CyberCode.ph · Philippines

Employee Cybersecurity Policy Template Philippines (2026)

Last updated September 6, 2026 · Practical privacy, cybersecurity and technology-law guidance
Employee cybersecurity policy template for Philippine businesses

Last materially reviewed: September 6, 2026

Direct Answer

Every Philippine employer that holds personal data needs a written employee cybersecurity policy. Section 20 of the Data Privacy Act requires organisational security measures, and a written rule is the only way a breach by staff can later support discipline. A US template will not do this work: it has no Labor Code hook, and Philippine dismissal law decides whether your policy is enforceable at all.

Key Takeaways

  • Section 20 of RA 10173 requires “reasonable and appropriate organizational, physical and technical measures,” and Rule VI of the IRR spells out what those look like.
  • A security policy only becomes enforceable against an employee if it is reasonable, lawful, made known to the employee, and pertains to their duties, per Dongon v. Rapid Movers.
  • A policy alone never creates a valid dismissal. You still need a just cause under Labor Code article 282 (renumbered article 297) plus the twin-notice procedure.
  • Employees can commit crimes personally: RA 10173 sections 25 to 32 and RA 10175 sections 4(a)(1), 4(a)(3) and 4(a)(5).
  • Monitoring is the most misunderstood clause. RA 4200 bars recording a private communication without the authorisation of all parties, and no policy can waive that for third parties.
  • Pollo v. Constantino-David shows why a written no-privacy notice on company systems matters: an express policy defeated the employee’s claimed expectation of privacy.
  • The full template below is a starting document and must be adapted to your systems, sector rules and disciplinary code.

On This Page

Clause-to-Law Mapping

Global security-policy templates list controls. They do not tell a Philippine employer why each control is legally required or what makes it enforceable against staff. This table does both.

Policy clause What it does Philippine legal basis
Scope and binding effect Covers employees, contractors and interns; confidentiality survives the engagement IRR of RA 10173, Rule VI s.26 (human resources management; confidentiality continuing after employment)
Passwords, MFA and access control Prevents credential compromise RA 10173 s.20; IRR Rule VI s.28 (technical measures, including access controls and encryption)
Phishing and social engineering Addresses the most common breach vector RA 10173 s.20; s.20(f) breach notification duty
Device security and patching Keeps endpoints defensible IRR Rule VI s.28
Physical and clean-desk rules Controls paper, screens and storage media IRR Rule VI s.27 (physical security measures)
Approved software only Blocks hacking tools and unlicensed code RA 10175 s.4(a)(5) misuse of devices
No unauthorised access or snooping Stops staff browsing systems they have no business in RA 10175 s.4(a)(1) illegal access; RA 10173 s.29
No tampering or deletion Protects data integrity, including on resignation RA 10175 s.4(a)(3) data interference
Data handling, retention and disposal Prevents careless exposure and improper disposal RA 10173 s.27 (improper disposal); s.11(e) retention
Remote work and BYOD Extends controls off-premises RA 10173 s.20; IRR Rule VI ss.27-28
Monitoring notice Sets expectations lawfully and defensibly Pollo v. Constantino-David, G.R. No. 181881; RA 4200 limits; Civil Code arts. 26 and 32
Incident reporting Enables timely breach assessment and notification RA 10173 s.20(f); s.30 (concealment of security breaches)
Acknowledgement requirement Makes the rule provably “made known” Dongon v. Rapid Movers, G.R. No. 163431
Consequences clause Links breach to the disciplinary code Labor Code art. 282 (renumbered art. 297); King of Kings Transport v. Mamac; Agabon v. NLRC

Governing Law and Authorities

RA 10173, the Data Privacy Act of 2012. Section 20 requires the controller to “implement reasonable and appropriate organizational, physical and technical measures intended for the protection of personal information,” and to notify the Commission and affected data subjects where sensitive personal information is reasonably believed to have been acquired by an unauthorised person. Section 21 keeps the controller accountable. Sections 25 to 32 create offences that individuals, including employees, can commit personally.

IRR of RA 10173, Rule VI. Section 26 covers organisational measures, including designating a data protection officer or compliance officer, keeping records of processing activities, and human resources measures under which personnel with access “must maintain confidentiality even after employment ends.” Section 27 covers physical measures; section 28 covers technical measures, including safeguarding networks, monitoring for breaches, recovery capability, security testing, encryption and access controls. Section 29 measures the appropriate level of security against the nature of the data, the risks, the organisation’s size and complexity, current best practice and cost.

