)){kind=logo}
DCAA INSIGHTS · RESEARCH & ANALYSIS
Research & Analysis ·
As government services move from paper forms and filing cabinets to digital platforms, an increasingly important question emerges: where should public-sector data actually be stored? New Philippine rules show that the answer depends less on a simple “local or overseas” choice and more on how sensitive the data is, who remains accountable for it, and whether the infrastructure protecting it is sufficiently secure and resilient.
At a glance
The Philippines is accelerating its transition towards digital government.
The E-Governance Act provides the framework for more integrated online government services, while its 2026 implementing rules require national agencies and local government units to develop increasingly interoperable digital systems.
But what does data sovereignty actually mean?
In simple terms, data sovereignty is about who has legal authority over data and which country's laws apply to it.
It is related to — but different from — two other terms:
- Data residency means where the data is physically stored or processed.
- Data localisation means a rule requiring certain data to remain within a particular country or territory.
This distinction matters because the Philippines has not introduced a blanket rule requiring all government or Philippine data to stay physically inside the country.
Executive Order No. 119 instead establishes a risk-based framework for government information. Highly sensitive data receives stricter residency requirements, while less sensitive information may use secure cloud infrastructure, including in some cases infrastructure located outside the Philippines.
In practical terms:
The more sensitive the government data, the stronger the requirement for Philippine jurisdiction, control and protection.
That creates an important chain:
Digitalisation → Data classification → Residency decision → Infrastructure → Security → Operations → Assurance
For the Philippine data-centre industry, the significance is clear: government digitalisation does not simply produce more data. It increases the need for infrastructure capable of storing, processing and protecting different types of information appropriately.
From paper records to digital government
For decades, many government processes have depended heavily on physical documents, manual approvals and disconnected information systems.
That is changing.
Republic Act No. 12254, or the E-Governance Act, institutionalises the transition towards a digitally empowered and integrated government. It promotes online public services, electronic government transactions and systems capable of securely exchanging information across government.
The 2026 implementing rules make that direction more concrete.
They require the Department of Information and Communications Technology (DICT) and Department of the Interior and Local Government to develop a Local Government Digital Service Standard covering services such as:
- business permits, licences and clearances;
- real-property and business taxes;
- civil registry services;
- citizen requests and feedback; and
- other frontline government transactions.
LGUs may operate their own systems, but those systems will need to meet common requirements for accessibility, security and interoperability — meaning different government systems must be able to exchange and use information effectively.
The rules also promote government Public Key Infrastructure, or PKI — technology that uses digital certificates to verify identities and help protect electronic transactions — supporting paperless approvals and secure digital government processes.
But moving a record from a filing cabinet into a digital system creates another question:
Once government information becomes digital, where should it live?
Data sovereignty does not automatically mean local storage
This is one of the most important distinctions in the discussion.
Data sovereignty, residency and localisation are related, but they are not interchangeable.
EO 119 states that government data remains subject to Philippine law and jurisdiction regardless of where it is stored, processed or handled.
But the Order does not apply the same physical-storage requirement to every government dataset.
Instead, government information is classified according to risk and sensitivity.
Government data is broadly divided into Restricted Access Data and Open Access Data.
Restricted Access Data may then be classified as:
Top Secret
Secret
Confidential
Restricted
The storage rules become progressively more flexible as the sensitivity of the information decreases.
What EO 119 means in practice
Top Secret and Secret
The most sensitive categories must remain within Philippine territory or another location over which the Philippines exercises sovereignty or jurisdiction, such as Philippine embassies and consulates.
For information at this level, physical location is part of the security requirement.
Confidential
Confidential government information should generally also remain within Philippine territory or another location under Philippine jurisdiction.
However, EO 119 provides an exception.
Confidential information may be stored or processed outside the Philippines where the responsible agency obtains prior approval from the Joint Oversight Committee for Data Classification and implements safeguards that maintain government control and provide the required level of protection.
Restricted
Restricted government data may be stored on secured cloud-computing platforms, subject to encryption, risk mitigation and cybersecurity requirements.
Open and other government data
Other government information, including open-access data, may use secure cloud platforms regardless of the physical location or ownership of that infrastructure, subject to appropriate security controls.
This is why it would be inaccurate to describe EO 119 simply as a rule requiring all government data to be stored locally.
DICT itself describes the framework as avoiding blanket data localisation in favour of safeguards based on the sensitivity of the information.
What about private companies?
Another important distinction is that EO 119 does not generally apply to commercial data owned by private-sector companies.
It does, however, apply when a private company stores or processes government data on behalf of a covered government agency. In such cases, the government agency remains responsible for ensuring that the appropriate contractual, technical and security safeguards are in place.
Private-sector personal information is principally governed by the Data Privacy Act of 2012, together with other applicable sector-specific rules.
The Data Privacy Act does not impose a blanket prohibition on transferring personal information internationally.
Instead, the organisation controlling the information remains accountable for it even where processing has been transferred to another party domestically or internationally. It must use contractual or other reasonable means to ensure a comparable level of protection.
The National Privacy Commission has reinforced this principle in its guidance on cross-border transfers, stating that the Data Privacy Act is not intended to prevent international data transfers when appropriate safeguards are in place.
This distinction is important:
Data sovereignty does not automatically mean that every piece of Filipino data must physically remain in the Philippines.
So where should government data actually be stored?
The answer should begin with what the data is, rather than immediately deciding where to put it.
A government agency should first determine:
What information do we hold?
How sensitive is it?
What could happen if it were exposed, altered, destroyed or unavailable?
What laws apply?
Who remains accountable for it?
