Physical Security Measures

The Philippines Data Privacy Act (RA 10173) requires organizations to implement physical access limits to facilities, design workstations for privacy, control the movement of electronic media, and secure physical infrastructure against disasters and unauthorized access.

RA 10173 requires a comprehensive combination of organizational, technical, and physical security measures. This specific control focuses heavily on the physical protection of data centers, workstations, paper records, and electronic media.

Organizations should implement strict physical access controls using badge readers, visitor logs, and locked restricted areas to ensure only authorized personnel can enter rooms or interact with workstations where personal data is processed.

A clear desk policy is a crucial administrative control requiring employees to clear sensitive personal data from their desks and securely lock away physical documents at the end of the workday or when the workstation is left unattended.

Yes, IRR Section 27 specifically mandates the implementation of policies and procedures for the secure transfer, removal, disposal, and re-use of electronic media, as well as the prevention of improper disposal of sensitive paper files.

Companies must limit access to data center facilities using strong physical authentication, monitor activities inside the server rooms, and physically protect the critical hardware from natural disasters, power disturbances, and external threats.

Workstation security controls include positioning computer screens to prevent unauthorized viewing, limiting activities within the workstation area, and ensuring users always lock their terminals when stepping away from their desks.

A fully compliant physical security policy must explicitly outline facility access limits, workstation privacy guidelines, media disposal and re-use procedures, and disaster protection protocols for all physical records and equipment.

Personal data must be disposed of using certified methods that prevent mechanical recovery or reconstruction, such as cross-cut shredding for paper records and cryptographic wiping or physical destruction for electronic storage media.

Auditors should comprehensively review physical access control lists, visitor access forms, facility floor plans demonstrating privacy considerations, media disposal records, and the formal physical security policy. WatchDog Security's Compliance Center can help teams link these artifacts to RA 10173 control requirements and track whether evidence is current.

Physical security controls often produce scattered evidence, such as access lists, visitor logs, clear desk attestations, and media disposal records. WatchDog Security's Compliance Center can help teams centralize this evidence, map it to RA 10173 requirements, and identify gaps before an internal review or audit.

Clear desk and secure disposal rules are only effective when employees receive current policies and acknowledge them. WatchDog Security's Policy Management can help maintain version-controlled physical security policies, distribute them to employees, and track acceptance for audit readiness.