into practical controls: restricting physical access to racks and media during teardown, sanitizing or destroying storage media before they leave the facility, supervising third-party contractors who handle equipment, and keeping records of what was destroyed and when. Where a contractor performs the work, the outsourcing and subcontracting rules in Rule X of the IRR apply, including the duty of a personal information processor under.

If something goes wrong

Rule IX of the IRR governs data breach notification. requires notification of a personal data breach, and sets out the contents of that notification. covers the breach report, and lays down the procedure for notification. If decommissioning results in the loss or unauthorized disclosure of personal data, the notification obligations are triggered. allows for delay of notification in defined circumstances.

The National Privacy Commission, under Section 8 of the IRR, administers and implements the Act and monitors compliance with international standards for personal data protection. Its functions under Section 9 include rule making, advisory work, public education, compliance and monitoring, complaints and investigations, and enforcement, including the imposition of administrative fines.

Frequently asked questions

Does decommissioning a data center in the Philippines require notifying the NPC? The IRR requires notification for personal data breaches under Rule IX. Whether a specific decommissioning triggers notification depends on whether a breach occurred. If personal data is lost, altered, or disclosed without authority, the notification rules apply.

Who is liable if a contractor mishandles the data during teardown? Under Rule X of the IRR, a personal information controller may outsource processing, and imposes a duty on the personal information processor. The controller remains accountable, and the processor must comply with its own obligations.

How long must personal data be kept before disposal? Section 19 of the IRR states that personal data shall not be retained longer than necessary. The IRR does not fix a single retention period; the appropriate period depends on the purpose and the applicable law.

Practical takeaways

• Treat decommissioning as processing: erasure and destruction are expressly covered by Section 3 of the IRR.
• Apply the retention principle in Section 19 — do not keep personal data longer than necessary.
• Implement organizational, physical, and technical security measures under Rule VI, including media sanitization and controlled access during teardown.
• Use written outsourcing agreements and hold contractors to the duty of a personal information processor under.
• Document disposal, and assess whether a breach has occurred so that the Rule IX notification rules can be followed if needed.

Primary sources

The rules discussed above are drawn from the following primary sources, as published in the Official Gazette and the national statute book.

• NPC IRR OF REPUBLIC ACT NO. 10173, August 24, 2016

• REPUBLIC ACT NO. 11232 - AN ACT PROVIDING FOR THE REVISED CORPORATION CODE OF THE PHILIPPINES

• DENR ADMINISTRATIVE ORDER NO. 96-40, S. 1996, December 20, 1996

This article is general information and not legal advice. For your specific situation, consult a lawyer or ask ASG Legal AI.