President Marcos has ordered the update of the government's decades-old data classification framework to strengthen data sovereignty, enhance cybersecurity, and support secure digital transformation.

Marcos made the order through Executive Order (EO) No. 119, which was in response to the need to update and modernize the government’s data classification structure to establish a coherent policy framework on data residency and cross-border data transfers, uphold data sovereignty, and support secure digital transformation across government.

The EO covers all government data in digital or hybrid form, owned, processed, or controlled by national government agencies and instrumentalities, including government-owned or -controlled corporations, and state universities and colleges, insofar as it is consistent with existing laws, rules, and regulations.

The Legislature, Judiciary, Constitutional Commissions, Office of the Ombudsman, and local government units were also encouraged to adopt the provisions of the EO.

Meanwhile, the order does not apply to private sector or commercial data owned by private entities but covers government data or information processed or stored by private entities, including those engaged in public-private partnerships, public services, public utilities, critical infrastructure, or strategic or sensitive projects, on behalf of a government agency.

The EO updated the Government Data Classification Framework established under Memorandum Circular (MC) 78 (s. 1964), mandating all covered government entities to adopt a unified, and risk-based framework for the classification, protection, handling, and management of government data.

As to the Data Classification Framework, government data will be classified into two general classes: Restricted Access Data and Open Access Data, in accordance with the updated Government Data Classification Framework adopted under the EO.

Restricted Access Data refers to official matters requiring protection in the interest of national security.

Open Access Data, on the other hand, means information or matters not falling within Restricted Access Data as defined in Section 4 of the Order.

Under the President’s order, data are classified or categorized as top secret, secret, confidential, and restricted.

The order mandates that all covered government agencies and entities to submit an annual report on their compliance to the soon-to-be created Joint Oversight Committee for Data Classification (JOC-DC), which will then be submitted to the President.

Through a phased implementation, covered government agencies are expected to achieve full compliance within three years from the order’s effectivity.