RA 10175, the Cybercrime Prevention Act of 2012. Section 4(a)(1) punishes illegal access, “the access to the whole or any part of a computer system without right”; section 4(a)(3) data interference, “the intentional or reckless alteration, damaging, deletion or deterioration of computer data … without right”; section 4(a)(5) misuse of devices, including sharing passwords or access codes for the purpose of committing offences under the Act; and section 4(b)(3) computer-related identity theft.

Labor Code of the Philippines, Presidential Decree No. 442. Article 282, renumbered article 297, sets the just causes for termination by the employer: serious misconduct or willful disobedience of lawful orders in connection with work; gross and habitual neglect of duties; fraud or willful breach of trust; commission of a crime against the employer or immediate family; and analogous causes.

RA 4200, the Anti-Wiretapping Law. Section 1 makes it unlawful for any person “not being authorized by all the parties to any private communication or spoken word” to tap any wire or cable or to use a dictaphone, dictagraph, walkie-talkie, tape recorder or similar device to record it. Section 4 makes anything obtained in violation inadmissible in any judicial, quasi-judicial, legislative or administrative proceeding.

Status note, 6 September 2026. Some write-ups refer to “NPC Guidelines on Passwords.” We could not locate a formal NPC issuance under that name on privacy.gov.ph, so the password requirements here are grounded in section 20 of RA 10173 and Rule VI section 28 rather than a standalone password issuance. Check privacy.gov.ph before citing one.

What the Policy Must Cover, Clause by Clause

Scope, acknowledgement and survival

The scope clause does more work here than elsewhere, because enforceability depends on the rule having been made known. Cover employees, probationary and project staff, interns, consultants and contractors; require a signed acknowledgement; and state that confidentiality survives the engagement, consistent with Rule VI section 26.

Identity and access

Passwords, multi-factor authentication, credential sharing and least-privilege access sit under section 20 and IRR section 28. Write the no-sharing rule plainly: under RA 10175 section 4(a)(5), sharing an access code for the purpose of committing an offence under the Act is itself punishable, which turns a casual habit into potential criminal exposure.

Phishing, payment fraud and reporting

Require out-of-band verification for payment, bank-detail and password-reset requests, and set a reporting deadline in hours. The notification duty under section 20 is time-sensitive, and an employee who sits on a compromise for a week destroys the employer’s ability to comply. Section 30 penalises concealment of security breaches, so say that hiding an incident is treated more seriously than causing one.

Devices, software and physical security

Patching, endpoint protection, screen locks, encryption and secure disposal map to IRR sections 27 and 28. The approved-software clause matters for a specific Philippine reason: possession or use of hacking tools can engage RA 10175 section 4(a)(5), so “do not install security tools without authorisation” is not just an IT preference.

Data handling and departure

Improper disposal of personal information is an offence under section 27 of RA 10173, so shredding and secure wiping belong in the policy, not just in an IT runbook. The exit clause should require return of devices and data and prohibit deletion of company records, which can amount to data interference under RA 10175 section 4(a)(3).

Monitoring: What an Employer May and May Not Do

This is where most Philippine security policies go wrong, in both directions. Some claim unlimited surveillance rights. Others avoid the topic and lose the ability to investigate.

What supports lawful monitoring. In Pollo v. Constantino-David (G.R. No. 181881, 18 October 2011) the Supreme Court upheld a search of a government employee’s office computer. The employee “failed to prove that he had an actual (subjective) expectation of privacy either in his office or government-issued computer”: no separately enclosed office, no locked premises, no password protection. Decisively, the office policy stated that users “shall not have an expectation of privacy in anything they create, store, send, or receive on the computer system.” Applying the O’Connor v. Ortega reasonableness test, the Court balanced “the invasion of the employees’ legitimate expectations of privacy against the government’s need for supervision, control, and the efficient operation of the workplace” and found the search reasonable in inception and scope.

The lesson is that a clear, disseminated notice reduces the expectation of privacy on company systems, and that a search should be justified at inception and proportionate in scope. Note the limit: Pollo concerned a government employer, so the constitutional analysis does not transfer wholesale to a private company, where the exposure runs through Civil Code articles 26 and 32 and RA 4200 rather than the Bill of Rights directly.

