FOR YEARS, conversations around email systems centered on cost and features. Procurement asked what a platform cost and what it could do. We’re now seeing a wider regional trend where the questions have moved upstream: who operates the platform, what laws apply to it, and how quickly it can provide answers when a regulator comes calling. Organizations can outsource the technology, but accountability ultimately remains with them.
In the Philippines, this comes at a pivotal time as it redraws its data accountability map.
Setting new accountability standard
Under the Data Privacy Act, any organization, private or public, handling personal data now has 72 hours from discovering a breach to notify the National Privacy Commission. In July this year, President Ferdinand Marcos Jr. signed Executive Order 119, replacing a government data classification policy that had stood since 1964. Government data is now sorted by sensitivity, and its two most sensitive tiers, Top Secret and Secret, must remain within Philippine territory.
While the order applies directly to government agencies, it signals where regulatory expectation across the Philippines is heading: not a general assurance that a vendor takes security seriously, but a specific answer, system by system, about where data lives and who controls it.
For most systems, that answer exists. For email, that answer is often less clear because it is still treated as a utility rather than a governed business system. Yet almost every sensitive decision an organization makes moves through it at some point, including board material, legal advice, personnel matters and client instructions.
Most business systems have a named owner and defined controls. Email spans every department, which tends to leave responsibility divided among IT, security, compliance and operations. That arrangement holds until someone has to answer a precise question about it under a deadline.
What real control looks like
Control matters most in the first hours after a breach is discovered, because that is when the clock starts and the questions get specific. The questions are specific: What data was exposed, when and how it was exposed, and what has been done about it. Under the Data Privacy Act, the 72-hour clock starts the moment the breach is discovered, not the moment someone gets around to checking. An organization that lacks sufficient visibility or operational control over its communications systems may find itself dependent on others to identify, investigate and respond to incidents. It waits on a provider to notice the problem, explain it, and then authorize a response, in that order.
Not every organization needs to run its own servers. Every organization should be able to answer who controls its email and how quickly that person can act.
That answer tends to go unexamined until something forces a review. The prompt comes from an audit, an incident or a renewal. Audits and incidents arrive without notice. Renewals are scheduled.
Important questions to ask
The renewal is the one an organization controls, though most let it pass by default. The paperwork is signed, the service continues, and few organizations revisit what changing course would actually involve. That is the wrong instinct. A renewal is the one point where a company holds real leverage, and using it requires knowing, in advance, exactly what is being agreed to for another term.
Before renewing, organizations should be able to answer three questions.
How long would it actually take to move? Very few companies could answer with any precision. That gap matters at renewal, because a company without a credible alternative is negotiating on the supplier’s terms rather than its own.
What comes with you, and what stays behind? Messages are portable. Compliance records frequently are not, and those are the first thing a regulator asks to see. Responsibility for producing them does not transfer with the platform.
Who can act when something breaks? Not who to contact, but who has the authority to act. That determines whether an organization investigates its own incident or waits to be told what happened. With 72 hours to report, that difference decides whether the deadline is met.
Answering the three questions does not require switching vendors. Companies that go through this exercise can stay exactly where they are. The difference lies in making an informed choice, not staying by default.
The regulatory bar in the Philippines will only grow more specific from here. The organizations best positioned for it will not be the ones running the newest technology. They will be the ones that can say, plainly, who is accountable for their data, and prove it before anyone has to ask twice.
Anthony Chadd is the chief revenue officer at Zimbra, an enterprise email and collaboration platform that provides organizations with email, calendaring, contacts, tasks, file sharing and collaboration tools, along with administration, security and deployment options for on-premises, private-cloud and hosted environments.
