Req 2.87: The Supplier shall ensure full compliance with the...

⚙️ Technical Demonstration

IMTLazarus satisfies this requirement by ensuring that all data processing, storage, and administrative workflows within the platform are engineered to respect the legal mandates of the Data Privacy Act of 2012 (RA 10173), its Implementing Rules and Regulations (IRR), and the regulatory issuances of the National Privacy Commission (NPC). The platform provides the necessary technical and organizational safeguards to ensure that DepEd retains absolute data sovereignty and control over all institutional information.

The platform aligns with the core pillars of Philippine data privacy and DepEd data governance through the following structural mechanisms:

• Adherence to General Data Privacy Principles: All data collection and processing activities within the platform are governed by the principles of transparency, legitimate purpose, and proportionality. The platform restricts data processing exclusively to the functional telemetry required to manage, monitor, and secure DepEd endpoints, ensuring no unnecessary or non-proportional user data is gathered.
• Technical Security Safeguards: To protect personal data against unauthorized access, alteration, or disclosure, the platform enforces strong data encryption mechanisms. All data transmitted between enrolled devices and the management console utilizes secure, industry-standard cryptographic protocols, while data stored within the multi-tenant environment is logically segregated and isolated.
• DepEd Data-Classification and Handling Alignment: The platform’s multi-tenant architecture and Role-Based Access Control (RBAC) enable DepEd to enforce its internal data-handling standards. Central administrators can restrict data visibility across regional, division, and school tiers, ensuring that personnel only access information appropriate to their specific operational classification and authority.
• Support for Data Subject Rights: The system is built with administrative tools that allow DepEd to fulfill its obligations under RA 10173 regarding data subject rights—including the rights to access, correction, and erasure—by providing features to locate, modify, or permanently purge specific user records upon legitimate request.

---

Data Privacy & Compliance Safeguards Matrix

The platform's operational architecture supports compliance with the NPC governance framework through distinct structural controls:

Privacy Principle (RA 10173)	Platform Security Control Mechanism	Operational Alignment
Data Security & Integrity	End-to-end transport encryption and logical database separation.	Protects system data from unauthorized intercept or cross-tenant exposure.
Access Restriction	Granular Multi-Tenant RBAC provisioning.	Align with DepEd data-classification standards by restricting information access.
Accountability & Auditing	Immutable administrative action logging and configuration histories.	Provides a verifiable audit trail for internal compliance and regulatory review.
Data Lifecycle Control	Configurable retention schedules and secure data erasure tools.	Ensures personal data is managed and disposed of according to prescribed timelines.