The Philippines’ privacy regulator has finished gathering input on the rules that will decide when a privacy impact assessment is mandatory, and the countdown on ISO 9001:2026 is down to about two weeks. Add two international ballots closing on 8 September, and this is a week for compliance teams to act rather than watch.
Risk-based PIA rules move a step closer in the Philippines
The National Privacy Commission’s draft circular on updated privacy impact assessment guidelines would supersede its 2017 guidance (Advisory No. 2017-03) in its entirety, replacing the expectation that nearly all processing gets a PIA with a defined list of mandatory triggers. Under the official draft, a PIA is required for processing of sensitive personal information, large-scale processing (250 or more employees, or sensitive data of 1,000 or more individuals), automated decision-making or profiling, AI and other novel technologies, behavioural advertising, children’s and vulnerable groups’ data, and cross-border transfers to jurisdictions without sufficient protection. Written comments closed on 14 August, and the Commission scheduled its online public consultation for 25 August — so the final circular is the next step. As drafted, it takes effect 15 days after newspaper publication with only a 90-day compliance window. That is a short runway: BPOs and other personal information controllers should map current processing against the draft triggers now, an exercise that lines up naturally with the privacy risk assessments in ISO/IEC 27701:2025.
ISO 9001:2026 — two weeks and counting
The official ISO project page continues to show the sixth edition of ISO 9001 under publication, and the 16 September 2026 date announced by ISO/TC 176/SC 2 still stands. No accreditation-body transition resolution has been issued yet; a three-year window, consistent with recent revisions, is expected to be confirmed at or around publication. Certificates to ISO 9001:2015 remain valid throughout the transition, so there is no cliff edge — but the organizations that use these two weeks to complete a gap review against the final draft’s known changes and brief top management will start the transition on their own terms.
One week left: ISO 45001 and ISO 9002 ballots close 8 September
Two enquiry-stage ballots opened on 16 June reach their close on 8 September. ISO/DIS 45001 is the revised occupational health and safety standard expected in 2027, with strengthened attention to psychosocial risk. ISO/DIS 9002 upgrades the guidance on applying ISO 9001 from a 2016 technical specification into a full international standard aligned with ISO 9001:2026. Philippine organizations wanting local conditions reflected in either text have days, not weeks, to route comments through the Bureau of Philippine Standards.
ISO 22000 ballot verdict still pending
Voting on the draft of the revised ISO 22000 closed on 30 July, and the result remains under evaluation. The third edition of the food safety management standard will replace ISO 22000:2018 and is expected in 2027 — food processors and exporters should expect FSSC 22000 scheme updates to follow it.
Transition deadlines at a glance
- ISO/IEC 27701:2025 (published 14 October 2025) — certified organizations must transition by 31 October 2028.
- ISO 14001:2026 (published April 2026) — transition ends 30 April 2029; certification bodies stop issuing ISO 14001:2015 certificates to new clients after 31 October 2027.
- ISO 9001:2026 — publication scheduled 16 September 2026; a three-year transition period is anticipated, to be confirmed at publication.
- ISO 45001 — revised edition expected 2027; the draft ballot closes 8 September 2026.
- ISO 22000 — revised edition expected 2027; draft voting closed 30 July 2026, result pending.
We publish this roundup every Monday. For plain-English explainers, side-by-side comparisons and transition checklists written for Philippine organizations, visit our ISO standards revision hub.
