LNU Data Privacy Statement
Leyte Normal University (LNU) highly values your right to data privacy. It is firmly committed to ensuring that all personal data collected from students, employees, partners, stakeholders, and the public is handled with utmost care, in accordance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012. LNU likewise adhere to the data privacy principles of (1) legitimate purpose; (2) transparency; and (3) proportionality.
This Data Privacy Statement (DPS) outlines the policies and practices of LNU in collecting, using, storing, and disclosing your personal data. It seeks to inform you of your rights as a data subject and the ways in which the university protects and secures personal information under its control.
Whether you are a student enrolling in the university, an employee rendering service, or an individual engaging with LNU in any capacity, the DPS aims to assure you that the University observes the highest standards of transparency, accountability, and lawful processing in all its
data-handling practices.
LNU collects various types of personal information from students, employees, partners, stakeholders, and other individuals engaging with the University. This includes personal information that can be used to identify an individual, such as full name, maiden name, or other names used; date and place of birth; gender, civil status, and nationality; contact details including home address, email address, and telephone or mobile number; photographs or other identifying images; and government-issued identification numbers such as TIN, GSIS, SSS, and PhilHealth.
It also includes sensitive personal information as defined under RA 10173, such as race or ethnic origin; religious, philosophical, or political affiliations; health and medical information including health records and medical clearances; educational background, academic records, and disciplinary records; criminal or administrative case records, if any; licenses or permits issued by government agencies along with details of their suspension, revocation, or denial; and tax returns or other financial records.
In the course of its operations, LNU may likewise collect other relevant information such as student performance data (grades, academic progress, and achievements); employment details (position, salary grade, benefits, and performance evaluations); scholarship or financial assistance records; research outputs and intellectual property records; attendance records for classes, events, and training; CCTV footage and other security-related recordings; and digital logs from the University’s online systems, portals, and platforms. The collection of such personal information
is limited to what is necessary to fulfill the University’s academic, research, administrative, and statutory mandates.
Personal and sensitive personal information, as mentioned above, are collectively referred to as “personal data”.
LNU collects, uses, and discloses personal data for purposes that are directly related to the performance of its academic, research, administrative, and statutory functions. These purposes include, but are not limited to, the following:
LNU processes personal data to carry out its core functions as a state university. These include curriculum development, delivery of instruction, promotion of research activities, implementation of extension programs and community engagement, and the overall administration of the university’s academic and non-academic operations.
Personal data is used in processing applications for admission, maintaining academic and
disciplinary records, administering student services, managing human resource functions such as hiring, payroll, benefits, performance evaluation, and separation, as well as maintaining communication and engagement with graduates through alumni activities.
LNU collects and processes data to assess eligibility, facilitate applications, and monitor the status of students and employees applying for or receiving grants, scholarships, stipends, and other forms of financial aid. It also uses personal information to evaluate academic performance, eligibility for honors or graduation, and participation in academic and co-curricular activities.
As a government institution, LNU is required to submit personal data to various regulatory
bodies such as the Commission on Higher Education (CHED), Civil Service Commission (CSC), Commission on Audit (COA), Department of Budget and Management (DBM), and other relevant agencies. Compliance with statutory and contractual obligations, including submission of reports, audit requirements, and lawful orders, may also necessitate the
disclosure of personal data.
LNU processes personal data through both manual and automated means. Manual processing includes the use of paper-based forms, physical records, and hard-copy documentation handled only by authorized personnel. Automated processing involves the use of secure information systems, databases, and cloud platforms that are password-protected and encrypted.
LNU processes personal data only when it is lawful, fair, and necessary, in accordance with the Data Privacy Act of 2012 (RA 10173). Such processing may be carried out with your informed and explicit consent for a specific purpose, in fulfillment of contractual or institutional obligations such as those related to enrollment, employment, internships, or training, or in compliance with legal requirements mandated by government agencies including CHED, DBM, CSC, COA, GSIS, and BIR. It may also be undertaken without prior consent when necessary to protect your vital interests, particularly your life, health, or safety in emergency situations, or when performed in the exercise of LNU’s official authority and mandate as a public higher education institution, which includes the delivery of quality education, conduct of research, implementation of extension services, and performance of institutional governance functions.
Leyte Normal University (LNU) upholds the confidentiality of your personal data and ensures that it is only shared with third parties when necessary and lawful. Any disclosure of data is strictly limited to the fulfillment of the university’s legitimate purposes, and all third parties are bound by applicable data privacy safeguards, including data sharing agreements, non-disclosure undertakings, or contractual clauses. LNU may share your data with the following:
Personal data may be disclosed to government agencies and oversight bodies in compliance with legal mandates and institutional reporting requirements. These include, but are not limited to:
- Commission on Higher Education (CHED) – for academic reporting, scholarship
validation, program monitoring, and regulatory compliance. - Civil Service Commission (CSC) – for employment records and personnel-related
transactions of faculty and staff. - Commission on Audit (COA) – for audit and financial accountability purposes.
