An Employee or Customer Asks to See, Correct or Delete Their Data: How a Philippine Company Should Respond

What exactly are they asking for? Access, correction, erasure and objection are different

The Philippine Data Privacy Act gives data subjects a set of rights, including being informed about how their data is processed, accessing their data, correcting inaccurate data, asking for erasure or blocking, objecting to certain processing and, under certain conditions, obtaining a copy of their data. The systems a company should have in place to honour these rights are outlined in the basic requirements of the Data Privacy Act.

Real requests are usually mixed. A departing employee says "send me a copy of my personnel file and then delete everything about me"; a customer says "why do you have my number — delete it and stop contacting me". The first step is to split the request: which part is access, which part is erasure, which part is stopping marketing contact. Each part carries different obligations and different grounds on which the company may decline, so treating the whole request as one thing usually leads to an answer that is wrong in at least one respect.

Also identify who is asking and which data is involved. An employee's personnel file, payroll and attendance records, CCTV footage, interview and background-check records, or a customer's orders, chat logs and contact details are usually scattered across different systems and departments. Put one person in charge and bring the relevant teams in, rather than leaving it to the receptionist or customer-service agent who happened to receive the request and who may not know where the data sits.

Write the split-out request back to the requester in plain terms — "you are asking for a copy of X, the deletion of Y and an end to Z" — so both sides agree on what is being answered.

Step one: verify identity and acknowledge in writing — do not just send the data

Before anything else, confirm the requester really is the data subject or someone they have legally authorised. Sending an employee's full personnel file to an impostor is itself a data breach, with consequences worse than not replying at all.

Match the verification to the sensitivity of the data. HR can check a current employee in person; a former employee or a customer can be called back on contact details already on file, or asked for information that proves identity; a request made on someone else's behalf requires written authority. Collect only what you need to verify — do not use the request as an excuse to gather more personal data than the situation requires.

Once identity is confirmed, acknowledge the request in writing, say the company will reply within a reasonable time, and explain how you will contact them if you need to clarify the scope. Response timeframes follow the privacy regulations and current NPC rules; set a clear internal deadline and record the date the request arrived, because that date will matter if the requester later says the company was too slow.

If the request is very broad — "send me everything you have on me" — you can politely ask them to indicate what matters most to them, but a broad scope is not a reason to refuse or to delay indefinitely.

Log every verification step in the request register: who checked, how, and when. If identity cannot be confirmed, say so in writing and explain what the person can provide instead, rather than simply going silent and leaving them to assume the company is stonewalling.

Access and copies: what to give, what to withhold, how to deliver

In principle, a data subject is entitled to know what personal data you hold about them, where it came from, what it is used for, who receives it and how long it is kept, and to receive a copy.

To answer properly, search every relevant place: HR system, payroll and attendance, email and chat, CCTV, customer management system and paper files. Compile the requester's data and provide it in a readable form. Take particular care with content that involves other people — colleagues visible in CCTV, other people's details in chat logs, the identities of witnesses in complaint files. Redact third-party personal data before release, so that fulfilling one person's request does not breach someone else's privacy.

Some material may lawfully be withheld or restricted, for example data tied to an ongoing investigation, legal proceedings or privileged communications, or content whose release would seriously harm others' rights. Whether an exception applies is a case-by-case judgment; when unsure, ask a lawyer or privacy adviser, and state in your reply which parts are withheld and why. "Company policy" is not a reason the requester will accept, nor one the NPC is likely to.

Deliver securely: an encrypted file sent through a verified channel, or a hand-over in person against a signed receipt. Keep a copy of exactly what you released, so there is no later argument about what the requester received.

Before sending, have a second person check the package for anything that should have been redacted. A single unredacted name in a complaint file can undo the goodwill of an otherwise careful reply, and can expose the company to a complaint from the person whose details slipped through.

