Digital Certificate Subscriber Agreement

PLEASE READ THIS AGREEMENT CAREFULLY BEFORE USING THE DIGITAL CERTIFICATE ISSUED TO YOU OR YOUR ORGANIZATION. BY APPLYING FOR A DIGITAL CERTIFICATE, YOU ARE AGREEING TO BE BOUND BY THE TERMS OF THIS AGREEMENT. IF YOU HAVE PROBLEMS UNDERSTANDING THIS AGREEMENT, E-MAIL US AT support.pnpki@dict.gov.ph.

1.0 Definitions

Applicant: The individual that applies for (or seeks renewal of) a Digital Certificate naming it as the “Subject”.

Certification Practice Statement (CPS) – A statement of the practices that a certification authority employs in issuing, managing, revoking, and renewing or re-keying certificates.

Certificate Policy (CP) – A named set of rules that indicate s the applicability of a certificate to a particular community and/or class of application with common security requirements. For example, a particular CP might indicate applicability of a type of certificate to the authentication of parties engaging in business-to-business transactions for the trading of goods or services within a given price range.

Certificate Revocation List (“CRL”): A collection of electronic data containing the list of serial numbers revoked or suspended by the Certificate Authority

Online Certificate Status Protocol (“OCSP”): An Internet Protocol (IP) used to obtain the real time revocation status of a digital certificate. It is used as an online faster alternative to CRL list.

Public Key – A mathematical key which is available publicly and which is used to verify Digital Signatures created with the matched Private Key and to encrypt electronic data which can only be decrypted using the matched Private Key

Private Key: A mathematical key which is kept private to the owner and which is used to create Digital Signatures or to decrypt electronic data

Registration Authority (RA) – An entity that is responsible for one or more of the following functions: the identification and authentication of certificate applicants, the approval or rejection of certificate applications, initiating certificate revocations or suspensions under certain circumstances, processing subscriber requests to revoke or suspend their certificates, and approving or rejecting requests by subscribers to renew or re-key their certificates. RAs, however, do not sign or issue certificates (i.e., an RA is delegated certain tasks on behalf of a CA).

Subscriber – A subject of a certificate who is issued a certificate.

2.0 Authority to Use Digital Certificates

2.1 Grant of Authority

As from the Effective Date up to the validity period of any issued Digital Certificate (“Valid from” date to “Valid to” date) , PNPKI grants to the Subscriber the authority to use the requested Digital Certificate in conjunction with Private Key and/or Public Key operations. The obligations of the subscriber (see section 4.0) with respect to Private Key protection are applicable from the effective date.

2.2 Limitations on Authority

The digital certificate cannot be used for purposes other than what is allowed in this subscriber agreement and the CPS.

3.0 Use of PNPKI Digital Certificate

The subscriber shall use the certificate for its lawful and intended use only. The certificate shall be used in accordance with its Key-Usage field extensions. All issued certificate by PNPKI cannot be used for purposes other than what is allowed in this subscriber agreement and by the CPS. PNPKI shall not be liable for any claims arising from prohibited use.

3.1 Acceptance of a Digital Certificate

The following conduct constitutes certificate acceptance:

a) A certificate shall be deemed accepted when it is in the subscriber or representative’s control;

b) Failure of the subscriber to object to the certificate or its content within five (5) calendar days; or

c) The subscriber uses the certificate.

3.2 Revocation of Digital Certificates

A certificate shall be revoked when the bind between the subject and the subject’s public key is no longer valid.

An end-user subscriber certificate can be requested for revocation under any of the following conditions:

1. When a verified request for revocation is received by PNPKI CA or RA;

2. When any of the information found in the certificate is changed or nolonger applicable;

3. When the Private Key, or the media holding the Private Key, associated with the certificate is compromised;

4. When the PNPKI CA determines that the end-user entity is no longer complying with the requirements of by the CPS and this subscriber agreement; or

5. When the PNPKI CA has the reason to believe that the certificate was issued in a manner that is not in accordance with the procedures required by the CPS and this subscriber agreement.

6. When subscriber requested revocation of the Certificate;

4.0 Subscriber Obligations

This Agreement governs the subscriber’s application for, acceptance, and use of, a digital certificate issued by the RA.

1. The provisions of the Root CA CP/CPS, GovCA CP/CPS, and other pertinent documents are binding upon the subscriber.

2. All the information provided in the digital certificate application form is true and correct.

3. The use of the digital certificate shall be for the sole use of the subscriber.

4. The subscriber will not, under any circumstances, allow any other person to use the digital certificate. Any such use by another person constitutes a compromise of the associated private key, requiring the revocation of the digital certificate.

5. The subscriber shall protect the confidentiality of the private key associated with his or her digital certificate as well as any PIN number or other means used to activate the private key.

