President Ferdinand Marcos Jr. has mandated an overhaul of the nation’s decades-old data classification framework to bolster data sovereignty, enhance cybersecurity, and facilitate a secure digital transition throughout the public sector.
Issued through Executive Order No. 119, the directive addresses the pressing demand for a modernized, unified policy governing data residency and international data transfers.
The mandate encompasses all digital or hybrid government data owned, managed, or processed by national agencies, state-run corporations, and state universities and colleges, provided it aligns with current legal regulations.
While the order focuses strictly on public-sector data and excludes private or commercial information owned by private firms, it does cover government data managed by private entities. This includes private companies engaged in public services, public utilities, public-private partnerships, critical infrastructure, or sensitive state projects that handle data on behalf of any government office.
The new directive replaces the old Government Data Classification Framework, which was originally set up under Memorandum Circular 78 in 1964. Under these updated guidelines, all covered state entities are required to employ a standardized, risk-based strategy for classifying, securing, and handling government information.
The updated framework splits government data into two primary classifications: Restricted Access Data and Open Access Data. The restricted category encompasses official information requiring protection to safeguard national security, whereas open access covers any information that does not meet the restricted criteria detailed in Section 4 of the order.
These categories are further broken down into top secret, secret, confidential, and restricted tiers.
To ensure accountability, the executive order establishes a compliance structure requiring covered agencies to provide yearly reports to the upcoming Joint Oversight Committee for Data Classification (JOC-DC).
The committee will review and forward these consolidated reports to the President. Agencies are given a three-year window from the order’s implementation date to achieve full compliance via a phased rollout.
Furthermore, the President urged local government units, the judiciary, the legislature, constitutional commissions, and the Office of the Ombudsman to integrate these new guidelines into their respective operations.