Vendor and SaaS Security Checklist Philippines: Due Diligence Before You Sign

Last materially reviewed: September 6, 2026

Direct Answer

A vendor security review for a Philippine business is not a generic questionnaire. It is a check that the vendor can meet the duties the Data Privacy Act places on you: the outsourcing contract required by Sections 43 and 44 of the IRR, the security measures required by Section 20 of RA 10173, and the accountability you keep under Section 50 of the IRR. Ask for evidence, and keep it.

This checklist is part of Cybercode’s broader vendor, cloud and business cybersecurity guidance.

Key Takeaways

• Every assessment question should trace back to a duty you owe, not to a template you downloaded.
• IRR Section 44 lists what the processor contract must contain. That list is your strongest negotiating position, because it is law rather than preference.
• Ask for evidence you can file: the executed addendum, the dated subprocessor list, the certification scope, the incident contact.
• Subprocessors are where most Philippine SMEs lose visibility. Section 44 contemplates that a processor should not engage another without prior approval.
• Certifications are evidence, not compliance. Read the scope statement before treating one as an answer.
• Do the review before signature. After signature you have questions; before signature you have leverage.

On This Page

• The Assessment Map
• Governing Law and Authorities
• What to Require, Area by Area
• Exceptions and Boundaries
• Hypothetical Philippine Scenarios
• Documentation and Records
• Running the Review, Step by Step
• Consequences and Realistic Outcomes
• Common Mistakes
• Tool: The Vendor Due-Diligence Question Set
• FAQs
• Related Cybercode Guides
• Official Sources
• Disclaimer

The Assessment Map

Governing Law and Authorities

Republic Act No. 10173. Section 20 requires the personal information controller to implement “reasonable and appropriate organizational, physical and technical measures.” Section 21(a) provides that the controller “is accountable for complying with the requirements of this Act and shall use contractual or other reasonable means to provide a comparable level of protection while the information are being processed by a third party.” That phrase is the legal engine of vendor due diligence: it is why you may insist.

The Implementing Rules and Regulations. Rule X, Section 43 permits a controller to outsource or subcontract processing provided it uses contractual or other reasonable means to ensure proper safeguards. Section 44 requires that processing “shall be governed by a contract or other legal act that binds the personal information processor to the personal information controller,” and prescribes the contents. Rule VI, Section 25 sets the security-measures duty, and Rule XII, Section 50 makes the controller responsible for personal data “outsourced or transferred to a personal information processor or a third party for processing.”

NPC Circular No. 2023-06 (1 December 2023), on security of personal data, applies to persons processing personal data “within and outside of the Philippines” and is the reference point for expected security measures. NPC Circular No. 2022-04 covers registration and DPO designation. Where the counterparty processes for its own purposes rather than on your instructions, NPC Circular No. 2020-03 on data sharing agreements applies instead.

Cross-border hosting does not change the assessment. As covered in the companion guide on data privacy for SaaS and cloud tools, Philippine law imposes no adequacy regime, and NPC Advisory No. 2024-01 on model contractual clauses is expressly voluntary.

What to Require, Area by Area

Identity and access

Require multi-factor authentication, single sign-on where you use it, role-based permissions with administrator separation, and audit logs you can read yourself. Ask specifically whether vendor support staff can enter your environment, how that access is authorised, and whether it is logged visibly to you. A vendor that cannot answer the support-access question has not thought about it.

The contract, checked against Section 44

Do not ask whether the vendor is “DPA compliant.” Ask for the data processing addendum and read it against the Section 44 list: subject matter and duration; nature and purpose; type of personal data and categories of data subjects; processing only on documented instructions; confidentiality of authorised personnel; security measures; no further processor without prior approval; assistance with data-subject rights; support for your own compliance; deletion or return of data at the end of the service; and making information available for audits. Any missing item is a specific, citable request rather than a vague concern.

Subprocessors and fourth parties

Ask for the current subprocessor list, in writing, with a date. Ask how you will be told when it changes, and how much notice you get before a new one starts processing. This is the area where Philippine businesses most often cannot answer their own clients’ questions.

Security operations and evidence

Ask about patching and vulnerability management, whether independent assessment or penetration testing has been done, and how to report a security issue. Where a certification is offered, ask for the scope statement rather than the logo: a certificate covering a different product line or data centre is not evidence about the service you are buying.

