By Beatriz Marie D. Cruz, Senior Reporter
INFORMATION TECHNOLOGY–business process management (IT-BPM) firms operating in the Philippines must strengthen data governance and privacy protections as growing cyber risks threaten to erode client confidence in an industry already facing significant disruption, analysts said.
Dominic Vincent D. Ligot, director for AI Ethics & Data Governance at the Philippine AI Business Association, said any reported cybersecurity incidents impact the Philippines’ reputation as a global IT-BPM hub.
“One alleged insider incident must not be generalized across a workforce of nearly two million people. Nevertheless, clients often price risk by location, and prominent breaches can reinforce perceptions that offshore delivery means weaker control,” he said in a Viber message.
Australian authorities recently detected a data breach originating from a former employee at a Manila-based call center. The individual had targeted Sydney-based firm Origin Energy Ltd., exposing the personal and financial information of approximately 900,000 customers.
The breach was similar to a vishing attack on Australian flag carrier Qantas Airlines’ Manila-based call center last year.
The latest incident is seen as a “reputational risk” to the Philippine IT-BPM industry, which faces increasing competition among emerging players like India, Egypt and Vietnam. This shift also comes as ongoing artificial intelligence (AI) adoption automates key processes across the sector, which could slow hiring for entry-level roles.
“The Philippine outsourcing sector is already confronting slower growth, automation and pressure to move from routine processing into higher-value AI, analytics and cybersecurity work,” Mr. Ligot added.
However, he noted the breach incident is not a mere “offshore problem,” but a “failure of end-to-end governance.”
Sought for comment, the IT & Business Process Association of the Philippines (IBPAP) noted its member firms’ continued investment in boosting safeguards, responsible access to information, and compliance with applicable laws and requirements.
“Data protection and cybersecurity are fundamental to the trust that underpins the Philippine IT-BPM industry,” IBPAP said in an e-mail to BusinessWorld.
The group is also working with its members and stakeholders to promote responsible industry practices, strengthen data privacy and increase cybersecurity awareness, it said.
To prevent data breach incidents, Mr. Ligot said IT-BPM firms must implement stronger personnel screening, ethical AI use, and independent security audits.
He also cited the need for measures on role-based and time-limited access, segregation of duties, continued monitoring, data-loss prevention, rapid access revocation, auditable AI usage, and effective whistleblowing channels.
“Contracts must define data ownership, permitted AI tools, subcontracting restrictions, incident-notification deadlines, and measurable assurance obligations,” Mr. Ligot said.
The Philippines must build its edge as a global IT-BPM player with strong cybersecurity measures and not just on its cheap labor costs, said Digital Pinoys National Campaigner Ronald B. Gustilo.
“Incidents involving Philippine-based operations can have a significant reputational impact because international clients entrust BPO companies with highly sensitive customer information,” he said in a Viber message.
Mr. Gustilo noted that Republic Act No. 10173 or the Data Privacy Act of 2012 indicates that firms should ensure reasonable and appropriate organizational, physical and technical safeguards.
For its part, the IT-BPM industry should ensure stronger identity and access management frameworks based on zero-trust and least-privilege principles, he added.
Under the IBPAP’s latest industry roadmap, the IT-BPM sector could reach at least $43.3 billion in revenues and 1.85 million in AI-enabled workers by 2028 from $42.3 billion and 1.96 million workers this year, respectively.
The new projections were lower than their earlier forecast of $59 billion in revenues and a workforce of 2.5 million workers by 2028, amid rapid AI adoption and global competition.
previous post