EO 119 requires covered agencies to conduct data inventories and risk assessments and, where appropriate, privacy impact assessments before applying the required classification.
Only after understanding the information and its risk should the infrastructure be selected.
For highly sensitive government information, Philippine-based infrastructure may be mandatory.
For other workloads, secure cloud environments may be permitted.
The question therefore becomes more useful when expressed as:
Which infrastructure provides the legally appropriate level of control, security, resilience and accountability for this particular data?
rather than simply:
Local data centre or overseas cloud?
Why LGU digitalisation makes this increasingly important
The E-Governance Act brings the issue much closer to everyday government services.
As LGUs digitise applications, permits, tax payments, civil registry services and citizen interactions, increasing amounts of information that once existed primarily in paper files will become part of interconnected digital systems.
The implementing rules specifically require local digital-service standards and integration with wider government platforms.
There is an important legal distinction here.
The E-Governance Act and its IRR apply to LGUs, while EO 119's direct coverage focuses on national government agencies and other specified government entities and encourages LGUs to adopt its provisions.
But the underlying infrastructure questions remain.
Digital government records still require:
- appropriate classification;
- access control;
- encryption;
- cybersecurity;
- backup and recovery;
- privacy protection;
- auditability;
- business continuity; and
- clear accountability.
Going paperless removes one type of dependency.
It does not remove risk.
It changes the nature of the risk.
What this means for Philippine data centres
Data-residency policy can influence demand for domestic digital infrastructure.
But that should not be reduced to the claim that government policy will automatically force every public-sector workload into a Philippine data centre.
EO 119 does not say that.
What it does create is a clearer need for trusted infrastructure capable of supporting government workloads according to their sensitivity and classification.
For Philippine data-centre and cloud infrastructure, that makes several capabilities increasingly important.
Physical security
Who can enter the facility and access critical infrastructure?
Logical security
Who can access systems and information, and under what conditions?
Encryption
How is information protected while stored and while moving between systems?
Resilience
Can services continue operating when equipment, power or network infrastructure fails?
Data location
Can an organisation demonstrate that workloads subject to residency requirements remain within an approved jurisdiction?
Auditability
Can the organisation prove that policies, procedures and technical controls are actually being followed?
Business continuity and disaster recovery
How will services and information remain available when the primary environment becomes unavailable?
Operational capability
Are the people responsible for the infrastructure competent to maintain the required controls throughout its operating life?
A data centre therefore does more than provide space for servers.
For sensitive digital services, it becomes part of the trust architecture supporting the service.
Local does not automatically mean secure
This distinction is equally important.
Keeping information physically inside the Philippines does not by itself guarantee that the information is secure.
A poorly designed or operated domestic facility could still suffer from:
- unauthorised access;
- weak change control;
- cybersecurity incidents;
- hardware failures;
- insufficient redundancy;
- poor maintenance;
- ineffective backup procedures; or
- inadequate disaster-recovery planning.
Likewise, using infrastructure outside the Philippines does not automatically remove the Philippine organisation's responsibility for the information.
The Data Privacy Act maintains accountability even when personal information is processed internationally.
Residency is therefore only one element of the wider problem.
Location matters. But so do security, control, resilience and accountability.
Implementation is still developing
EO 119 establishes a phased three-year transition for covered government agencies.
During the first year, agencies are expected to build capability, inventory their data and begin classification.
During the second year, covered entities are expected to reach full compliance for Top Secret and Secret information.
By the third year, compliance is expected across the remaining government-data classifications.
The Joint Oversight Committee for Data Classification, co-chaired by DICT and the National Security Council, is responsible for overseeing implementation and developing further guidance on matters including classification, residency, sovereignty and secure cloud use.
That means the Philippine government data-sovereignty framework should still be understood as developing rather than fully mature.
How it is implemented across agencies — and eventually reflected in procurement, cloud adoption and digital-infrastructure requirements — will be important to monitor.
DCAA perspective
The Philippines' transition towards digital government changes the infrastructure conversation.
A paperless public service is not simply a software project.
Behind every digital permit, online application, electronic record or government transaction sits a chain of physical and digital infrastructure:
Application → Network → Data → Cloud or Data Centre → Power → Cooling → Security → Operations → Assurance
As government information becomes increasingly digital, the question of where data resides becomes more important.
But location alone is not enough.
The stronger objective is to ensure that information is classified appropriately, stored in an environment suited to its sensitivity, protected against failure and unauthorised access, and operated by people capable of maintaining those controls throughout the system's lifecycle.
The Philippines now has a clearer framework for beginning that process.
For the country's growing data-centre industry, the opportunity is therefore not simply to offer local storage.
It is to demonstrate that Philippine digital infrastructure can provide the security, resilience, governance and operational assurance required to become a trusted platform for increasingly important digital services.
BUILD THE INFRASTRUCTURE. BUILD THE WORKFORCE.
Sources
- Lawphil — Executive Order No. 119 →
- Lawphil — Republic Act No. 12254 — E-Governance Act →
- Lawphil — 2026 Implementing Rules and Regulations of the E-Governance Act →
- National Privacy Commission — Data Privacy Act of 2012 →
- National Privacy Commission — NPC Advisory No. 2024-01 — Model Contractual Clauses for Cross-Border Transfers of Personal Data →
- Philippine Information Agency / DICT — EO 119 implementation overview →
Editorial Notice
DCAA Insights is provided for general industry information and professional education. Sourced information and third-party statements are attributed to their original publishers. DCAA commentary and analysis are identified as such. References to companies, projects or external resources do not constitute endorsement. External publications remain the intellectual property of their respective owners. Readers should refer to the original sources for the latest information.