RETENTION OF YOUR PERSONAL DATA

UP shall retain and provide measures for the secure storage of your personal data for as long as the above purposes for processing such data subsist, in order to establish or defend legal claims, or as otherwise allowed or required by the DPA and other applicable laws and issuances.

DATA PRIVACY RISKS AND MEASURES TO PROTECT YOUR PERSONAL DATA

The University of the Philippines (UP) is committed to protecting the personal data you provide through its contact forms. UP recognizes the risks associated with data processing, such as breaches of confidentiality, data integrity, and unauthorized access. To address these risks, UP has implemented the following measures:

• Physical Measures: Restricted access to facilities where personal data is stored, including physical security mechanisms.
• Organizational Measures: Ensuring only authorized personnel, who have signed non-disclosure agreements and require access to perform their duties, can process personal data. Regular privacy impact assessments are conducted to identify and address risks.
• Technical Measures: Using secure technologies, such as encryption, multi-factor authentication (MFA), and content delivery networks (CDN). UP also conducts regular vulnerability and penetration testing to ensure system security.

While these measures are robust, no system is entirely immune to risks such as targeted cyberattacks or malware. UP has adopted a data breach response plan, aligned with the Data Privacy Act (DPA) and National Privacy Commission (NPC) guidelines, to handle any security incidents effectively.

SECURITY INCIDENT RESPONSE PROCEDURES
In the event of a security incident or data breach, UP follows strict protocols, including:

1. Reporting and assessing the incident using standardized forms.
2. Notifying the National Privacy Commission (NPC) and affected individuals when required.

These procedures ensure that both UP-affiliated users and non-UP customers are informed and protected in case of data breaches.

GUIDELINES FOR DATA SECURITY
To help protect your personal data, UP advises all users—both UP-affiliated and non-UP customers—to take the following steps:

1. Use strong passwords for email accounts and online portals.
2. Enable two-factor authentication (2FA) on your email accounts when possible.
3. For UP-affiliated users, use your official UP email account for communications and transactions involving UP.
4. Avoid submitting personal data over public or unsecured networks. If unavoidable, use a virtual private network (VPN) for added security.
5. Keep all account credentials, such as email login details, confidential.

For more information, including step-by-step instructions on securing your accounts, please refer to UP’s official advisories (View Advisory).

NON-UP CUSTOMERS
If you are a non-UP customer submitting a contact form, your personal data is treated with the same level of protection and processed solely for responding to your inquiries or requests. Any data you provide will be stored securely and retained only for as long as necessary to fulfill its intended purpose or as required by law.

ADDITIONAL RESOURCES
For detailed information on UP’s data protection policies and response procedures, please refer to the UP Data Privacy Website.