THE UNIVERSITY has laid out protocols for handling data breaches and notifying affected individuals under its revised Data Privacy Manual, which also strengthens safeguards for storing, transmitting and disposing of electronic personal data.
Why it matters: The manual specifies the information UST must provide when personal data is compromised and the measures intended to prevent unauthorized access, disclosure and loss.
In case of a breach: UST must inform affected data subjects of the nature of the breach and the personal data possibly involved.
- The University must also disclose the measures it has taken to address the breach and steps individuals may take to reduce possible harm or negative consequences.
- Affected individuals must be informed of assistance available from UST and given the name and contact details of a University representative from whom they may obtain additional information.
- Notifications must be sent through secure written or electronic means.
The bigger picture: The University is responsible for the integrity and availability of personal data stored electronically and for ensuring that such information is accessible only to authorized recipients.
- Vital records must also be protected, preserved and recovered in accordance with applicable laws and relevant University policies.
Storage and security: Electronic personal data collected through University information systems, such as the MyUSTe portal, will be stored in authorized on-premises facilities and cloud-based systems provided by official third-party providers.
- Access will be managed by Compliance Officers for Privacy (COPs), who ensure that only authorized personnel are granted access for declared, specified and legitimate purposes.
- Logbooks, electronic access records or similar record-keeping mechanisms must also be maintained for rooms and areas containing personal data.
Get your data: Personal data processed electronically may be obtained in copies from the Personal Information Controller, subject to permitted further use.
- Electronic records due for disposal must be securely erased or otherwise rendered permanently inaccessible using methods appropriate to the storage medium and nature of the data.
- Computers and other electronic devices being relocated or disposed of must likewise have stored personal data erased in accordance with security disposal procedures and proper documentation.
Electronic communications: The manual emphasizes caution when using emails and file-sharing systems involving sensitive personal information.
- Because electronic data is susceptible to copying, forwarding, interception and disclosure to unauthorized persons, University personnel must transmit personal data only through appropriately secured systems and to intended, authorized recipients.
- These systems may use encryption, access controls, password protection or other safeguards prescribed by the University.
- The 2026 manual also expands on approaches to electronic data collection alongside traditional physical means of collecting information.
- Before collecting personal data, the University must ensure that individuals voluntarily give their consent through written, recorded or electronic means.
What else changed: The revised manual incorporates updates from applicable laws, regulations and institutional policies governing the responsible, lawful and transparent processing of personal data.
- It covers the rights of data subjects, privacy principles, types of information collected by or on behalf of UST, and procedures for handling, protecting and disposing of stored data.
- Development of the revised manual began in 2017. After legal reviews and revisions, the final version was approved by the University’s Board of Trustees and published online on July 31, 2026.
- The manual is available through the University’s official communication platforms. Regis Avalo Jophiel L. Lim