- Department of Budget and Management (DBM), Bureau of Internal Revenue (BIR),
and other relevant agencies – for payroll, benefits processing, and tax compliance.
Personal data may be shared with external institutions and organizations that have formal partnerships with LNU for academic exchange, research collaboration, benchmarking, or
accreditation. These include:
- Accrediting bodies such as the Accrediting Agency of Chartered Colleges and
Universities in the Philippines (AACCUP) - International and local academic institutions, research consortia, or professional organizations where collaboration involves validation of academic records, faculty credentials, or research outputs.
LNU may engage the services of third-party providers for IT solutions, student platforms, payment processing, learning management systems, facility management, and other support services necessary for university operations. These providers process data on behalf of the University and only under strict confidentiality and data protection provisions in line with the Data Privacy Act.
All such disclosures are made with your rights and privacy in mind, and LNU ensures that these external parties handle your personal data in a manner consistent with this Privacy Statement
and the Data Privacy Act.
At present, LNU does not transfer personal data to entities located outside the Philippines. In the event that such transfer becomes necessary in the future, it shall only be undertaken with the explicit consent of the data subject and in compliance with the Data Privacy Act of 2012, its Implementing Rules and Regulations, and relevant issuances of the National Privacy Commission,
ensuring that adequate safeguards are in place.
LNU retains your personal data only for as long as necessary to fulfill the specific, legitimate, and declared purposes for which it was collected. The duration of retention is guided by the following considerations:
The length of time needed to carry out academic, administrative, legal, financial, research,
and employment-related responsibilities;
Compliance with applicable laws, rules, and regulations, including those set by
government oversight agencies such as CHED, CSC, COA, DBM, and BIR;
Adherence to internal University policies and operational requirements;
Conformity with official retention schedules and guidelines issued by the National Archives of the Philippines (NAP) under the Records Disposition Schedule (RDS) and other relevant issuances.
Once the applicable retention period has expired, and the data is no longer necessary for any legal, regulatory, or operational purpose, personal data shall be securely and permanently disposed of. LNU shall undertake data disposal through safe and appropriate methods—such as secure shredding of paper files and permanent deletion or anonymization of digital records—to prevent unauthorized access, use, or disclosure.
The University ensures that all records disposition activities are done in accordance with the rules and regulations of the National Archives of the Philippines.
LNU stores personal data using a combination of physical and electronic systems designed to ensure integrity, availability, and confidentiality. Data is:
Physically stored in secure locations such as locked filing cabinets, records rooms, or restricted offices, with access limited to authorized personnel only;
Digitally stored in encrypted databases, secure servers, or cloud-based platforms maintained and administered by the university’s Information Technology Support Office (ITS) or accredited service providers.
LNU regularly reviews and upgrades its data storage practices to adapt to evolving cybersecurity threats and to uphold the standards set by the Data Privacy Act of 2012 and relevant issuances from the National Privacy Commission (NPC).
Leyte Normal University (LNU) is committed to maintaining the integrity, availability, and confidentiality of all personal data under its custody. To prevent data breaches, unauthorized access, loss, alteration, or destruction of personal information, the University implements a combination of organizational, physical, and technical security measures, as mandated by the Data Privacy Act of 2012 and the guidelines of the National Privacy Commission (NPC).
Under the Data Privacy Act of 2012, as a data subject, you have the following rights:
To be informed whether Information and/or Personal Data is being or has been processed;
To require LNU to correct any Information and/or Personal Data relating to the Data Subject which is inaccurate;
To object to the processing of the Information and/or Personal Data in case of changes or amendments to the Information and/or Personal Data supplied or declared to the Data Subject;
To access the Information and/or Personal Data;
To suspend, withdraw or order the blocking, removal or destruction of the Data Subject’s Personal Data from LNU’s information database system;
Be indemnified for any damages sustained due to such inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of personal information.
Lodge a complaint with our Data Protection Officer or with the National Privacy Commission (NPC) through www.privacy.gov.ph.
Inquiries and Complaints
For any concerns or if you wish to exercise your rights under the Data Privacy Act, you may contact:
Data Protection Officer (DPO)
Leyte Normal University
Paterno Street, Tacloban City
Leyte, Philippines
dpo@lnu.edu.ph
053-888-0929
