ISO 27001 certification in the Philippines: PAB accreditation, the Data Privacy Act, BSP guidelines and local practice

Why Philippine organisations pursue ISO/IEC 27001

Most Philippine requests start with a client abroad. A contact centre, back-office or software team in Metro Manila, Cebu or Clark that serves clients in the United States, Australia or Europe finds ISO/IEC 27001 on the vendor security questionnaire, in the master services agreement or in the onboarding checklist for a new account. Without a certificate, expect long questionnaires and repeated client audits.

Local demand has two further sources. Organisations that process personal data answer to the National Privacy Commission under the Data Privacy Act, and an ISMS gives the security obligations of that Act a system to live in. Financial institutions supervised by the Bangko Sentral ng Pilipinas work under its information security guidelines, and their technology suppliers inherit those expectations through due diligence. What ISO/IEC 27001 itself requires is covered in the requirements guide.

PAB accreditation and checking an ISMS certificate

PAB's Management System Accreditation Division runs seven certification schemes, one of them for information security management systems. Under that scheme it evaluates the technical competence, consistency and impartiality of bodies that issue ISO/IEC 27001 certificates, against ISO/IEC 17021-1 and ISO/IEC 27006 and the applicable IAF Mandatory Documents. PAB publishes each accredited body's certificate and scope appendix, so you can confirm that a body is accredited for ISMS, not only for quality management.

Your certification body does not have to be accredited by PAB. A certificate backed by another internationally recognised accreditation body is generally accepted, and since 1 January 2026 international recognition runs through the Global ACI arrangement. Confirm the current recognition status of PAB, or of whichever body stands behind your certificate, on that body's own site and on the Global ACI list before you rely on it. To check a certificate, PAB points buyers to IAF CertSearch. The verification guide and the guide to choosing a certification body cover the full check.

The Data Privacy Act and BSP guidelines

Data Privacy Act of 2012 and the NPC

Section 20 of the Act requires organisational, physical and technical measures to protect personal information, and NPC Circular 16-03 requires notification of qualifying breaches to the Commission and data subjects within 72 hours, a breach response team and an annual summary of incidents. Section 14 and the implementing rules on outsourcing make controllers answerable for their processors. Build the ISMS so its risk register, incident process and supplier controls produce the records the NPC would ask for. Information collected from foreign residents under their own laws is largely excluded, yet the implementing rules keep processors subject to the security requirements. The Data Privacy Act page covers the Act itself; ISO/IEC 27701 extends the ISMS to privacy management.

BSP Circular No. 982

BSP Circular No. 982, series of 2017, "Enhanced Guidelines on Information Security Management", applies to BSP-supervised financial institutions and requires an information security risk management framework. It says security certification is "not specifically required" but "may be considered a sound security practice". A bank can use ISO/IEC 27001 to structure that framework; a fintech or IT supplier to banks uses it to shorten the bank's due diligence.

Local practice that changes the project

Client-dedicated environments

BPO floors often run client-owned tools, networks and access rules. The scope and Statement of Applicability must say which controls the Philippine entity operates and which the client does.

Ecozone and group structures

Many IT-BPM locators belong to a foreign parent with a global ISMS. Decide early whether the Philippine entity holds its own certificate or sits under the group's; that decides which body audits you.

Multi-site and hybrid work

Sites in Metro Manila, Cebu or Clark and work-from-home agents all sit in scope. Agree site sampling with the body early and evidence remote-working controls.

How Sterling works in the Philippines

Sterling runs Philippine engagements from its Manila office, on site or remotely. Local services and contacts are on Sterling in the Philippines. The team draws on 8,100+ client engagements in 60+ countries since 2003. Sterling does not certify: an independent, accredited body audits you and decides.

ISO/IEC 27001 in the Philippines: questions buyers ask