The Philippines has spent years debating data privacy, cybersecurity, cloud computing, and digital government. Yet a basic question has often remained unresolved: does the government actually know what data it holds, how sensitive that data is, and what level of protection each dataset requires?

Executive Order No. 119, titled “Updating the Government Data Classification, Establishing a Data Residency Framework, and for Other Purposes,” starts from that concern. Its importance is not confined to deciding where government data may be stored. More fundamentally, it requires agencies to identify the information they hold, evaluate the harm that could arise from misuse or unauthorized disclosure, and apply protections that are proportionate to the risk. Government cannot protect data that it has not properly identified.

EO 119 separates government information into two broad categories: Restricted Access Data and Open Access Data. Restricted Access Data refers to information that must be protected because unauthorized disclosure could damage national security, government operations, the public interest, or individuals. Open Access Data covers information that does not fall within those protected categories.

The method matters more than the labels. Agencies are required to inventory the data in their custody, conduct risk and impact assessments, assign the proper classification, and review those classifications over time. When circumstances change, data may be downgraded or declassified. The classification, legal basis, and risk assessment must also be entered into a government registry.

This represents a necessary move away from treating classification as merely a stamp on a document and toward treating it as an ongoing governance process. Both underclassification and overclassification create risks. Weak classification can expose the State to security breaches, fraud, privacy violations, and operational disruption. Excessive classification can obstruct transparency, slow inter-agency work, and make legitimate public access more difficult. The aim must be precision.

The Order also appropriately connects data residency with classification. Top Secret and Secret data must generally remain within Philippine territory or in other territories under Philippine sovereignty or jurisdiction. Confidential data is subject to similar treatment, although offshore storage or processing may be allowed under strict approval procedures and safeguards. Less sensitive government information may be kept on secure cloud platforms, provided encryption and risk controls are in place.

That approach is more practical than requiring all government data to stay inside the country. A national-security file should not be handled in the same way as a published statistical report. A risk-based framework allows government to align security requirements with actual sensitivity instead of relying on blanket restrictions. It can also improve technology procurement by giving agencies a clearer basis for deciding whether information belongs on a sovereign platform, a private cloud, a commercial cloud service, or an open public system.

The economic implications are also significant. Poorly classified information creates uncertainty. Agencies hesitate to share data, cloud projects face delays, vendors encounter inconsistent requirements, and open-data initiatives stall because officials are unsure what can be released. A coherent framework can make cloud procurement more predictable, improve data sharing, and give service providers clearer standards.

It can also support the Philippines’ position in ASEAN’s digital economy. A country seeking a larger role in cloud services, data centers, cybersecurity, and digital services needs more than infrastructure. It also needs credible rules governing the information that moves through that infrastructure. In that sense, classification is not separate from digital transformation; it is a precondition for deciding which systems can be opened, which must be restricted, and which safeguards must accompany modernization.

Implementation, however, will be the central challenge. The hardest task will not be producing registries or templates, but building sound judgment within agencies. Officials must be able to distinguish genuine security concerns from bureaucratic caution. They must avoid classifying information merely to avoid scrutiny, while also ensuring that legitimate open access does not weaken necessary protection.

EO 119 establishes a Joint Oversight Committee for Data Classification, co-chaired by the Department of Information and Communications Technology and the National Security Council, and gives agencies three years to achieve full compliance. That transition period should not become a mass relabeling exercise. The quality of agency inventories, risk assessments, and later reviews will matter as much as formal compliance with the deadline.

The objective is not to create more stamps, folders, and reports. It is to improve the way government understands and governs information. Executive Order No. 119 is ultimately about institutional discipline: before government can protect data, move it, share it, or use it for artificial intelligence, it must first know what that data is.

That may be one of the least glamorous parts of digital transformation, but it may also be among the most important.

The views expressed herein are his own and do not necessarily reflect the opinion of his office as well as FINEX.

Joel Luis E. Dabao serves as the President of Kabankalan Community Antenna Television (K-CAT, Inc.), a key cable and internet service provider based in Kabankalan City, Negros Occidental. Under his leadership, the company has been a staple for connectivity in Southern Negros.