PRESIDENT Ferdinand Marcos Jr. has issued Executive Order (EO) 119 to update the government’s decades-old data classification system, supporting the country’s digital transformation, Malacañang said.
Signed on July 13, the circular orders the adoption of a unified, risk-based Government Data Classification Framework covering all government data in digital or hybrid form that are owned, processed or controlled by national government agencies, government-owned and -controlled corporations, and state universities and colleges.
The Legislature, Judiciary, Constitutional Commissions, the Office of the Ombudsman and local government units are encouraged to adopt the framework.
"There is a need to update and modernize the government’s data classification structure and to establish a coherent policy framework on data residency and cross-border data transfers to safeguard national security, uphold data sovereignty, ensure compliance with existing laws and support secure digital transformation across government," the directive read.
Under the new policy, government data will be classified into two broad categories: Restricted Access Data, which includes four levels of classification — Top Secret, Secret, Confidential and Restricted — and Open Access Data, which covers information not involving national security and may be designated as unclassified or open, subject to existing laws and regulations.
EO 119 mandates the establishment of a data residency framework requiring all government data to remain under Philippine laws and jurisdiction regardless of where the information is stored, processed or handled.
Top Secret and Secret data must be stored within Philippine territory or in areas under Philippine jurisdiction, while Confidential data may be stored abroad only with prior approval from a Joint Oversight Committee for Data Classification and subject to strict safeguards.Government agencies are directed to adopt a risk-based approach in classifying data, including conducting risk and privacy impact assessments, maintaining an inventory of government data and periodically reviewing classifications. The Department of Information and Communications Technology (DICT) will develop and maintain a Government Data Classification Registry System to document classifications and related risk assessments.
The order creates the Joint Oversight Committee for Data Classification, to be co-chaired by the DICT and the National Security Council, with representatives from the Department of the Interior and Local Government, National Intelligence Coordinating Agency, Department of Foreign Affairs, National Privacy Commission, Philippine Statistics Authority and National Archives of the Philippines. The committee will issue implementing guidelines, monitor compliance and submit annual reports to the president.
EO 119 requires covered government agencies to achieve full compliance within three years. During the transition, agencies must inventory government data, complete capacity-building measures, and progressively implement the new classification and residency requirements.