6. The subscriber shall remain solely responsible for the maintenance of the confidentiality of the certificate.

7. The subscriber shall not use the digital certificate for any unlawful purpose, or for any purpose that does not have anything to do with accessing the PKI information systems or transactions using the digital certificates.

8. The subscriber shall promptly request the RA to revoke the digital certificate upon knowing or suspecting inaccurate information, loss, exposure or compromise of the associated private key.

9. The subscriber shall not tamper, interfere with, or reverse-engineer any technical implementation of the digital certificate or its use, or in any manner seek to compromise the security provided by the RA and the National PKI system.

10. The subscriber accepts the risk of an undetected compromised digital certificate or associated private key, which may be used to impersonate the said subscriber.

5.0 Permission to Publish Information

The Subscriber agrees that PNPKI may publish the serial number of the Subscriber’s Digital Certificate in connection with PNPKI’s dissemination of CRL’s and OCSP.

6.0 Disclaimer

PNPKI shall not be liable for any claims arising from prohibited use of Digital Certificates issued by GovCA. PNPKI will not be liable if the user has not respected his obligations mentioned in the CPS and in this agreement.

7.0 Term and Termination

This agreement shall terminate upon

(a) The expiry date of any Digital Certificate issued to the Subscriber

(b) Any failure to comply with any of the subscriber obligations mentioned in this Subscriber Agreement

8.0 Effect of termination

Upon termination of this Subscriber Agreement for any reason, PNPKI may revoke the Subscriber’s Digital Certificate in accordance with PNPKI revocation procedures.

9.0 CP and CPS Information

The digital certificate contains information provided by the subscriber, which is authenticated by the RA in accordance with the requirements set out in the CA CP and CPS, available for viewing and download at dict.gov.ph/pnpki/.

For a copy of the document click the link below:

 Digital Certificate Subscriber Agreement

PNPKI Certificate Policy Version 2.0

Republic of the Philippines

Department of Information and Communications Technology

18 January 2017

DEPARTMENT CIRCULAR

NO. 2017 – 001

TO : ALL HEADS OF DEPARTMENTS, BUREAUS, OFFICES AND OTHER AGENCIES OF THE NATIONAL GOVERNMENT, INCLUDING CONSTITUTIONAL COMMISSIONS, CONGRESS, THE JUDICIARY, OFFICE OF THE OMBUDSMAN, STATE UNIVERSITIES AND COLLEGES, GOVERNMENT-OWNED OR -CONTROLLED CORPORATIONS, LOCAL GOVERNMENT UNITS AND ALL OTHERS CONCERNED

SUBJECT : AMENDING THE PHILIPPINE NATIONAL PUBLIC KEY INFRASTRUCTURE (PNPKI) ROOT CERTIFICATION AUTHORITY CERTIFICATE POLICY VERSION 1.0

SECTION 1. BACKGROUND AND RATIONALE

1.1 Execuctive Order (E.O.) No. 810, series 2009 institutionalized the certification scheme for digital signatures and directed the application of digital signatures in e-Government Services.

1.2 Section 3(a) of E.O. No. 810, s2009 designated the National Computer Center (NCC) to operate the Philippine Root CA (RootCA).

1.3 Section 15 of Republic Act No. 10844 abolished NCC and transferred its powers and functions, applicable funds and appropriations, records, equipment, property and personnel to the Department of Information and Communications Technology (DICT).

1.4 ICT Office Memorandum Circular No. 2013-001 approved the PNPKI Certificate Policy (CP) version 1.0 in operating the Philippine RootCA.

SECTION 2. PURPOSE

This Department Circular is being issued to amend the PNPKI Certificate Policy version 1.0 issued by the Information and Communications Technology Office (ICT Office) last 23 December 2013.

SECTION 3. COVERAGE

3.1 This Department Circular shall cover all Departments, Bureaus, Offices and Other Agencies of the National Government, including Constitutional Commissions, Congress, the Judiciary, Office of the Ombudsman, State Universities and Colleges, Government-Owned or -Controlled Corporations, Local Government Units.

3.2 The implementation of this Department Circular shall also cover private entities that will make use of the services of the Philippine RootCA.

SECTION 4. APPROVAL OF THE PNPKI CP

The attached PNPKI CP version 2.0 is hereby approved and to be implemented in operating the Philippine RootCA in compliance with Section 3(a) of E.O. No. 810, s2009.

SECTION 5. ADMINISTRATION OF THE PNPKI CP

The administration and updating of the PNPKI CP shall be the responsibility of the PNPKI Team under the DICT.

SECTION 6. REPEALING CLAUSE

All other Circulars and Issuances or parts thereof that are inconsistent with this Department Circular are hereby repealed or modified accordingly.

SECTION 7. EFFECTIVITY

This Department Circular shall take effect immediately upon filing three (3) certified true copies with the Office of the National Administrative Register, University of the Philippines Law Center and publication in a newspaper of general circulation.

APPROVED.

