President Ferdinand R. Marcos Jr. has signed Executive Order No. 119, which updates how the Philippine government classifies and stores its data and introduces new rules on where that data can be kept. The order replaces Memorandum Circular No. 78, a policy from 1964 that predates cloud computing and modern digital services.
The Department of Information and Communications Technology (DICT) developed EO 119 after consultations with more than 50 stakeholders, including national government agencies, privacy regulators, foreign chambers of commerce, and cloud service providers. DICT reviewed 18 formal position papers before finalizing the framework, which was issued ahead of the Private Sector Advisory Council (PSAC) meeting on digital infrastructure.
EO 119 sorts government data into four tiers, each with its own storage rule. Top Secret and Secret data must stay within Philippine territory, including at Philippine embassies and consulates abroad. Confidential data must generally remain in the country as well, though it can be stored or processed offshore if the agency involved secures approval and follows required safeguards. Restricted and Open Access data can be kept on secure cloud platforms, provided those platforms meet encryption, cybersecurity, and internationally recognized standards.
The order applies only to government data. It does not cover data owned by private companies or individuals.
To oversee the rollout, EO 119 creates the Joint Oversight Committee for Data Classification (JOC-DC), co-chaired by DICT and the National Security Council. The committee also includes the Department of the Interior and Local Government, the National Intelligence Coordinating Agency, the Department of Foreign Affairs, the National Privacy Commission, the Philippine Statistics Authority, and the National Archives of the Philippines. The JOC-DC has 120 days from the order’s effectivity to issue implementing guidelines.
Agencies get three years to comply in full. In the first year, they must complete data inventories, build internal capacity, and begin initial classifications. By the second year, Top Secret and Secret data must be fully compliant. By the third year, every remaining classification of government data must meet the new standard.
“Data is the foundation of our digital future. We must protect critical government information while ensuring that the Philippines remains open to innovation, cloud technologies, and global digital partnerships,” said DICT Secretary Henry R. Aguda.
DICT frames the order as a response to a gap industry groups had flagged: the absence of clear, internationally aligned rules on how government data is classified and stored. Rather than requiring all data to stay in the country, EO 119 applies safeguards based on how sensitive the data is, which DICT says gives cloud providers and data center operators clearer terms for investment decisions in the Philippines.
Implementing guidelines from the JOC-DC are due within 120 days of the order’s effectivity.