What monitoring cannot do. RA 4200 is not a workplace-privacy statute; it is a criminal statute about intercepting private communications. It makes it unlawful for a person “not being authorized by all the parties to any private communication or spoken word” to tap a line or use a recording device to capture it. Two consequences follow. First, an employer cannot record an employee’s phone call with a customer on the strength of the employee’s consent alone, because the customer is also a party. Second, section 4 makes anything obtained in violation inadmissible in any judicial, quasi-judicial, legislative or administrative hearing, so an unlawfully obtained recording is useless in the very disciplinary case it was gathered for. Penalties under section 2 run to imprisonment of not less than six months and not more than six years.

Call recording for quality assurance is common in Philippine contact centres and is handled by notifying all parties, which is why the announcement plays before the call connects. Your policy should describe that mechanic accurately rather than asserting a general right to record.

Exceptions and Boundaries: What This Policy Cannot Lawfully Do

  • It cannot authorise unlimited monitoring. No policy clause overrides RA 4200’s all-parties requirement for private communications.
  • It cannot make dismissal automatic. Breach must be matched to a just cause under article 282 (renumbered article 297), proved, and processed with due notice.
  • It cannot bind conduct before dissemination. Dongon requires the order to have been made known to the employee.
  • It cannot authorise self-help hacking. “Testing” a competitor’s or a colleague’s system without authority is illegal access under RA 10175 section 4(a)(1) regardless of intent.
  • It cannot require employees to waive third parties’ rights. A customer’s consent cannot be given by the employee.
  • It cannot cure a defective security posture on paper. IRR section 29 measures adequacy against actual risk, size and complexity, not against the existence of a document.
  • It cannot displace sector regulation. BSP-supervised institutions, insurers and healthcare providers face additional supervisory requirements this template does not address.

Hypothetical Philippine Scenarios

These are hypothetical illustrations, not real cases or predictions of outcome.

Scenario 1: The shared login

Two agents in a Cebu shared-services centre share one login for convenience; one of them exports a customer list. Because the credential was shared, the employer cannot attribute the export to a person, and the disciplinary case collapses on evidence rather than law. The no-sharing clause is an evidentiary control as much as a security one.

Scenario 2: The resigning developer

A developer on his last week deletes several repositories he considers his own work. Depending on the facts this may be data interference under RA 10175 section 4(a)(3) and may support a just cause under article 282. Whether the employer can act depends on whether the policy said, in writing and before the fact, that company records must not be deleted and that access ends on the last working day.

Scenario 3: The covert recording

An employer suspects an employee of leaking information and records his calls without telling him or the callers. Even if the suspicion is correct, section 1 of RA 4200 was violated and section 4 makes the recording inadmissible in the administrative case. The employer created criminal exposure for itself and gained nothing usable.

Scenario 4: The unreported phishing click

An accounts clerk enters her credentials on a fake login page and says nothing for ten days, during which personal data is exfiltrated. The delay compromises the employer’s ability to assess and notify under section 20. The policy should have made same-day reporting an express duty and stated that good-faith reporting is protected while concealment is not.

Records and Documentation That Make the Policy Enforceable

  • Signed acknowledgement receipts, dated and naming the policy version. This is the document most often missing when an employer needs it.
  • Dissemination proof: circulation email, HRIS delivery log, dated photograph of any posted copy.
  • Training and awareness logs: date, topic, attendees, duration, materials, phishing-simulation results.
  • Access provisioning and de-provisioning records, showing who had access to what and when it ended.
  • Incident register, with report time, assessment, notification decision and outcome.
  • Records of processing activities under IRR Rule VI section 26 and security-testing results under section 28.
  • Consistency log of how comparable breaches were penalised, which defends you against a claim of selective enforcement.
  • Policy version history, so you can prove which text was in force on the incident date.