(Sgd.) RODOLFO A. SALALIMA

Secretary

Download a copy of the  DC for PNPKI CP 

Attachment:  PNPKI CP Version 2.0 

Certification Practice Statement Version 1.0

December 23, 2013

Memorandum Circular No. 2013-002

Series of 2013

FOR: ALL HEADS OF THE NATIONAL GOVERNMENT DEPARTMENTS / AGENCIES / BUREAUS, GOVERNMENT-OWNED AND ‑CONTROLLED CORPORATIONS; GOVERNMENT FINANCIAL INSTITUTIONS; STATE UNIVERSITIES AND COLLEGES;  LOCAL GOVERNMENT UNITS; CONSTITUTIONAL BODIES, HOUSE OF REPRESENTATIVES, THE SENATE AND THE JUDICIARY

SUBJECT: APPROVAL OF THE PHILIPPINE NATIONAL PUBLIC KEY INFRASTRUCTURE (PNPKI) CERTIFICATION AUTHORITY (CA) CERTIFICATION PRACTICE STATEMENT (CPS) VERSION 1.0

SECTION 1. APPROVAL OF THE PNPKI CA CPS

The attached PNPKI CA CPS version 1.0 is hereby approved and to be implemented in operating the PNPKI CA in compliance with Section 3(b) of E.O. 810 series of 2009.

SECTION 2. ADMINISTRATION OF THE PNPKI CPS

The administration and updating of the PNPKI CA CPS shall be the responsibility of the PKI component team of the iGovPhil Program until the DOST‑ICT Office Rationalization Plan is fully implemented. The responsibility of updating the PNPKI CA CPS shall then be lodged with the Policies and Standards Division under the National ICT Governance Service.

SECTION 3. DIRECTIVE TO THE DOST-ICT OFFICE RECORDS OFFICER

The DOST‑ICT Office Records Officer is hereby ordered to furnish three (3) certified true copies of this Memorandum Circular and the attached PNPKI CA CPS version 1.0 to the University of the Philippines Law Center.

SECTION 4. EFFECTIVITY.

This Memorandum Circular shall take effect immediately.

Recommending Approval:

(Sgd.) DENIS F. VILLORENTE

iGovPhil Program Director

Approved By:

(Sgd.) LOUIS NAPOLEON C. CASAMBRE

Executive Director

DOWNLOAD a copy of the  MC for PNPKI CPS

Attachment:  PNPKI CPS Version 1.0 

GovRA Accreditation Guidelines

April 25, 2014

MEMORANDUM CIRCULAR NO. 2014-001

Series 2014

FOR: GOVERNMENT AGENCIES WANTING TO BECOME A GOVERNMENT REGISTRATION AUTHORITY (GOVRA)

SUBJECT: PRESCRIBING POLICIES AND PROCEDURES GOVERNING THE ACCREDITATION OF GOVERNMENT REGISTRATION AUTHORITIES UNDER THE NATIONAL CERTIFICATION SCHEME FOR DIGITAL SIGNATURES

Pursuant to the provisions of Executive Order No. 810 issued on 15 June 2009 and entitled, “Institutionalizing the Certification Scheme for Digital Signatures and Directing the Application of Digital Signatures in E-Government Services,” this Memorandum Circular is hereby prescribed by the National Computer Center (NCC), in its capacity as Government Certification Authority (GovCA), for the compliance, information, and guidance of all concerned:

Section I OBJECTIVES

This Memorandum Circular prescribes the POLICIES AND PROCEDURES governing the accreditation of government agencies as Government Registration Authorities (GovRAs) under the National Certification Scheme for Digital Signatures as mandated under Executive Order No. 810, Series of 2009.

Section II DEFINITION OF TERMS

1. Accreditation and Assessment Body – refers to the body that accredits the Certification Authorities (CAs) and conducts regular assessment of such CAs to ensure compliance to prescribed criteria, guidelines and standards; refers to the Philippine Accreditation Office (PAO), under the Department of Trade and Industry (DTI);

2. Certificate – an electronic document issued to support a digital signature, which purports to confirm the identity or other significant characteristics of the person who holds a particular key pair. Certificates issued may be for general use or for specific use only;

3. General Certificate – a certificate which can be used for all government and private transactions;

4. Specific Purpose Certificate – a certificate which can only be used for a specific purpose;

5. Certificate Revocation List (CRL) – a time-stamped list that identifies/ contains revoked or invalid certificates. The CRL is signed by a Certification Authority and is published periodically in a public repository;

6. Certification Authority (CA) – issues digitally-signed public key certificates and attests that the public key embedded in the certificate belongs to the particular subscriber as stated in the certificate. A CA may be involved in a number of administrative tasks such as end-user registration, although these tasks are often delegated to the Registration Authority (RA). The CA may either be a government body or private entity;