Erasure and stopping processing: what can go and what must stay

Data subjects can ask for erasure or blocking, but the right is not absolute. Before deleting, check whether there is a legal reason to keep the data, because deleting records you were obliged to keep creates its own problem.

Common reasons to retain: personnel, payroll and time records employers must keep under labour rules; transaction and accounting records required by tax rules; evidence needed for an actual or reasonably foreseeable labour dispute or lawsuit; and data needed to perform a contract still in force. You may refuse to erase these, but restrict their use to the retention purpose and delete them when the retention period ends. Retention periods follow the current rules for each type of record.

Common cases where data should be erased or processing stopped: marketing contact details and preferences once the person has objected to marketing; data no longer needed for any purpose and with no retention duty; and data that was never necessary in the first place. Erasure must reach every copy — including customer contacts saved on sales staff's personal phones, exported spreadsheets on shared drives, and backups, which are the places erasure most often fails.

Reply clearly: what has been deleted or stopped, what is retained by law, why and for how long. If the requester is not satisfied, tell them they can complain to the NPC — that is transparency, and it signals the company is confident in its handling.

Record the deletion itself: what was deleted, from which systems, by whom and when. If the requester or the NPC later asks for proof that the request was honoured, a deletion log is the only convincing answer.

Common employee scenarios: leaving, in a dispute, asking for CCTV

Employee requests usually arrive when the relationship is already strained, and mishandling them can become entangled with a labour dispute and make that dispute harder to settle.

A departing employee wants a copy of their file: provide their personal data, redact third-party content, and decide case by case whether and how evaluative notes about their performance are disclosed. An employee wants all their data deleted: records required by labour rules stay, with an explanation, but stop using their data for unrelated purposes — remove them from marketing materials and internal chat groups, for example.

An employee in a dispute asks for access: the request is often about gathering evidence. You still have to answer under privacy rules and cannot refuse simply because there is a dispute, though privileged material or material tied to an ongoing investigation can be handled lawfully. Have the lawyer handling the dispute review the reply before it goes out. An employee asks for CCTV footage: check whether it is still within the retention period, provide the segments showing them, and mask other people. What employees must be told about biometrics and surveillance is covered in biometric attendance and privacy.

Rejected job applicants asking for background-check results are another frequent case; the limits are set out in background checks in the Philippines.

Whatever the scenario, keep the privacy reply separate from the substance of any dispute. Answer the data request on its own terms and in its own letter; do not use it to argue the merits of the termination or the disciplinary case, and do not let the dispute delay the privacy reply beyond the required timeframe.

Turning one request into a process, and how YIXING can help

The first request usually causes a scramble. Afterwards, fix the process: a named privacy contact, clear instructions in your privacy notice on how to make a request, a request register recording the date received, how identity was verified, who handled it, when you replied and the outcome, and an inventory of the personal data you hold with retention periods for each category.

The inventory is the most valuable piece. Knowing where data sits, who can access it and how long it is kept turns the next search from days into hours, and lets you assess impact quickly if there is ever a breach; see responding to a customer data breach. Remind sales and service staff not to keep customer data on personal devices or private accounts — that is where erasure requests are hardest to carry out completely, and where breaches most often begin.

YIXING Travel Consultancy Inc. (SEC Reg. No. CS202009551; Bureau of Immigration Accreditation No. CA-202624381-1; DOLE-accredited) provides compliance retainer services including privacy notice and internal procedure reviews, request registers and reply templates, checks on retention periods for employee records, and referral to licensed lawyers and privacy advisers where labour disputes or privilege are involved. Response deadlines, exceptions and retention periods follow current NPC and statutory rules. Every case turns on its own facts; consult a licensed Philippine lawyer. This article is not legal advice.

Review the register once or twice a year. Patterns — the same complaint about marketing contact, the same difficulty locating CCTV footage, repeated requests from one department's former staff — show where the underlying process needs fixing, and they are useful evidence of accountability if the NPC ever asks how the company manages privacy.