How to Adopt, Disseminate and Enforce It

  1. Map your actual data and systems first. IRR Rule VI section 29 measures adequacy against your real risk profile.
  2. Read the primary sources: RA 10173 and the IRR, Rule VI.
  3. Name the accountable officer required by IRR Rule VI section 26, with contact details.
  4. Adapt the template below, replacing every bracketed field.
  5. Align each prohibited act with your disciplinary code, so penalties are graduated and consistent.
  6. Write the monitoring clause carefully, describing what is monitored, on which systems, for what purpose, and expressly excluding anything RA 4200 prohibits.
  7. Consult and issue with a prospective effectivity date.
  8. Disseminate and collect signed acknowledgements. Keep the proof.
  9. Train and test, then log both.
  10. Enforce consistently, and record how each case was handled.
  11. Review at least annually and after every material incident. Register your DPO and check advisories at privacy.gov.ph.

Consequences and Realistic Outcomes

Labour consequences

A policy alone does not create a valid dismissal. The employer must establish a just cause under Labor Code article 282 (renumbered article 297) and observe procedural due process. For willful disobedience, Dongon v. Rapid Movers and Forwarders (G.R. No. 163431, 28 August 2013) requires that “the conduct of the employee must be willful or intentional” and that “the order the employee violated must have been reasonable, lawful, made known to the employee, and must pertain to the duties that he had been engaged to discharge.” The Court added that “willfulness must be attended by a wrongful and perverse mental attitude.”

On procedure, King of Kings Transport v. Mamac (G.R. No. 166208, 29 June 2007) requires a first written notice specifying the grounds with reasonable opportunity to explain, a hearing or conference at which the employee may respond with counsel if desired, and a second written notice of termination; “a verbal appraisal of the charges against an employee does not comply with the first notice requirement.” Where the cause is valid but procedure was skipped, Agabon v. NLRC (G.R. No. 158693, 17 November 2004) held that “the lack of statutory due process should not nullify the dismissal” but the employer must indemnify the employee, awarding P30,000 nominal damages there.

Administrative consequences

The NPC may investigate the employer as controller and issue compliance orders. IRR section 29 makes the assessment contextual: a small company is not held to a bank’s controls, but neither is an unimplemented document accepted as a measure.

Criminal consequences

Employees carry personal exposure. Under RA 10173, section 29 penalises unauthorised access due to breach of security with one to three years’ imprisonment and a fine of P500,000 to P2,000,000; section 27 penalises improper disposal; section 30 penalises concealment of security breaches; sections 31 and 32 cover malicious and unauthorised disclosure. Under RA 10175, offences under sections 4(a) and 4(b) carry imprisonment or a fine of at least P200,000, or both, with misuse of devices under section 4(a)(5) carrying a fine of up to P500,000. RA 4200 carries imprisonment of not less than six months and not more than six years. Confirm all figures against the statutes before relying on them.

Civil consequences

Civil Code articles 19, 20 and 21 support damages for wrongful or abusive acts; article 26 requires respect for “the dignity, personality, privacy and peace of mind” of others; article 32 allows an independent civil action for interference with the privacy of communication and correspondence, provable by preponderance of evidence and open to moral and exemplary damages. Overreaching surveillance is the clause most likely to generate such a claim.

Common Mistakes

  • Adopting a US template whose legal references are HIPAA, SOX or state breach laws, none of which apply here.
  • Never collecting signed acknowledgements, then discovering at the NLRC that you cannot prove the rule was made known.
  • Writing a monitoring clause that claims the right to record calls or intercept messages, which RA 4200 does not permit and which can render your own evidence inadmissible.
  • Enforcing selectively, which converts a valid rule into an argument about arbitrary treatment.
  • Treating incident reporting as optional, which strips the employer of the ability to assess and notify under section 20(f).
  • Confusing an IT standard with a policy. A password complexity setting is a control; the policy is what makes breaching it a disciplinary matter.
  • Citing a non-existent NPC password issuance instead of grounding password rules in section 20 and IRR section 28, or leaving bracketed placeholders in the adopted version.

The Full Employee Cybersecurity Policy Template

How to use this template. Every square-bracketed item is a field you must replace. Italic notes are annotations explaining the legal basis and should be deleted before adoption. This is a starting document for a Philippine private-sector employer and requires review against your systems, contracts, sector regulation and disciplinary code. It is not legal advice.

BEGIN TEMPLATE — EMPLOYEE CYBERSECURITY POLICY

1. Title, Owner and Effectivity

This Employee Cybersecurity Policy of [COMPANY NAME] takes effect on [DATE] and supersedes prior guidance on the same subject. Policy owner: [NAME AND POSITION OF DPO OR COMPLIANCE OFFICER], [EMAIL], [PHONE]. Version [X.X].