7. Digital Signature – refers to an electronic signature consisting of a transformation of an electronic document of an electronic data message using an asymmetric or public cryptosystem, such that a person having the initial untransformed document and the signer’s public key can accurately determine: (i) whether the transformation was created using the private key that corresponds to the signer’s public key; and (ii) whether the initial digital document had been altered after the transformation was made;

8. Government Certification Authority (GovCA) – refers to the government body that issues digitally-signed public key certificates and attests that the public key embedded in the certificate belongs to the particular subscriber as stated in the certificate. The GovCA designates Government Registration Authorities (GovRAs) and conducts regular assessment of such GovRAs to ensure compliance to prescribed criteria, guidelines and standards. The GovCA is part of ICTO;

9. Government Registration Authority (GovRA) – refers to a government agency designated by the Certification Authority (CA) to perform administrative tasks such as end-user registration;

1. Root Certification Authority (Root CA) – issues and manages certificates to government and private CAs; the Root CA is part of ICTO;

2. Subscriber – an individual or entity applying for and using digital certificates issued by the CA;

3. Personal Information Controller – means a person or organization who controls the collection, holding, processing or use of personal information. It includes a person or organization who instructs another person or organization to collect, hold, process, use, transfer, or disclose personal information on his or her behalf, but excludes a person or organization who performs such functions as instructed by another person or organization. It also excludes an individual who collects, holds, processes or uses personal information in connection with the individual’s personal, family or household affairs.

Section III GOVERNMENT REGISTRATION AUTHORITY ACCREDITATION

GovRA accreditation is granted following the mandatory evaluation of an applicant-government agency’s compliance with this Circular. Certification shall be valid for three (3) years, unless suspended or revoked sooner, and subject to the mandatory annual assessment of compliance.

Section IV. CONDITIONS FOR ACCREDITATION FOR GOVRA

1. Certification shall be valid for three (3) years unless suspended or revoked sooner, and subject to the mandatory annual assessment of compliance;

2. The GovRA-applicant must fulfill basic technical agency requirements before or during the certification process. The full list of technical agency-related requirements is attached as Annex A, which shall form an integral part of this Memorandum;

3. Application for accreditation

a) The GovRA-applicant shall send an application letter to the GovCA outlining their objectives in applying for the position of GovRA and their intended subscribers;

b) On receipt of the application letter and the accomplished application form, the GovCA shall acknowledge the application within nine (9) calendar days and direct the applicant-government agency to complete the following required documents within thirty (30) calendar days for document review. The required documents shall form part of the criteria used to evaluate the applicant-agencies, and shall be discussed in detail on Article V:

i. Certified copy of charter / legal document creating the agency and any amendments;

ii. Disaster recovery and business continuity plan;

iii. GovRA operations manual;

c) If the GovRA-applicant is not able to respond to submission of the required documents within the specified number of days stated above, the processing of the application shall be terminated. However, the GovRA-applicant may still reapply for GovRA accreditation;

1. Document Review

a) The GovCA shall undertake the review of the submitted documents. Results of the review are communicated to the GovRA-applicant for any clarifications or concerns regarding the submitted documents;

b) The GovRA-applicant must address the concerns raised by the document reviewer within five (5) days. All the required documents need to be approved before an applicant government agency is accredited as a GovRA.

1. Preparation for Assessment

a) An assessment team shall be appointed by the GovCA to conduct an on-site assessment of the GovRA-applicant premises;

b) The assessment team shall sign an Impartiality and Confidentiality Statement before conducting the assessment;

1. Conduct of Assessment

a) The date of assessment shall be communicated to the GovRA-applicant prior to the actual assessment and shall be agreed upon by the GovRA-applicant and the GovCA;

b) The assessment shall be done against the requirements of relevant standards and criteria as required by GovCA;

c) During the assessment, the team shall review the policies and procedures of the GovRA-applicant as documented in its Operations Manual and other relevant documents. The team shall also assess the implementation of these operation standards and the overall competence of the GovRA-applicant in their issuance of digital certificates or signatures;

1. Evaluation

a) Following completion of document review and on-site assessment, an evaluation shall be conducted by an independent panel assigned by the GovCA;

b) All costs involved in the course of the assessment shall be the responsibility of the GovRA-applicant.

1. Recommendation

a) If there are no negative findings raised, the GovRA-applicant shall be recommended for accreditation. Otherwise, the GovRA-applicant shall be given thirty (30) calendar days to rectify the negative findings. If the GovRA-applicant is unable to remediate the negative findings, the application shall be denied;

b) A recommendation letter for accreditation will be issued to the successful GovRA-applicant. A Memorandum of Understanding shall be signed between the GovCA and the (recommendee) successful GovRA-applicant, with the final version of the approved documents evaluated during the accreditation process annexed as part of the memorandum.

