Executive Order 119 as a Vendor Checklist

Audience: Executives, country managers, and IT leads at Japanese companies in the Philippines that handle government projects (system development, cloud, BPO, data processing) — or are considering entering that market

Reading time: 15 minutes

What this case study covers: We read Executive Order No. 119 (EO 119) — the new framework for classifying government data and controlling where it is stored (data residency), effective July 2026 — not as regulatory commentary but as a readiness checklist for the vendor side.

Part 1: Read → Draw the Implications for Your Company

Executive Order 119 has two main parts.

Item	Detail
Signed and effective	Signed 13 July 2026, effective on publication 15 July 2026
Classification	Access-restricted data (Top Secret / Secret / Confidential / Restricted) and open-access data
Residency	Top Secret and Secret must sit in the Philippines or in facilities under Philippine sovereignty. Confidential follows the same rule in principle, with offshore handling only under strict approval and safeguards
Oversight	A Joint Oversight Committee (JOC-DC) co-chaired by DICT and the National Security Council
Timeline	Three years to full compliance: inventory and initial classification in year one, Top Secret and Secret in year two, the remainder in year three
Application to industry	Explicitly extends to private companies handling government data on behalf of agencies

What happened

President Marcos signed Executive Order No. 119 on July 13, 2026, and it took effect upon publication on July 15. It does two big things.

First, it creates a classification system for government data. Government data is divided into Restricted Access Data — graded Top Secret / Secret / Confidential / Restricted according to the damage disclosure would cause — and Open Access Data, which carries no restrictions.

Second, it sets rules on where data may live (data residency). Data classified Top Secret or Secret must stay within Philippine territory, or in facilities under Philippine sovereign control such as embassies. Confidential data gets similar treatment in principle, with offshore storage or processing allowed only under strict approval and safeguards.

To supervise the framework, a Joint Oversight Committee (JOC-DC) was created, co-chaired by the DICT (Department of Information and Communications Technology) and the National Security Council. Covered agencies have three years to reach full compliance, in phases: year one for data inventory and initial classification, year two for full compliance on Top Secret and Secret data, and year three for everything else.

What the issues are

The order is addressed to government agencies. We are covering it as a private-sector case study because it explicitly applies to private entities handling government data on behalf of agencies. Providers of cloud, outsourcing, and data-processing services to the government sit inside this framework.

Which means this: for companies holding government contracts, "where is the data physically stored?" will become a mandatory contract question over the next three years. A setup that currently processes government-project data in an overseas cloud region may need rebuilding, depending on how the data is classified.

Implications for your company

The impact arrives in three tiers.

Companies contracting directly with government agencies — the most direct. You will need to confirm with the contracting agency how your data is classified and where it must live
Companies working as subcontractors on government projects — the same requirements flow down through the prime contractor. Somewhere along the contract chain, someone will ask you to prove your storage locations
Companies with no government work — no direct obligation. But government standards tend to trickle into private-sector commercial practice within a few years, and the underlying discipline — inventory and classify your data — is worth building now

Part 2: Key Terms for Executives

Data residency — Rules about which country data is physically stored and processed in. What matters is not the vendor's contractual address but where the servers actually are.

Data classification — Instead of protecting all data equally, you grade it by the damage a leak would cause and assign protections to match. EO 119 introduces this for government data.

Region — The geographic location of a cloud service's data centers. The same service behaves very differently, for residency purposes, in a Philippine region versus a Singapore or U.S. region.

JOC-DC (Joint Oversight Committee) — The supervising body for this framework, co-chaired by the DICT and the National Security Council. Implementation details will come from here.

Related: How AI Helps Philippine SMEs Prepare Their System Environment Before Adoption explains this in detail.

Part 3: Applying This to Your Company

For a contractor, work through it in five steps.