Incidents, continuity and exit

Require a named incident contact, a notification undertaking and cooperation in obtaining logs, because your breach obligations depend on facts only the vendor holds. Ask what happens during an extended outage. Then settle the exit before signature: export format, whether retrieving your own data attracts a fee, deletion on termination, and backup retention afterwards.

Exceptions and Boundaries

Proportionality is legitimate. The DPA requires measures that are reasonable and appropriate. A vendor holding one mailing list does not warrant the same scrutiny as one holding your payroll. Scale the review to the data and the criticality of the workflow, and record why you scaled it that way, because that record is itself evidence of accountability.

Due diligence does not transfer your responsibility. IRR Section 50 keeps the controller responsible for data outsourced or transferred to a processor. The strongest contract in the market changes what you can recover from the vendor, not what data subjects and the National Privacy Commission expect from you.

Some arrangements are not outsourcing at all. If the counterparty will process the data for its own purposes, this is data sharing under NPC Circular No. 2020-03 and a processor addendum is the wrong instrument. Settle the classification before you start the questionnaire.

Sector rules can be stricter. Banks, insurers, health facilities, government agencies and BPO clients often face outsourcing approval requirements from their own regulators or customers that go beyond the DPA. A small vendor is not automatically unacceptable either: company size is not a legal criterion.

Hypothetical Philippine Scenarios

Illustrative hypotheticals, not real cases and not legal advice.

Hypothetical 1: The Ortigas insurance broker. A broker adopts a claims-handling platform. The vendor’s addendum covers instructions, confidentiality and security, but is silent on deletion at the end of the service and on further processors. Both are Section 44 items. The broker asks for them by name before signature, and gets a rider. Had the request come at renewal instead, the vendor’s answer would have cost more.

Hypothetical 2: The certification that covers the wrong thing. A vendor offers a certificate as its complete answer on security. The scope statement, when requested, covers a data centre in another region and a different product. The certificate is genuine and irrelevant. The buyer’s file should record that it asked for the scope, because asking is the evidence of an appropriate assessment.

Documentation and Records

The assessment file is the deliverable. For each vendor keep:

• The completed question set with the vendor’s written answers, dated.
• The executed data processing addendum, with version accepted and date of execution.
• Your Section 44 gap check, showing which items were present and what you asked for.
• The dated subprocessor list and the notification route for changes.
• The named incident contact and escalation route.
• The access review: who holds administrator rights, and when last checked.
• The exit terms: export format, any fee, deletion undertaking, backup retention period.
• Your risk decision, including where you accepted a gap and why, signed off by a named owner with a review date.

Running the Review, Step by Step

1. Classify the arrangement. Processor, controller or data sharing. This decides whether you need an IRR Rule X outsourcing agreement or a data sharing agreement under NPC Circular No. 2020-03.
2. Scope the data. Name the categories, whether sensitive personal information is involved, and how many data subjects. Scale the review to this.
3. Send the question set below and require written answers. Verbal assurances from a sales contact are not evidence.
4. Request the addendum and the subprocessor list at the same time, so the paperwork and the answers arrive together.
5. Run the Section 44 gap check against the IRR published by the NPC and list every missing item.
6. Put the gaps in writing before signature, citing the section. Vendors respond differently to a legal citation than to a preference.
7. Assess security against Section 20 of RA 10173 and NPC Circular No. 2023-06, asking for certification scope where one is offered.
8. Record the residual risk and who accepted it, with a review date.
9. Configure the tool on day one: MFA, SSO, least privilege, administrator separation, logging on, external sharing restricted.
10. Add the vendor to your incident plan and to your incident response procedures, with the contact and log-access route.
11. Diarise re-review at renewal, on any material security notice, on a subprocessor change, and annually.

Consequences and Realistic Outcomes

The realistic outcome of skipping the review is rarely a regulator at the door. It is the moment your own enterprise customer sends you a security questionnaire and you cannot answer questions about your own supply chain, or the moment an incident occurs and you cannot establish what was affected because you never secured log access or a contact.

Legal exposure is real but indirect. The Data Privacy Act carries criminal penalties for specified offences, and the National Privacy Commission has investigation and enforcement functions. There is no offence called “inadequate vendor due diligence.” Exposure arises where the absence of diligence produces a substantive failure: no processor contract where one was required, security measures that were not reasonable and appropriate, or a breach you could not assess or notify because you had no route into the vendor.