1. Issuance of Certificate

a) A certificate shall be issued to the successful GovRA- applicant and their information added to the GovCA website;

b) The whole accreditation process is required to be completed within ninety (90) calendar days from the date of submission of documents, otherwise the GovRA-applicant shall need to re-apply;

c) The requirements for certification are a continuing requirement that must be maintained by the GovRA-certified agency for as long as it is functioning as such. The GovCA may revoke the agency’s GovRA status if the GovRA fails to uphold its requirements.

Section V. DOCUMENTARY CRITERIA FOR APPLICANT EVALUATION

Strict compliance with the criteria listed below is mandatory for all government agencies applying for certification to become a GovRA. All approved documents for public use are required to be uploaded and made public to the GovRA website. The following essential documents must be supplied and will be used for evaluation:

1. Disaster Recovery and Business Continuity Plan

The Disaster Recovery and Business Continuity Plan is an internal document for the use of GovRA personnel describing how services will be restored in the event of a system crash or failure.

It shall describe the emergency response procedure to be followed in the event of a disaster affecting the function(s) of the GovRA; a security incident or suspected security incident affecting the function(s) of the GovRA. The document shall include mechanisms for the preservation of evidence of system misuse which could be admissible in a court of law.

This internal document is not publicly available and is restricted to ensure that the document is consistent with the information contained in the Security Profile, Operations Manual and the Code of Practice for Information Security Management (ISO/IEC 27002:2005) and the Guidelines for Information and Communications Technology Disaster Recovery Services (ISO/IEC 24762:2008).

1. GovRA Operations Manual

The GovRA Operations Manual describes how the GovRA service will be operated and managed on a day to day basis, providing details of the functions and responsibilities of the personnel within the GovRA. It is essentially an internal document for use by the GovRA staff and will also describe the GovRA staffs’ training plan and the Entity Identification process when hiring staff. It will provide directions for the personnel on the implementations of policies and procedures specified in the Security Profile and the Disaster Recovery and Business Continuity Plan.

Section VI. PERSONNEL HIRING REQUIREMENTS

The GovRA hiring practices shall include, as a minimum, the following processes on personnel handling Entity Identification materials:

1. Duly accomplished GovRA Employee User Application Form to be submitted to GovCA;

2. Police, NBI and Court Clearance;

3. Background check;

4. Mandatory orientation session with each employee;

5. Computer literate;

6. Signed non-disclosure agreement between the GovRA and the employee;

7. Development and implementation of appropriate training courses for all GovRA employees;

8. Orientation course on Electronic Commerce Act of 2000 (R.A. 8792), Executive Order No. 810, Series of 2009, Data Privacy Act of 2012 (R.A. 10173) and Cybercrime Prevention Act of 2012 (R.A. 10175);

9. Orientation course on GovRA module, including Overview, Configuration and RA User Operation, and GovCA Certificate Policy and Certification Practice Statement (CPS) to be conducted by the GovCA.

Section VII. SUBSCRIBER-APPLICANT IDENTIFICATION PROCESSING

Identification of the subscribers of Digital Certificates shall be done through the following:

1. An individual applicant shall comply with the following for identification:

a) Personal appearance of the applicant;

b) Taxpayer Identification Number (TIN);

c) A Unified Multi-Purpose Identification (UMID)-compliant card. In the absence of a UMID-compliant card, any two of the following cards are allowed as valid IDs based on BSP Circular 608, series of 2008:

i. Passport

ii. Driver’s License

iii. Professional Regulation Commission (PRC) ID

iv. National Bureau of Investigation (NBI) Clearance

v. Police Clearance

vi. Postal ID

vii. Voter’s ID

viii. Government Service Insurance System (GSIS) e-Card

ix. Social Security System (SSS) Card

x. Senior Citizen Card

xi. Overseas Workers Welfare Administration (OWWA) ID

xii. OFW ID

xiii. Seaman’s Book

xiv. Alien Certification of Registration/Immigrant Certificate of Registration

xv. Government Office and GOCC ID, e.g. Armed Forces of the Philippines (AFP ID), Home Development Mutual Fund (HDMF ID)

xvi. Certification from the National Council for the Welfare of Disabled Persons (NCWDP)

xvii. Department of Social Welfare and Development (DSWD) Certification

xviii. Integrated Bar of the Philippines

xix. Company IDs Issued by Private Entities or Institutions Registered with or Supervised or Regulated either by the BSP, SEC or Insurance Commission

d) A passport-sized photo taken within the last six (6) months;

e) Phone number (mobile and/or landline);

f) E-mail address owned by the individual or authorized by the owner for use by the subscriber;

g) Latest copy of a bill showing the physical address of the applicant, where the PIN which will be used to activate a digital certificate shall be mailed; and

h) Consent to verify the information submitted.