Step	What to do	Easy to miss
1	Identify every engagement touching government data	Subcontracted work, and data still held from past projects
2	Write down where the data sits for each engagement	Not just production, but backups and copies in test environments
3	Ask the contracting agency for the classification	The agency decides. Asking is itself evidence you understand the framework
4	Estimate the cost of restructuring in advance	A rough figure and timeline is enough
5	Mirror the three-year schedule into your own plan	Start with engagements that may touch Top Secret or Secret

Step 1: List every project that touches government data

Include not just direct contracts but subcontracted work and data retained from past projects. In this kind of inventory, the most dangerous case is the one where "we didn't realize we were holding government data."

Step 2: Write down where each project's data actually lives

Cloud regions, on-premises server locations, backup destinations, and copies in development and staging environments. It is common for production to be domestic while backups or test data sit in an overseas region. What gets examined is every location, not just the primary one.

Step 3: Ask the contracting agency about classification

You cannot classify your own data — that authority belongs to the government side. But asking "under EO 119, how will this project's data be classified?" is itself proof that you are a vendor who understands the framework. The same conversation tells you where your project falls in the three-year timeline.

Step 4: Estimate the configuration changes in advance

Migration to a domestic region, new backup destinations, revised access controls — rough estimates of cost and duration are enough at this stage. I have watched system projects fail after being handed over wholesale: leave the requirements vague, and you get something that "runs but can't be used." The projects that worked were the ones where the client fixed the initial design and decision criteria themselves and left the implementation details to the vendor. Cloud migration follows the same shape: own the criteria for what must stay onshore, and delegate the work.

Step 5: Map the three-year schedule onto your own plan

Year one inventory and classification, year two compliance for the top tiers, year three everything else — the government's phases are also the vendor's preparation phases. In my own daily operations I keep services running by fixing work priorities to time slots and proceeding in stages; the same applies here. Do not attempt everything at once. Start with the projects that could plausibly touch Top Secret or Secret data, and work down.

Part 4: Common Failure Patterns (What Not to Do)

Mistake 1: Closing the tab because "we have no government contracts"

True, there is no direct obligation. But if any client of yours holds government work, storage-location questions will travel down the chain to you. And data classification as a discipline is heading into private commercial practice too. The accurate reading is not "irrelevant" but "not directly — yet."

Mistake 2: Answering "it's stored domestically" from the contract alone

A vendor's contractual place of business and the physical region where data sits are different things. Answering "domestic" without checking where backups, logs, and staging copies live can turn into a false statement later. Verify the technical configuration before you answer.

Mistake 3: Guessing the classification and acting on the guess

Rushing into an expensive domestic migration because "it's probably Confidential" is as risky as relaxing because "it's probably nothing sensitive." Classification is the government's call. The vendor's job is to ask, and to be ready to move once the answer comes.

Mistake 4: Applying the Japan head office's cloud standard as-is

If headquarters standardizes on overseas-region cloud, Philippine government projects will collide with that standard. "It's our global standard" is not an answer the contracting agency will accept. Sort out the exception process on the local side before you need it.

Mistake 5: Treating this as a future problem

EO 119 took effect on July 15, 2026. The three-year runway does not mean nothing is happening: year-one inventory and classification is already underway on the government side. Set it aside and you will have no answer when the first inquiry from a contracting agency arrives.

Practical Tips (3 Tips)

Tip 1: Build a one-page data location map — A single table of project × data × storage location answers inquiries from agencies and questions from the Japan head office with the same sheet of paper. It does not need to be perfect; making the current state visible on one page comes first.

Tip 2: Research domestic-region options before you need them — Know the Philippine regions of the major clouds, the local providers, and rough costs in advance. If you start researching only when a migration is demanded, there is no time left to compare options.

Tip 3: Keep records of what you confirmed and when — Document the date and content of every classification inquiry to the contracting agency. While the framework's operational details are still settling, a record of "what we confirmed, as of when" is what protects you.

Bonus: How to Make Use of PH AI Works

We can help you work out whether your projects sit in the EO 119 chain, verify where your cloud configuration actually stores data, and build rough estimates for a domestic-region migration — based on your real architecture. Starting with the first page of your data location map is fine.