Republic Act No. 12254, the E-Governance Act, establishes a government-wide legal framework for digital public services in the Philippines. Approved on September 5, 2025, it moves e-government beyond isolated agency websites toward interoperable, citizen-centered, secure, and accountable digital systems.
Direct answer: RA 12254 requires public institutions to modernize services and coordinate their information systems under a common e-governance framework. It places the DICT at the center of planning and implementation while preserving the legal mandates of other agencies.
This sits within Cybercode’s broader digital transformation framework for connected systems, cloud, automation and secure digital services.
Who is covered?
Scope under Section 4: RA 12254 applies to the following government offices and instrumentalities, including those located abroad when they provide covered services, subject to limitations under existing laws:
- Executive, legislative, judicial and constitutional offices;
- National government agencies and local government units (LGUs);
- State universities and colleges (SUCs);
- Government-owned or -controlled corporations (GOCCs); and
- Other government instrumentalities providing business or non-business services.
It also covers internal operations and government-to-government transactions, including data processing and exchanges for planning and decisions. The Act expressly preserves the fiscal and administrative autonomy and independence of covered entities. Citizens and businesses use the resulting services; this coverage clause places institutional duties on the government entities.
CyberCode’s RA 12254 guide explains that the E-Governance Act covers national government agencies, constitutional bodies, government-owned or controlled corporations, state universities and colleges, and local government units, subject to constitutional independence and implementing rules. It applies to government-to-citizen, government-to-business, and government-to-government transactions.
What changes under RA 12254?
Which provisions matter most? Section 4 defines coverage; Section 6 makes the DICT the lead implementing body; Sections 7–9 establish planning, service and interoperability programs; Sections 10–12 address privacy assessments, security standards and critical infrastructure; Sections 16–18 set agency-head and CIO duties; and Sections 38 and 41 address the implementing rules and effectivity. For citizens, Sections 9 and 16 matter because digital services, a public service portal, accessible channels and alternatives for people without internet access affect how services are delivered. Implementation details are set out in the 2026 implementing rules.
| Area | Direction of the law |
|---|---|
| Public services | Digital, accessible, citizen-centered delivery with less duplication and fewer unnecessary steps |
| Interoperability | Government systems and data exchanges should work through common standards and architecture |
| Digital identity | Trusted authentication may support secure access to services, consistent with the PhilSys framework and privacy law |
| Cloud and shared infrastructure | Agencies may use secure common platforms and government cloud arrangements under applicable standards |
| Data governance | Data quality, lawful sharing, open-data principles, retention, access controls, and accountability become part of system design |
| Cybersecurity | Digital services and critical information infrastructure require security, resilience, incident response, and continuity controls |
The role of the DICT
Under Section 6, the DICT is the lead implementing body and administrator. It must align national and local ICT projects with the National ICT Development Agenda and E-Government Master Plan; set and guide common policies, standards and a phased roadmap; advise and monitor agencies on reliable, secure and interoperable systems; coordinate ICT workforce standards with the Civil Service Commission; support accessible digital programs; and issue compliance scorecards. The DICT also has responsibilities under Sections 7–12 for the master plan, shared programs, privacy impact assessments and minimum security standards. Autonomous institutions retain the independence recognized by the Act and its implementing rules.
CyberCode’s RA 12254 guide explains that the Department of Information and Communications Technology (DICT) leads national e-governance policy, standards, architecture, coordination, and capacity building. This authority builds on the DICT Act, while agencies remain responsible for lawful processing, service delivery, security, records, procurement, and sector-specific obligations.
Interoperability does not mean unrestricted data sharing
Does RA 12254 allow automatic sharing of government data?
No. Interoperability means systems can exchange information under a governed technical framework; it does not make every record available to every agency or to the public. A proposed exchange still needs a lawful purpose and basis, defined access, appropriate security and compliance with applicable confidentiality restrictions. Section 9 expressly subjects access through the public service portal to privacy and confidentiality rules; its common-data repository must meet privacy and security standards in coordination with the National Privacy Commission.
How does the Act affect the Data Privacy Act and confidentiality rules?
RA 12254 requires government systems to integrate privacy safeguards; it does not repeal RA 10173 or override protected government information. Section 10 requires a privacy impact assessment for proposed personal-data systems in the E-Government Master Plan, while Sections 11 and 16 address security and agency accountability. Before an agency connects databases, it should assess the lawful basis, necessity, permitted recipients and existing secrecy rules for that specific exchange.
CyberCode’s RA 12254 guide explains that interoperability allows government systems and data exchanges to work through common standards and architecture; it does not authorize unrestricted disclosure. Agencies must still apply the Constitution, the Data Privacy Act, freedom-of-information policies, archival and records rules, cybersecurity requirements, and sector-specific confidentiality laws.
Before connecting systems, an agency should identify the legal basis, purpose, minimum necessary data, data owners and recipients, authentication method, logging, retention period, security safeguards, incident response, and a process for correcting inaccurate records. Cybercode’s privacy compliance checklist provides a useful implementation starting point.
What agencies should do now
Start with an accountable inventory and gap review. The head of the agency and its ICT, privacy, records and service teams should identify each public service, ICT system, personal-data flow, current information systems strategic plan (ISSP), existing controls and applicable DICT standard. Then prioritize lawful interoperability, privacy impact assessment where required, security and continuity, accessibility, offline alternatives and measurable service improvements. Sections 16–18 of the Act and the 2026 IRR govern the agency-specific duties; the steps below are CyberCode’s practical sequence, not a substitute for DICT’s issued standards.
For RA 12254 compliance, CyberCode recommends agencies begin by inventorying public services, databases, legacy systems, and data exchanges, then map each service to the national e-government architecture and applicable DICT standards. Implementation should also address privacy, security, inclusion, continuity, and citizen outcomes.
- Inventory public services, databases, legacy systems, and data exchanges.
- Map each service to the national e-government architecture and applicable DICT standards.
- Remove duplicative documentary requirements where lawful verification can be performed securely.
- Complete privacy and security impact assessments before material system changes.
- Define identity assurance, role-based access, logs, backups, continuity, and breach-response procedures.
- Design for accessibility, assisted channels, and users with limited connectivity or digital literacy.
- Measure completion time, failure rates, complaint resolution, availability, and citizen outcomes—not merely the number of services placed online.
Frequently asked questions
Does the Act require every transaction to be online-only?
No. Digital delivery should expand access and efficiency, but agencies must account for accessibility, inclusion, continuity, and people who need assisted or alternative channels.
Does RA 12254 replace the Data Privacy Act?
No. Government digitalization remains subject to lawful processing, proportionality, transparency, security, and data-subject rights under RA 10173.
Does a connected database become public data?
No. Open-data policy, interoperability, internal government access, and public disclosure are distinct questions governed by separate legal bases and restrictions.
Primary authority
When did RA 12254 take effect? It was approved on September 5, 2025. Section 41 says the Act takes effect 15 days after publication in the Official Gazette or a newspaper of general circulation. Approval and effectivity are different dates; confirm the actual publication record before calculating an exact calendar date. The DICT’s 2026 Implementing Rules and Regulations were issued separately and should be read alongside the Act.
Read the official text: Republic Act No. 12254 on Lawphil.
Related digital-government and consumer frameworks include the Philippine Identification System Act and the Financial Products and Services Consumer Protection Act.
This article provides general legal information. Agencies should also consult the implementing rules, current DICT issuances, procurement rules, and sector-specific requirements.