1. For the juridical applicant:

a) Requests for CA certificates shall include the CA name, address and documentation of the existence of the organization;

b) The PNPKI RootCA or subordinate CA shall verify the information in addition to the authenticity of the requesting representative and the representative’s authorization to act in the name of the CA;

c) A juridical applicant’s information shall be verified with prior submission of the following:

i. Taxpayer Identification Number (TIN);

ii. Authorization Letter or Board Resolution naming up to three (3) authorized representative/s to apply for a digital certificate in behalf of the agency;

iii. Consent to verify the information submitted;

iv. Verified e-mail address owned by the organization or authorized by the owner of the e-mail address to be used by the organization; and

v. Latest copy of a bill containing the address of the applicant where the PIN, which will be used to activate a digital certificate, shall be mailed;

vi. Juridical applicants shall send their applications via authorized representatives who shall comply with all of the requirements for individual applicant;

d) For a government agency:

i. Government Service Insurance System (GSIS) registration number;

e) For non-government agencies:

i. Securities and Exchange Commission (SEC) business registration for corporation and partnership, DTI Certificate of Business Name Registration for single proprietorship, or Cooperative Development Authority (CDA) registration for cooperatives;

ii. Business Permit issued by the Local Government Unit (LGU); and

iii. Social Security System (SSS) Employer Clearance;

f) For organizations requesting SSL Certificates, the following requirements shall be complied:

i. Authorization letter, signed by the head of the organization, naming the authorized representative/s; and

ii. Certification from the Philippine Government Internet Domain Name Registry validating the authenticity of the entity’s domain name or other recognized domain name registry operating in the Philippines recognized by the PNPKI; or any proof of ownership of a particular domain name.

Section VIII. PRIVACY POLICY

The processing of personal information shall be allowed, subject to compliance with the requirements of this Guideline and other laws, in particular R.A. 10173, allowing disclosure of information to the public and adherence to the principles of transparency, legitimate purpose, and proportionality.

Personal information must be:

1. Collected for specified and legitimate purposes determined and declared before, or as soon as reasonably practicable after collection, and later processed in a way compatible with such declared, specified and legitimate purposes only;

2. Processed fairly and lawfully;

3. Accurate, relevant and, where necessary for purposes for which it is to be used the processing of personal information, kept up to date; inaccurate or incomplete data must be rectified, supplemented, destroyed or their further processing restricted;

4. Adequate and not excessive in relation to the purposes for which they are collected and processed;

5. Retained only for as long as necessary for the fulfillment of the purposes for which the data was obtained or for the establishment, exercise or defense of legal claims, or for legitimate business purposes, or as provided by law; and

6. Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected and processed: Provided, That personal information collected for other purposes may lie processed for historical, statistical or scientific purposes, and in cases laid down in law may be stored for longer periods: Provided, further, That adequate safeguards are guaranteed by said laws authorizing their processing.

The GovRA must ensure implementation of personal information processing principles set out herein.

Section IX. AMENDMENTS TO THE GUIDELINES

The accreditation guidelines outlined in this Circular may change over time to reflect advances in technology and government policies. Any such amendments will be done in consultation with existing accredited GovRAs in accordance with the terms of their existing certification. The time frame for compliance with the new criteria is set to ninety (90) days.

Section X. OTHER APPLICABLE LAWS AND PENALTIES

The use and issuance of digital certificates shall be covered by the provisions of Republic Act No. 8792 or the Electronic Commerce Act of 2000, Republic Act No. 8484 or the Access Devices Regulation Act of 1998 and Republic Act No. 7394 or the Consumer Act of the Philippines and their Implementing Rules and Regulations (IRRs). Hence, violations committed against such laws in relation to the use and issuance of digital certificates shall be subject to the penalties applicable under said laws and their IRRs.

Section XI. DIRECTIVE TO THE DOST-ICT OFFICE RECORDS OFFICER

The DOST-ICT Office Records Officer is hereby ordered to furnish three (3) certified true copies of this Memorandum Circular and the attached annex to the University of the Philippines Law Center.

Section XII. EFFECTIVITY

This Circular shall take effect immediately.

Recommending Approval:

(Sgd.) DENIS F. VILLORENTE
iGovPhil Program Director

Approved By:

(Sgd.) LOUIS NAPOLEON C. CASAMBRE
Executive Director

DOWNLOAD a copy of the  Government Registration Authority (GovRA) Accreditation Guidelines 

Time Stamping Authority

Certificate Chain of Trust

How to Install the PNPKI Certificate Chain of Trust

• For Windows users:

1. Close all browsers.

2. Unzip the Root CA certificate installer.zip.

3. Double click on the setup.exe.

4. Click Yes at the User Account control.

5. Follow installation procedure then click on Install.

6. Wait for it to install then click finish.

• For Mac users:

To download instructions on how to install the PNPKI chain of trust in Mac click the link below:

 PNPK Certificate Chain of Trust

Certificate Authority (CA) Certificates

to download certificates, right click then save link as

Philippine PKI CA Certificates – CER Format

SHA256 

sum: 8af4bbeb31aecb390b4ff77005c5736f9049a99ce4b93f0008f7fccd9d54a50b

PNPKI Forms

Individual Certificate Application Form

This form is for bulk application of government agencies. For individual application, please complete the registration at the Online Registration System (ORS) portal.

