Questions to ask an IT vendor in the Philippines

In the Philippines, the contract with your IT vendor is not optional and its contents are not up to you. The law says what has to be in it.

That makes this country unusual. In most places a written agreement is good practice. Here, section 44 of the Implementing Rules and Regulations of the Data Privacy Act specifies what an outsourcing agreement must contain, and a handshake does not meet it.

Most vendors are decent. Almost every bad outcome we have seen came from something nobody wrote down, so these are the questions worth asking before you sign. Some of them make vendors uncomfortable, ourselves included.

General information, not legal advice. Written September 2026, due for review March 2027. Every legal claim links to its source.

You stay responsible

Section 21 of the Data Privacy Act makes the personal information controller responsible for data transferred to a third party for processing, whether that processing happens here or overseas.

So the question is never whether your vendor is liable. It is whether you can show you did what the law expected of you before handing the data over.

What the contract must say

The Implementing Rules require your outsourcing agreement to set out the subject matter and duration of the processing, its nature and purpose, the types of data and categories of people involved, your rights and obligations, and the geographic location where processing happens.

Your processor must also act only on documented instructions, keep the data confidential, and not bring in another processor without your say-so.

Ask to see their template. If they do not have one, ask whether they knew this was a requirement. The answer tells you a good deal.

Breach timing

Under the NPC rules you notify the Commission and the affected individuals within 72 hours of knowing or reasonably believing a notifiable breach has happened, with a full report within five days.

Note that both notifications share the same 72-hour window. Several other countries give you longer to reach individuals. Here you do not get that.

Your vendor's deadline to you has to sit well inside that. Twenty-four hours from their discovery, in writing.

Your data protection officer, and theirs

Every personal information controller and processor must designate a data protection officer. That includes you and it includes your vendor.

Since NPC Circular 2023-06, both sides also need a privacy management programme and a business continuity plan that covers backup and restoration. Ask whether theirs exists and when it was last tested.

Registration with the NPC is a separate question and applies above thresholds: 250 or more employees, sensitive personal information of 1,000 or more people, or processing likely to pose a risk. Automated decision-making systems always require registration. Below that, registration is voluntary. The NPC publishes guidance on who must register.

Is this a real business

Corporations and partnerships register with the SEC. Sole proprietors register a business name with the DTI. Basic name searches are free on both, and certified documents such as the General Information Sheet and audited financial statements are paid.

Ask for the registration number and check it yourself. Look for a company registered weeks before your meeting, officers who are not the people you met, and a sole proprietorship presenting itself as a firm.

Ask to speak to a client who left. Any vendor can produce a happy customer. Ask the one who moved on whether handover happened promptly and whether the final invoice matched the quote.

Ask what happens if their lead developer leaves. Small vendors run on one or two people, which is fine as long as somebody wrote things down. A good answer names a second person who knows your system.

Who owns the code

Section 178.4 of the Intellectual Property Code splits this in a way that surprises most buyers. The commissioning party owns the work itself. The copyright stays with the creator unless there is a written stipulation to the contrary.

So you can pay for a system, own the system, and still not own the copyright in it. That matters the day you want another developer to modify it.

Get the written stipulation. Assignment of the custom code on payment, plus a permanent licence to anything reusable the vendor brought along.

Whose name is on the domain

Yours. Same for cloud accounts, the app store listing and certificates. The vendor gets administrator access. Your organisation is the registered owner, on an email address you control.

When a vendor holds the domain, a billing dispute can take your website and email offline while it is resolved. Getting it right at the start costs nothing.

Money and scope

Fixed price or time and materials both work. What matters is a written scope and a change process where every change gets priced and approved before anyone builds.

Ask about the warranty period. Thirty to ninety days after go-live with defects fixed at no charge is the usual arrangement for custom software, and it exists only if you ask for it.

Ask what the service level agreement promises. Response and resolution times by severity, support hours in Philippine time, and a remedy when they miss. Ask what they will do to help you leave.

Given how much of the country runs on intermittent power and connectivity, ask specifically what happens to the service during an outage on their side, and what their own backup power and connectivity look like.

Security, without needing to be technical

You do not have to understand the answers. You need to notice whether there is one.

Do all your staff use multi-factor authentication on our systems. How quickly do you apply critical security patches. When did you last restore a backup, and can we watch the next one. Who can reach our data, and how is access removed when somebody leaves.

On certifications, ISO/IEC 27001 and SOC 2 are real and mostly out of reach for a small Philippine vendor, so their absence tells you little. A genuine certificate names the certifying body, the scope and an expiry date. A logo is not a certificate.

What to keep checking

Every month, check backup jobs report success, look at patch status, and confirm the invoice matches what you use.

Every quarter, restore something for real. Remove leavers and dormant accounts. Audit licences and seats. Check the sub-processor list. CIS Controls v8 recommends testing backup recovery quarterly for a sample of assets under Safeguard 11.5. Circular 2023-06 expects your continuity plan to cover restoration and to be reviewed, so this is a legal expectation here as well as good practice.

Twice a year, check domain, certificate and subscription expiry dates with a named owner for each renewal.

Once a year, run a full recovery exercise, read the outsourcing agreement against current NPC rules, review how the service level performed, and look the company up again.

Then the unscheduled moments. Someone leaves on either side, so access goes the same day. The vendor is acquired or loses a key person. A new integration or AI tool appears. A renewal arrives, so you reread the exit terms.

When to walk away

They will not sign an outsourcing agreement, which is a legal requirement here rather than a preference. They register your domain in their own name. They will not put copyright in writing. They have no data protection officer. They quote without a written scope. They cannot show documentation for systems they already run. One person holds every password.

One last thing

None of this requires you to be technical or suspicious. It requires you to write things down and check them occasionally.

If you want a second opinion on a contract or an arrangement you already have, we are happy to look at it. That includes telling you it is fine, which it often is.