Data Protection & NPC Disclosure.
Last updated October 2026
LaQuest’s commitments under the Philippine Data Privacy Act of 2012, and how to reach our Data Protection Officer.
1. Our commitment
LaQuest processes personal information in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC). We apply the principles of transparency, legitimate purpose and proportionality to everything we collect and process, whether as a personal information controller for our own operations or as a personal information processor for the institutions we serve.
2. Data Protection Officer
LaQuest has designated a Data Protection Officer accountable for compliance with the Act.
- Email: privacyofficer@laquest.net
- Address: Data Protection Officer, LaQuest Philippines Inc., 8th Floor, Unit B2, Commerce and Industry Plaza Building, McKinley Town Center, Campus Avenue, Fort Bonifacio, Taguig, 1635 Metro Manila
- Phone: +63 2 5310 5248
3. NPC registration
LaQuest registers its Data Protection Officer and its data processing systems with the National Privacy Commission, in line with NPC Circular No. 2022-04. The registration reference and validity period are shown below.
4. When we process on behalf of institutions
Where LaQuest operates a platform or service for a customer institution (for example HIMS, BrMIS, LIMS or LaQuest Payroll), the institution remains the personal information controller. LaQuest processes only on documented instructions under a data processing agreement that covers purpose, security measures, sub-processors, breach notification, assistance with data subject requests and return or deletion at the end of the engagement.
5. Security measures
We maintain organisational, physical and technical security measures proportionate to the sensitivity of the data and the risks involved, including role-based access, encryption in transit, logging and monitoring, secure development practices, staff confidentiality undertakings and privacy training. Measures for each platform are documented in the relevant engagement.
6. Breach management
LaQuest maintains a personal data breach management procedure. Where a breach involves sensitive personal information or information that may enable identity fraud and is likely to give rise to a real risk of serious harm, we notify the NPC and affected data subjects within the period the Act and NPC issuances require, and support customer institutions in meeting their own notification duties.
7. Rights of data subjects
Data subjects have the rights to be informed, to object, to access, to rectification, to erasure or blocking, to damages, to data portability and to file a complaint with the NPC. Requests can be made to the DPO; we respond within the timelines set by the NPC and verify identity before acting.
8. Retention and disposal
Personal information is retained only for as long as necessary for the declared purpose, or as required by law or contract, and is then securely disposed of or anonymised.
9. Complaints
If you believe your personal information has been mishandled, contact the DPO first. You may also lodge a complaint with the National Privacy Commission of the Philippines.
NPC registration.
LaQuest Philippines Inc. has met the registration requirements under the Data Privacy Act of 2012, its Implementing Rules and Regulations and related directives. The certificate is evidence of registration and does not validate the contents of the documents submitted.