The eSAP (Electronic Submission Authentication Portal) platform provides a digital authentication service for SEC documents. It replaces the traditional paper-based process, eliminating the need for wet signatures, notarization, and the submission of hard copies. Instead, it uses One Time Passwords (OTPs) and the Philippine National Public Key Infrastructure (PNPKI) to authenticate SEC-required documents electronically. This enhances the efficiency and convenience of submitting documents for SEC online services.

We collect the following personal information:

 • Full name
 • Tax Identification Number (TIN) or Passport No
 • Mobile Number
 • Email Address
 • Home Address
 • Business Address
 • Nationality
 • Sex
 • Birth date

The collected personal information will be utilized in the processing of authenticating documents.

We collect personal information when a user registers or interacts with the eSAP system to authenticate SEC documents. The personal data is required for the authentication process to ensure the validity and security of the documents being submitted electronically.

Pursuant to RA 11232 Revised Corporation Code of the Philippines (RCC), RA 8799 The Securities Regulation Code, RA 11032 Ease of Doing Business, Anti-Money Laundering Act (AMLA) of 2001, Data Privacy Act of 2012.

The personal information collected is necessary to authenticate the identity of the person submitting the documents. This ensures that the documents are being submitted by the correct individual and that the authentication process is secure and valid. The information we collect includes:

 • Full Name: To identify the individual.
Tax Identification Number (TIN) or Passport Number: To authenticate the identity.
 • Mobile number: For communication and verification purposes.
 • Email Address: To communicate information about the document submission and authentication process.
 • Home and Business Addresses: For contact purposes and verification.
 • Mobile Numbers: To facilitate communication during the authentication process.
 • Nationality: To ensure compliance with any nationality-related regulatory requirements.
 • Sex: To gather demographic data as part of the identity verification process.
 • Birth date: To validate the individual’s age and ensure compliance with age-related regulations.

We collect, use and process the personal information provided through electronic or automated means to proceed in this system.

The SEC ensures the protection of personal data against accidental or unlawful destruction, alteration, disclosure, and other unlawful processing by implementing appropriate security measures based on the nature of the data.

Personal information of SEC personnel is retained and disposed of in accordance with civil service laws and the National Archives of the Philippines Act of 2007.

Personal data from contractors and service providers are retained for one year after contract expiration. After this period, hard copies are securely destroyed, and soft copies are deleted.

Similarly, personal data from job applicants are retained for one year from collection. After this period, hard copies are securely disposed of, and soft copies are deleted.

Once a record has passed its retention period and is no longer needed, all hard and soft copies of personal information will be securely disposed of and destroyed. Authorized disposal methods include shredding, burial, or sale to a buyer. This process will be carried out in the presence of a Records Management Analyst from the National Archives of the Philippines (NAP), a SEC COA representative, and members of the SEC RMIC, such as the Chairperson, Vice-Chairperson, and relevant Departmental Directors/Records Focals (or their alternates).

Risk refers to the potential for incidents that may harm a data subject or organization, including unauthorized collection, use, disclosure, or access to personal data. It involves threats to the confidentiality, integrity, and availability of personal data or violations of data privacy principles and rights.

The SEC implements physical, technical, and organizational security measures to protect personal data but acknowledges that risks like cyberattacks, malware, and unauthorized access to manual records may still occur.

Adequate policies are in place to manage security incidents, in alignment with NPC policies, circulars, and other relevant issuances.

Only authorized SEC personnel are granted access to the personal information collected through the authenticating system. The collected personal information via the internet or other electronic methods is stored in a secured database. We use reasonable security safeguards to protect the information gathered from any loss, unauthorized access, use or disclosure.

Under the Data Privacy Act of 2012, data subject refers to an individual whose personal information is collected and processed. We are duly bound to observe and respect your privacy rights, including your right to information, right to access, right to correct, right to remove, right to damages and right to data portability.

Data subjects may file a request with the Data Protection Officer (DPO). They may contact the DPO at 8818-7204, send an email to [email protected] or file a complaint through imessage.sec.gov.ph.