1. What Personal data do you collect?

2. In what form and through which channels?

3. For what purpose you collect personal data?
4. How is it used?
5. To whom is personal data shared with internally and externally?
6. Who is authorized to access this data?
7. Where do you keep your data?
8. How long do you keep your data?
9. How do you dispose this data?
 Process : Public Assistance and Complaints Desk (PACD)
Process Owner:
Date Conducted:
ORD/Legal
PERSONAL DATA TYPE Does this activity Y/N Remarks
(PI/SPI) involve any of these
personal data flows?
Name of Client PI Collection Y Others prefer to give their names
Walk-in Use Y but upon endorsement hide the
Via email Storage/Retention Y name and contact details
Disclosure Y/N 2 years retention recommended
Disposal Y

Contact information PI Collection Y Others prefer to give their names

Cell Phone Number Use Y but upon endorsement hide the
Residential Address Storage/Retention Y name and contact details
Email address Disclosure Y/N 2 years retention recommended
Disposal Y
1. The personal data you collect
2. The form and channels through which personal data is collected
3. The purpose for collecting personal data
4. How personal data is used
5. To whom personal data is shared whether internally or externally
6. Who is authorized to access
7. How and where data is kept
8. How long data is kept
9. Disposal of data
Transparency Yes No N/A Remarks/Justification

y The client is informed that we have to

Are the information provided prior to the ask all the information needed for
collection? Please specify how in the proper reply to be made in the concern
he raised.
remarks section.

y It will be placed in the PACD area

beside the forms box, so that client can
Does the privacy notice remain accessible read it also even with the PACD
any time a data subject wants to know more officer explaining prior.
about the processing system? Please specify
how in the remarks section.
Legitimate Purpose
Is there a lawful basis for processing personal data?
Please specify the lawful basis in the remarks
section.
Is the processing compatible with a declared and
specified purpose which are not contrary to law,
morals, or public policy? Please specify purpose (s)
in the remarks section
Are all the functionalities aligned to the purpose?
Yes No N/A Remarks/Justification
y DILG mandate on conduct of Fact Finding
Investigations
DILG Memorandum, dated May 8, 2012, of
Asec. Rolando M. Acosta: Re: Conduct of
Fact-Finding in the Exercise of General.
Supervision over Local Government Units
y 1. Information gathered will only be used
for the concern raised;
2. Should the DS request for his name and
contact information to be withheld in
Indorsements to be made, PACD will
adhere to the same and make the
necessary means to still act on the
concern.
y
Proportionality
Is the processing of personal data adequate,
relevant, suitable, necessary and not excessive in
relation to its declared and specified purpose?.
Has the necessity of processing each personal
data been assessed?
Is it possible to achieve the purpose by processing
fewer personal data? Please explain in remarks
section.
Will the “need-to-know" principle be adopted
when granting access to personal data?
Yes No N/A Remarks/Justification
y 1. Information gathered will only be used for
the concern raised;
2. Should the DS request for his name and
contact information to be withheld in
Indorsements to be made, PACD will
adhere to the same and make the necessary
means to still act on the concern.
y Considering all prior complaints, requests
received, all the info requested are necessary.
n Name, contact details (address and email) are
necessary, as these are to be used for Office to
inform the complainant on any action made on
a concern raised.
*Should the DS request for his name and contact information to be
withheld in Indorsements to be made, PACD will adhere to the
same and make the necessary means to still act on the concern.
y
Proportionality Yes
Does the processing use the least intrusive
& most privacy-preserving method based on
industry standards?
Will the processing stop once the purpose is
achieved?
No N/A Remarks/Justification
y 1. Information gathered will only be used
for the concern raised;
2. Should the DS request for his name and
contact information to be withheld in
Indorsements to be made, PACD will
adhere to the same and make the
necessary means to still act on the
concern.
y
Proportionality Procedures to exercise
Right to be informed The client is informed that we have to
ask all the information needed for
proper reply to be made in the concern
he raised.
DPN will be placed in the PACD area
beside the forms box, so that client can
read it also even with the PACD officer
explaining prior.
Right to access Client writes the information on the form,
should he not be able to write, PACD
officer will show the client the information
Right to object
Right to erasure
Right to damages
Right to file a complaint
Right to rectify
Controls
(Y | N)
DPN will be placed in the
PACD area beside the
forms box, so that client
can read it also even with
the PACD officer
explaining prior.
Acceptable Remarks/Justification
y Name, contact details (address and email) are
necessary, as these are to be used for Office to
inform the complainant on any action made on a
concern raised.
*Should the DS request for his name and contact
information to be withheld in Indorsements to be
made, PACD will adhere to the same and make th
necessary means to still act on the concern.
1. The personal data you collect
2. The form and channels through which personal data is collected
3. The purpose for collecting personal data
4. How personal data is used
5. To whom personal data is shared whether internally or externally
6. Who is authorized to access
7. How and where data is kept
8. How long data is kept
9. Disposal of data
Data Lifecyle Controls Acceptable Infosec Type Remarks/Justification
(Y | N |
N/A)
C I A O P T

Collection

Use

Storage/Retention

Disclosure/Sharing

Disposal
1. The personal data you collect
2. The form and channels through which personal data is collected
3. The purpose for collecting personal data
4. How personal data is used
5. To whom personal data is shared whether internally or externally
6. Who is authorized to access
7. How and where data is kept
8. How long data is kept
9. Disposal of data
Data Lifecyle Controls Acceptable Infosec Security Measures
(Y | N | N/A)

C I A O P T

Collection

Use

Storage/Retention

Disclosure/Sharing

Disposal