Note: naming an accountable individual reflects IRR Rule VI section 26. Effectivity must be prospective.

2. Purpose

This policy sets the minimum security rules for all users of [COMPANY NAME] systems and information. It gives effect to section 20 of the Data Privacy Act of 2012 and Rule VI of its Implementing Rules and Regulations, and forms part of the reasonable and lawful company rules to which personnel are subject.

3. Scope

This policy binds all employees, probationary, project and fixed-term personnel, interns, consultants, contractors and any other person granted access to [COMPANY NAME] systems, premises or information. It applies to company devices, personal devices used for company work, and remote and on-site work. Confidentiality obligations continue after the engagement ends.

4. Accounts, Passwords and Authentication

  • Use a unique password of at least [NUMBER] characters for each company account; reuse of personal passwords is prohibited.
  • Enable multi-factor authentication on [LIST SYSTEMS].
  • Never share passwords, one-time codes or access tokens with anyone, including colleagues and IT staff.
  • Store credentials only in [APPROVED PASSWORD MANAGER].
  • Report a suspected credential compromise to [CONTACT] immediately.

Note: sharing an access code for the purpose of committing an offence under RA 10175 can itself be punishable under section 4(a)(5).

5. Access and Least Privilege

Access is granted only for the duties of the role. Personnel must not attempt to access any system, folder, mailbox, record or account they have not been authorised to use, even where a technical control does not prevent it.

Note: unauthorised access can amount to illegal access under RA 10175 section 4(a)(1).

6. Phishing, Fraud and Verification

Do not click unexpected links, open unexpected attachments or supply credentials in response to unsolicited requests. Any request to change bank details, release funds, reset a password or send personal data must be verified through a separate channel using contact details already on file, never those supplied in the message. Report suspected phishing to [CONTACT].

7. Devices and Software

  • Apply security updates within [NUMBER] days of release.
  • Do not disable endpoint protection, encryption, logging or other security controls.
  • Install only software and browser extensions approved by [OFFICE]; unlicensed software is prohibited.
  • Do not install, possess or use network scanning, password cracking or exploitation tools without written authorisation from [OFFICE].
  • Lock the screen when unattended and enable device encryption where available.
  • Report lost or stolen devices to [CONTACT] within [NUMBER] hours.

8. Physical Security and Clean Desk

Do not leave documents containing personal data unattended. Store physical records in [LOCATION]. Visitors must be escorted in [AREAS]. Removable media must be [ENCRYPTED / PROHIBITED].

Note: reflects physical security measures under IRR Rule VI section 27.

9. Data Handling, Retention and Disposal

Access and use company and personal data only for legitimate work purposes. Transfer personal data only through [APPROVED CHANNELS]. Retain data only for the period in [RETENTION SCHEDULE]. Dispose of records only through [SECURE DISPOSAL METHOD]; personal data must never be placed in ordinary waste or resold storage media.

Note: improper disposal of personal information is an offence under section 27 of RA 10173.

10. Remote Work, Networks and Personal Devices

Connect to company systems only through [APPROVED REMOTE ACCESS METHOD]. Do not transmit personal data over public networks without approved protection. Personal devices used for company work must have [SCREEN LOCK, CURRENT UPDATES, ENCRYPTION, REMOTE WIPE] and are subject to [BYOD CONDITIONS].

11. Monitoring and Privacy Notice

[COMPANY NAME] monitors [SPECIFY: company email accounts, internet gateway logs, endpoint security telemetry, access logs, badge records] on company-provided systems for security, compliance and investigation purposes. Personnel should have no expectation of privacy in material created, stored, sent or received on company systems. Monitoring is limited to what is necessary and proportionate to those purposes.

[COMPANY NAME] does not intercept or record private communications without the authorisation of all parties, as required by Republic Act No. 4200. Where calls are recorded for [PURPOSE], all parties are notified before the recording begins. Personal accounts and personal devices are not monitored except [STATE ANY LIMITED EXCEPTION AND ITS BASIS].

Note: an express, disseminated no-privacy notice was decisive in Pollo v. Constantino-David. RA 4200 is a hard limit no policy can waive.

