Acceptable Use Policy (Philippines)

An Acceptable Use Policy in the Philippines lays down the policy the organisation applies, giving staff or users clear guidance on their responsibilities.

The Cybercrime Prevention Act (RA 10175) is the primary Philippine statute criminalizing unauthorized access to computer systems, data interference, system interference, and computer-related identity theft. An AUP gives contractual teeth to these legal prohibitions by making users expressly acknowledge the boundaries of permitted conduct. Organizations that publish and enforce an AUP are better positioned before the National Bureau of Investigation (NBI) Cybercrime Division and the Philippine National Police Anti-Cybercrime Group (PNP-ACG) when seeking to prosecute unauthorized users or report cybercrime incidents.

For Philippine internet service providers (ISPs) licensed by the National Telecommunications Commission (NTC) under Republic Act 7925 (Public Telecommunications Policy Act), an AUP is both a commercial and regulatory document. NTC Memorandum Circular 07-07-2007 and subsequent circulars require ISPs to implement mechanisms to prevent misuse of their networks, which is typically operationalized through a published AUP. Bangko Sentral ng Pilipinas (BSP) Circular 982 (2017) on technology risk management also recommends that BSP-supervised financial institutions implement AUPs for their information systems.

An Acceptable Use Policy differs from a Terms and Conditions agreement in that the AUP focuses specifically on the technical and behavioral rules for system and network use — particularly cybersecurity-related conduct — while the T&C covers the broader commercial relationship. In practice, many Philippine organizations incorporate the AUP as a schedule or exhibit to the T&C.

The legal framework governing the Acceptable Use Policy (Philippines) in Philippines draws on several key statutes and regulatory bodies. Under Philippine law, the Civil Code of the Philippines (Republic Act No. 386) governs contractual obligations. The Revised Corporation Code (Republic Act No. 11232) regulates corporate entities through the Securities and Exchange Commission (SEC). The Labor Code of the Philippines (Presidential Decree No. 442) and Department of Labor and Employment (DOLE) govern employment matters. The Data Privacy Act of 2012 (Republic Act No. 10173) and the National Privacy Commission (NPC) protect personal data. The Bureau of Internal Revenue (BIR) administers tax obligations under the National Internal Revenue Code. Parties executing a Acceptable Use Policy (Philippines) in Philippines should confirm the document reflects current law, including any amendments enacted since the original drafting date. The Revised Corporation Code (RA 11232, 2019) sets the foundational requirements.

An Acceptable Use Policy is needed by any Philippine organization that provides technology systems, internet access, digital platforms, or computing resources to users, employees, or third parties.

Any Philippine company that provides employees with access to corporate IT systems — including computers, email, internet connectivity, and cloud applications — needs an AUP as part of its employment policies. The DOLE's guidelines on digital workplace conduct and the Labor Code (PD 442) recognize that employers may regulate the use of company resources through documented policies, and the National Labor Relations Commission (NLRC) has upheld dismissals based on violation of company IT policies where the AUP was clearly communicated to employees.

An internet service provider (ISP) or telecommunications company licensed by the National Telecommunications Commission (NTC) needs an AUP to define prohibited network uses — including spamming, unauthorized port scanning, distribution of malware, and facilitation of phishing attacks — consistent with the Cybercrime Prevention Act (RA 10175).

A cloud computing service provider, web hosting company, or SaaS platform serving Philippine customers needs an AUP to protect its infrastructure from abuse, limit its liability for user-generated content under the Electronic Commerce Act (RA 8792), and establish grounds for service suspension or termination.

A Philippine university, school, or educational institution providing students and faculty with internet access and computing facilities needs an AUP consistent with the Commission on Higher Education (CHED) and Department of Education (DepEd) guidelines on responsible technology use.

A financial technology (fintech) company supervised by the Bangko Sentral ng Pilipinas (BSP) needs an AUP as part of its technology risk management framework under BSP Circular 982 (2017) and the Manual of Regulations for Banks (MORB).

Parties in Philippines should prepare a Acceptable Use Policy (Philippines) proactively rather than waiting for a dispute to arise. Courts interpret agreements based on the written terms rather than oral representations. Under Philippine law, the Civil Code of the Philippines (Republic Act No. 386) governs contractual obligations. The Revised Corporation Code (Republic Act No. 11232) regulates corporate entities through the Securities and Exchange Commission (SEC). The Labor Code of the Philippines (Presidential Decree No. 442) and Department of Labor and Employment (DOLE) govern employment matters. The Data Privacy Act of 2012 (Republic Act No. 10173) and the National Privacy Commission (NPC) protect personal data. The Bureau of Internal Revenue (BIR) administers tax obligations under the National Internal Revenue Code. Where the transaction involves regulated activities, prior approval from the relevant authority may be required before execution.

A thorough Philippine Acceptable Use Policy must include the following essential elements.

Scope and Applicability: Clear statement of which systems, networks, and services are covered by the AUP, and which users — employees, contractors, customers, or third-party vendors — are subject to it.

Permitted Uses: Description of the authorized purposes for which the systems or services may be used, including any limitations on personal use of corporate resources.

Prohibited Conduct: Detailed list of prohibited activities, including: unauthorized access or hacking in violation of Section 4 of the Cybercrime Prevention Act (RA 10175); distribution of malware, viruses, or ransomware; spamming or phishing; unauthorized collection of personal data in violation of the Data Privacy Act (RA 10173); transmission of child sexual abuse material (CSAM) in violation of the Anti-Child Pornography Act (RA 9775); online libel in violation of Section 4(c)(4) of RA 10175; and copyright infringement under the Intellectual Property Code (RA 8293).

Monitoring and Privacy: Statement of the organization's right to monitor system use, with appropriate notice to employees under NPC Advisory Opinion 2018-020 on workplace monitoring and the constitutional right to privacy under Article III, Section 2 of the 1987 Constitution of the Philippines.

Enforcement and Consequences: Graduated enforcement mechanisms — from warning to account suspension to termination — and the organization's right to refer violations to law enforcement, including the NBI Cybercrime Division or PNP-ACG.

Reporting Mechanism: A clear process for users to report suspected violations of the AUP, including contact details for the organization's IT security or compliance team.

Amendment: Right of the organization to amend the AUP with appropriate notice, consistent with Civil Code Article 1306 on contractual freedom within the bounds of law and morals.

Additional compliance elements for a Acceptable Use Policy (Philippines) used in Philippines include: Under Philippine law, the Civil Code of the Philippines (Republic Act No. 386) governs contractual obligations. The Revised Corporation Code (Republic Act No. 11232) regulates corporate entities through the Securities and Exchange Commission (SEC). The Labor Code of the Philippines (Presidential Decree No. 442) and Department of Labor and Employment (DOLE) govern employment matters. The Data Privacy Act of 2012 (Republic Act No. 10173) and the National Privacy Commission (NPC) protect personal data. The Bureau of Internal Revenue (BIR) administers tax obligations under the National Internal Revenue Code. Forms-legal.com provides this template as a starting point for Philippines-compliant documentation.