[PNPKI Individual Certificate Application Form.pdf]

For further inquiries on the bulk application process, please email the respective PNPKI Team in your region. Their email addresses are available on the Contact Information tab.

Individual Certificate Application Form

This form is for juridical entities, as Agency Certificates represent and bear the name of the agency.

[PNPKI Agency Certificate Application Form.pdf]

For further inquiries, please email the respective PNPKI Team in your region. Their email addresses are available on the Contact Information tab.

Certificate Revocation Form

If you require a new certificate due to compromise, loss of the previously issued certificate, or inaccessibility of the p12 password, it is necessary to request a revocation of the existing certificate. To request revocation, please complete and submit the signed revocation form to the respective PNPKI Team in your region. Their email addresses are available on the "Contact Information tab.

[PNPKI Certificate Revocation Form.pdf]

Once the revocation request is approved, you may request a new digital certificate through the Self-Service Portal. Please note that revoked certificates are invalid and unusable.

PNPKI Manuals

Certificate Enrollment and Installation

How to Install a Digital Certificate on Windows Key Store
How to Install Digital Certificates in macOS Keychain Access
How to Activate and Download your PNPKI Digital Certificate 

Document Signing and Timestamping

Digitally Signing a PDF with Adobe Acrobat Reader
Digitally Signing PDF with Foxit PDF Reader
How to Add a Timestamp with Adobe Acrobat Reader
How to Add a Timestamp with Foxit PDF Reader 

Email Signing and Encryption

Complete Guide: How to Digitally Sign and Encrypt Emails Using Thunderbird 

PC Cleaning

How to delete unwanted copies of your digital certificates on Windows PC(e)
How to delete unwanted copies of your digital certificates on Mozilla Thunderbird(e) 

Tutorial Videos

The Online Registration System (ORS) and PhilSign Mobile Applications of the Philippine National Public Key Infrastructure (PNPKI) are platforms developed that aim to serve the Filipino people by enabling secure and efficient digital transactions, fostering the widespread adoption of secure digital signing, and strengthening trust in electronic processes, particularly in government transactions. Privacy Policy

PRIVACY NOTICE

The Online Registration System (ORS) and PhilSign Mobile Applications of the Philippine National Public Key Infrastructure (PNPKI) are platforms developed that aim to serve the Filipino people by enabling secure and efficient digital transactions, fostering the widespread adoption of secure digital signing, and strengthening trust in electronic processes, particularly in government transactions. These initiatives are part of the broader mission to promote a digitally empowered society in the Philippines.

At DICT, we recognize the importance of data privacy and are committed to protecting your personal data. In line with this, we ensure that we comply with the Data Privacy Act of 2012 (RA 10173), along with its Implementing Rules and Regulations as well as any other relevant data privacy-related laws and issuances by the National Privacy Commission. Furthermore, we only collect and process information that is necessary to fulfill the purpose of our platform. This Privacy Notice explains what information we collect, process, and share. It also informs you why we do so, and your data privacy rights with regard to your information.

We may update this Privacy Policy to reflect needed changes in our policy to comply with the law. In such cases, we encourage you to check for updates on our Privacy Policy, if notified. This is available on our website or app for your information and reference.

WHAT DATA DO WE COLLECT

The information we collect from the User may either be Personal Information (PI) and/or Sensitive Personal Information (SPI), as defined in the Data Privacy Act of 2012:

Personal Information (PI) is any information from which the identity of an individual can be reasonably and directly ascertained, or when put together with other information would directly and certainly identify an individual, such as name, date, and place of birth, specimen signature or biometrics (fingerprint, face recognition, palm print, etc.), photo, present and permanent address, source of fund or income, name of employer or the nature or self-employment or business, contact details such as personal telephone number, personal mobile number, and official work email address, mother’s maiden name, cookie information, user credentials (i.e., username and password, PIN/MPIN, etc.), contacts list, geolocation, and information about the device you use to interact with us.

Sensitive Personal Information (SPI) is any information that falls under the category of personal information with higher security impact as described in applicable privacy law. This information includes but is not limited to marital status, cardholder data (CVV/CVC, Expiry Date), tax returns, government-issued numbers peculiar to an individual (ex. SSS, GSIS, UMID, etc.), information on IDs issued by private companies that are duly registered with the Securities and Exchange Commission, and student IDs for those who are not yet of voting age (below 18 years old).

The information we collect from our subscribers for the various functions of the platform is as follows:

ORS / PhilSign Mobile Application

         Personal Information

●      Full Name

●      Sex

●      Civil Status

●      Date and Place of Birth

         Organizational Details

●      Organization Name & Unit

         Residential Address

●      Residential Address

●      Official Work Email Address

         Contact Numbers

●      Landline or Mobile Number

         Uploading of Required Documents

●      Primary Identification

●      Secondary Identification

         KYC for Users

●      Liveness Detection/Verification

By registering their account, users can have full access to the PhilSign Mobile Application.