12. Incident Reporting

Report any suspected phishing, malware, account compromise, unauthorised access, lost device, misdirected email or accidental disclosure to [CONTACT] within [NUMBER] hours, even where you are unsure it is serious. Reporting in good faith will not by itself be treated as an offence. Concealing or delaying the report of an incident is treated as a more serious matter than the incident itself.

Note: supports the employer’s notification duty under section 20(f) of RA 10173; concealment of a security breach is an offence under section 30.

13. Third Parties and Vendors

Do not grant system access or share personal data with any external party without written approval from [OFFICE] and a written agreement containing security and confidentiality obligations.

14. Separation and Return of Assets

On resignation, end of contract or termination, personnel must return all devices, media, records and credentials by [DEADLINE] and must not copy, retain or delete company data. Access is revoked on the last working day.

Note: deletion of company data can amount to data interference under RA 10175 section 4(a)(3).

15. Training

Personnel must complete security awareness training at induction and at least [FREQUENCY] thereafter, and must participate in phishing simulations conducted by [OFFICE]. Attendance is recorded.

16. Consequences of Breach

Breach may result in withdrawal of access and disciplinary action under [COMPANY DISCIPLINARY CODE REFERENCE], applied consistently and with due process. Nothing in this clause dispenses with the requirement of a valid cause and the observance of procedural due process under Philippine labour law. Breach may also give rise to personal criminal liability under the Data Privacy Act of 2012, the Cybercrime Prevention Act of 2012 and other laws, and to civil liability.

17. Review

Reviewed at least annually and after any material incident or regulatory development. Next scheduled review: [DATE].

18. Acknowledgement

I, [NAME], [POSITION], confirm I received the Employee Cybersecurity Policy of [COMPANY NAME], version [X.X], dated [DATE]; that its contents, including the monitoring notice in clause 11, were explained to me; and that I understand breach may lead to disciplinary action and to personal liability under Philippine law. Signature: ____________ Date: ____________
END TEMPLATE

Frequently Asked Questions

Is a written cybersecurity policy legally required in the Philippines?

Section 20 of RA 10173 requires reasonable and appropriate organisational, physical and technical measures, and IRR Rule VI section 26 expects documented data protection policies. No provision names an “employee cybersecurity policy,” but for most organisations a written policy is how those duties are met and evidenced.

Can we dismiss an employee for a security policy breach?

Only if the breach amounts to a just cause under Labor Code article 282 (renumbered article 297), the rule was reasonable, lawful and made known to the employee, and the twin-notice procedure was observed. The policy supports the case; it does not decide it.

Can we read employees’ work email?

Reviewing material stored on company systems is a different question from intercepting a live communication. Pollo v. Constantino-David shows the defensible pattern: a clear policy stating there is no expectation of privacy on company systems, plus a search justified at inception and reasonable in scope. That case involved a government employer, so private employers should also weigh Civil Code articles 26 and 32.

Can we record employees’ phone calls?

Not without the authorisation of all parties to the communication. RA 4200 section 1 requires authorisation from every party, and section 4 makes anything obtained in violation inadmissible in judicial, quasi-judicial, legislative and administrative proceedings. This is why contact centres announce recording to the caller.

Can an employee be criminally liable, not just disciplined?

Yes. RA 10173 sections 25 to 32 and RA 10175 sections 4(a)(1), 4(a)(3), 4(a)(5) and 4(b)(3) create offences an individual can commit. The policy should say this plainly, because it changes how staff treat the rules.

Are there official NPC password rules we must follow?

As of 6 September 2026 we could not confirm a standalone NPC issuance titled “Guidelines on Passwords” on privacy.gov.ph. Anchor your password requirements in section 20 of RA 10173 and Rule VI section 28 of the IRR, and check the NPC advisories page before citing anything more specific.

Official Sources

Disclaimer

Important: This article provides general educational information about Philippine law, regulation, cybersecurity, technology, or business compliance. It is not legal advice and does not create an attorney-client relationship. Laws, agency procedures, technical standards, platform rules, and the facts of each situation may change the result. Verify current requirements through the cited official sources and seek qualified professional advice when your rights, deadlines, money, safety, or legal exposure may be affected.

CyberCode updates

Get practical updates on Philippine technology law, data privacy, cybersecurity, and AI.

Email activity tracking

Unsubscribe any time. See our privacy policy below.