By Brian Campued
Underscoring the need to modernize the government’s decades-old classification system, President Ferdinand R. Marcos Jr. has issued Executive Order (EO) No. 119, mandating all covered government entities to adopt a unified, risk-based framework for the classification, protection, handling, and management of government data.
In his EO issued on July 13, the President noted that the current data classification framework established under Memorandum Circular (MC) No. 78 (s. 1964) was formulated in the context of a paper-based bureaucracy and is “no longer fully responsive to the demands of contemporary digital governance.”
“There is a need to update and modernize the government’s classification structure and to establish a coherent policy framework on data residency and cross-border data transfers to safeguard national security, uphold data sovereignty, ensure compliance with existing laws, and support secure digital transformation across government,” EO 119 stated.
The EO covers all government data in digital or hybrid form, owned, processed, or controlled by national government agencies and instrumentalities, including government-owned or -controlled corporations and state universities and colleges, with the Legislature, Judiciary, constitutional commissions, and the Office of the Ombudsman encouraged to adopt its provisions.
On the other hand, the EO does not apply to private sector or commercial data owned by private entities but covers government data or information processed or stored by private entities, including those engaged in public-private partnerships, public services, public utilities, critical infrastructure, or strategic or sensitive projects, on behalf of a government agency.
As to the Data Classification Framework, government data will be classified into two general classes: Restricted Access Data and Open Access Data, in accordance with the updated Government Data Classification Framework adopted under the order.
“Restricted Access Data” refers to official matters requiring protection in the interest of national security, while “Open Access Data,” on the other hand, means information or matters not falling within Restricted Access Data and does not involve national security.
According to the EO, top secret and secret data must be stored within Philippine territory, including Philippine embassies and consulates, while confidential data shall generally remain within the Philippines but may be stored or processed offshore with appropriate approval and safeguards.
Restricted and open access data may utilize secure cloud platforms, subject to encryption, cybersecurity measures, and internationally recognized standards.
To ensure implementation, EO 119 also establishes the Joint Oversight Committee for Data Classification (JOC-DC), co-chaired by the Department of Information and Communications Technology (DICT) and the National Security Council (NSC).
Through a phased implementation, covered government agencies are expected to achieve full compliance within three years from the order’s effectivity.
In a press release Thursday, DICT Sec. Henry Aguda highlighted the administration’s commitment to strengthening government data protection while positioning the Philippines as a secure and investment-ready digital economy.
This is especially important in the age of cloud computing, artificial intelligence, and digitalization of services, as it addresses a key regulatory gap identified by industry stakeholders—the need for clear and internationally aligned rules on government data classification, storage, and protection.
“Data is the foundation of our digital future. We must protect critical government information while ensuring that the Philippines remains open to innovation, cloud technologies, and global digital partnerships,” Aguda said.
-av