Commercial consequences usually arrive first: failed client audits, delayed enterprise deals, and renewals negotiated from dependence once you discover that exporting your own data is neither free nor simple.

Common Mistakes

• Running the review after signature, when the leverage is gone.
• Asking whether the vendor is “DPA compliant” instead of asking for the addendum and checking it against Section 44.
• Accepting a certification logo without reading the scope statement.
• Never obtaining a dated subprocessor list, and so being unable to answer your own clients.
• Treating the public privacy policy as the contract. Section 44 requires a contract binding the processor to you.
• Rejecting vendors by size rather than by data and criticality.
• Leaving the exit terms until termination, when export fees and deletion limits become someone else’s decision.
• Filing nothing. An assessment with no record is indistinguishable from no assessment.

Tool: The Vendor Due-Diligence Question Set

Send these verbatim and require written answers. Each is tied to a duty you owe.

Processing and contract

• Will you act as personal information processor, processing only on our documented instructions?
• Please provide your data processing addendum and confirm which version applies to our order.
• Does it state the subject matter and duration, nature and purpose, type of personal data and categories of data subjects?
• Does it bind your authorised personnel to confidentiality?
• Does it commit you to assist us in responding to data-subject requests, and within what period?
• Does it require deletion or return of our data at the end of the service, and in what format?

Subprocessors

• Please provide your current subprocessor list, including what each one processes and where.
• Will you obtain our prior approval, or give notice, before engaging a new processor, and how much notice?

Security

• Is multi-factor authentication available, and can we enforce it for all users?
• Do you support single sign-on, role-based permissions and separation of administrator roles?
• Are audit logs available to us, and for how long are they retained?
• Can your support staff access our environment? How is that authorised, and is it logged visibly to us?
• How is data encrypted in transit and at rest, and describe your patching, vulnerability management and any independent testing.
• If you hold a certification, please provide the scope statement.

Incidents and continuity

• Who is our named incident contact, and what is the notification undertaking and timeframe?
• What logs and forensic information will you provide to help us assess an incident?
• What are your backup and recovery arrangements and recovery objectives, and what is the fallback during an extended outage?

Data handling and exit

• What is retained, for how long, and can we set retention ourselves?
• Is our content used to train or improve any model, and can that be disabled?
• On termination, what is the export format, is there a fee, and how quickly is data deleted, including from backups?

FAQs

Is an ISO certificate enough vendor due diligence?

No. A certification is evidence supporting your assessment of security measures under Section 20, but it does not supply the processor contract required by IRR Section 44, and its scope may not cover the service you are buying. Always read the scope statement.

What is the single most important thing to obtain?

The executed processing contract carrying the IRR Section 44 contents. It is the item the law actually requires, and it is the one most often replaced by a marketing page.

Who should own vendor reviews?

The Data Protection Officer, where one is designated under NPC Circular No. 2022-04, usually coordinates, with input from IT, legal, procurement and the business owner of the service. The named owner and review date matter more than the job title.

Does a vendor abroad need extra approval?

No. Philippine law has no adequacy regime and requires no NPC clearance for overseas processing. Your accountability under Section 21 of RA 10173 and Section 50 of the IRR is unchanged, which is precisely why the review matters.

Related Cybercode Guides

• Data Privacy for SaaS and Cloud Tools in the Philippines — the data-protection rules that sit behind these questions
• Data Privacy Compliance Checklist Philippines
• Cybersecurity Compliance for Philippine Companies
• AI Vendor Due Diligence Checklist Philippines
• Cybersecurity Incident Response Plan Philippines
• SaaS Agreements Philippines

Official Sources

• Republic Act No. 10173, Data Privacy Act of 2012 (Sections 20 and 21)
• IRR of RA 10173 (Rule VI Section 25; Rule X Sections 43-44; Rule XII Section 50)
• NPC Advisories and Circulars, including Circular Nos. 2023-06, 2022-04 and 2020-03
• NPC Advisory No. 2024-01, Model Contractual Clauses for Cross-Border Transfers (30 May 2024)

Disclaimer

Important: This article provides general educational information about Philippine law, regulation, cybersecurity, technology, or business compliance. It is not legal advice and does not create an attorney-client relationship. Laws, agency procedures, technical standards, platform rules, and the facts of each situation may change the result. Verify current requirements through the cited official sources and seek qualified professional advice when your rights, deadlines, money, safety, or legal exposure may be affected.