HOW YOUR PERSONAL DATA IS COLLECTED

We collect your Personal Data when you:

●      register in the App;

●      provide us with supporting documents to validate your identity;

●      disclose your information through phone calls, emails, SMS, or verbal communication with our authorized representatives; and

●      visit and contact us through our official contact and/or address.

No information from users will be collected until they have given their express consent. During the initial registration process, clicking the checkbox will signify that the user has read and agrees to the General Terms and Privacy Conditions.

HOW WE USE YOUR PERSONAL DATA

We will only use your Personal Data when needed for the various features of the PNPKI Mobile Applications. We may not process or use your information without your express consent.

Data will be used for the purpose of registering an account within the application and updating their profile accordingly for the e-KYC procedure. Doing this grants them full access to the various features of PNPKI Mobile Applications.

When required by our Privacy Policy and the law and before we use or process your Personal Data for any other purpose, we will ask for your consent.

The Philippine National Public Key Infrastructure (PNPKI), overseen by the Department of Information and Communications Technology (DICT), is the legal and technical foundation for secure electronic transactions and digital signatures in the Philippines. Established by various laws and government issuances, it provides the essential infrastructure to ensure the authenticity, integrity, and legal validity of digital documents, building trust in the nation's digital economy. 

Key Legislation

• Electronic Commerce Act of 2000 (Republic Act No. 8792):
  View

This is the foundational law for all electronic transactions in the Philippines. It gives legal recognition to electronic documents and signatures, stating they have the same legal effect as paper-based counterparts. It defines an electronic signature as any mark or procedure that identifies a person and a digital signature as a specific, more secure type that uses cryptography.

• Cybercrime Prevention Act of 2012 (Republic Act No. 10175:
  View

This act provides a legal framework to address crimes committed through the use of information and communication technologies. It protects the integrity of digital transactions, which is reinforced by the PNPKI.

• Data Privacy Act of 2012 (Republic Act No. 10173):
  View

The PNPKI complements this law by helping to secure personal information during electronic transactions through encryption and other security measures. 

• Ease of Doing Business and Efficient Government Service Delivery Act of 2018 (Republic Act No. 11032):
  View

This law requires digital versions of government documents like permits and licenses to have the same legal validity as their physical counterparts, making digital signatures essential for authentication.

• E-Governance Act of 2025 (Republic Act No. 12254):
  View

This law mandates government agencies to streamline their processes and adopt a "zero-contact" policy. It requires agencies to create electronic versions of licenses, permits, and clearances that have the same legal weight as physical documents. This implicitly necessitates the use of digital signatures for official authentication.

Foundation Executive Orders and Department Circulars

• Executive Order No. 810, s. 2009:
  View

This EO institutionalized the certification scheme for digital signatures and directed the use of digital signatures in e-government services.

• DTI-DOST Joint Department Administrative Order No. 02 Series of 2001:

This issuance provides the Implementing Rules and Regulations (IRR) for the Electronic Commerce Act. It details the legal validity of electronic signatures and clarifies the technical requirements for a digital signature to be legally enforceable.

• Department of Trade and Industry: Department Administrative Order No.10-09:
  View

This order prescribes the rules governing the accreditation of Certification Authorities (CAs) for digital signatures. This order is a crucial part of the framework for implementing the Electronic Commerce Act of 2000 and Executive Order No. 810, which institutionalized the certification scheme for digital signatures. By establishing the criteria and processes for accrediting CAs, DAO No. 10-09 ensures the reliability, trustworthiness, and legal validity of digital signatures used in both government and private sector electronic transactions.

• Department of Trade and Industry: Department Administrative Order No.11-01 s. 2011:
  View

This outlines the general rules and guidelines for implementing the National Certification Scheme for Digital Signatures. This order serves as a key component for enforcing the Electronic Commerce Act of 2000 and Executive Order No. 810, Series of 2009, which aims to institutionalize the use of digital signatures in government and private sector transactions.

• Administrative Matter No. 01-7-01-SC: Rules on Electronic Evidence:
  View

Issued by the Supreme Court, this set of rules governs how electronic documents and signatures are presented as evidence in court. It strengthens the legal standing of digital signatures by providing a disputable presumption of authenticity once the signature is authenticated. This makes it a powerful tool for non-repudiation in legal proceedings.

• Administrative Matter No. 24-10-14-SC: Rules on Electronic Notarization:
  View

Issued by the Supreme Court, this recognizes and incorporates electronic signatures and digital signatures as a fundamental part of the digital notarization process. This landmark reform, which supplements the traditional 2004 Rules on Notarial Practice, enables the legal and secure notarization of electronic documents in the Philippines.

Implementing Circulars by Government Bodies