> ## Content Index > Fetch the complete content index at: https://blog.melardenio.com/llms.txt > Use this file to discover other available public pages before exploring further. # The Konektadong Pinoy Compliance Calendar Every Philippine ISP Should Be Tracking - URL: https://blog.melardenio.com/the-konektadong-pinoy-compliance-calendar-every-philippine-isp-should-be-tracking/ - Published: 2026-10-23T00:19:20.000Z - Updated: 2026-10-23T00:19:20.000Z - Author: Rommell Ardenio - Tags: PH How-tos I spent a good part of this week reading Republic Act 12234, the Konektadong Pinoy Act, and its implementing rules, line by line. Not the news summaries. The actual text. Most of the coverage talks about the big idea: you no longer need a legislative franchise to run a data network, you register with the NTC instead. That's true, and it's good news for small providers. What the headlines skip is the other half of the deal. Registration comes with a calendar of recurring duties, and several of them have deadlines measured in hours. Here is what I found, in the order a provider will actually run into it. ## Once a year: the filing season Under the IRR, a registered data transmission and internet provider (DTIP) has three yearly obligations: - **30 April:** annual report to the NTC and PCC, in machine-readable form. It includes a network map, costs, historical rates, customers per segment and cybersecurity status. - **30 April:** rates per segment submitted to DICT, NTC and PCC, plus a public rate archive you keep current. - **30 September:** payment of the SRF to the NTC. Your certificate also needs renewing no later than two months before it expires. Validity runs 5, 10 or 15 years depending on the segment, so this one is easy to forget because it comes round so rarely. Missing a required report carries a penalty of P50,000 to P2,000,000 per violation. That is not a rounding error for a small ISP. ## Within 2 years: the cybersecurity certificate Within two years of registration you need either a third-party, ISO-based certification or a DICT certificate of compliance. Along the way the IRR expects a recognized security framework, a risk plan, business continuity and disaster recovery planning, supply chain considerations, and reports of material incidents to DICT's NCERT. Two years sounds generous. But certification is built on evidence: access reviews, backup tests, incident records, policies. Evidence can't be produced in the last month. It has to be collected as you go. ## Every outage: a clock starts running This is the part that surprised me, because it is the opposite of an annual task. Outages are governed by timers: - **Scheduled downtime:** notice **7 days** ahead for last-mile work, **14 days** ahead for upstream. - **Unscheduled outage:** a report within **24 hours**. - **Interim report:** 24 hours after the repair plan is set. - **Final report:** within **7 days** of the repair. Anyone who has worked a master control room or a transmitter site knows what an outage night looks like. People are on the phone, the fix is in progress, and nobody is thinking about paperwork. Then the 24-hour mark passes while you're asleep. The deadline isn't hard to meet. It is hard to *remember* at 3 a.m. with a fiber cut on your hands. ## Every complaint: a register and a quarterly report The customer-service rules are just as specific: - At least two complaint channels, one of them 24/7. - Acknowledge every complaint within **24 hours**. - Resolve within **7 or 15 days**, and never longer than **30**. - Keep a complaint register for **5 years**. - Send the NTC a **quarterly** complaint report. A shared inbox and a spreadsheet will survive about three months of this. ## The pattern behind all of it Look at those four sections together. None of the duties is complicated. What makes them hard is that they come from different places: - **Annual duties** live on a calendar. - **Outage duties** are triggered by something happening in the network. - **Complaint duties** are triggered by something happening with a customer. - **Cybersecurity duties** are built up quietly over two years. Four sources of obligation, four different owners in a typical small ISP, and one regulator who will treat them all as the same thing: *did you file it, on time, with evidence?* If I were running a provider, I would do three things before touching any software: 1. **Put the fixed dates on one shared calendar** (30 April, 30 September, certificate renewal) with a named owner and a reminder at least 30 days ahead. 2. **Write a one-page outage runbook** that starts the 24-hour and 7-day clocks the moment an outage is declared, and says who files each report. 3. **Log every complaint with a timestamp from day one**, because the 24-hour acknowledgement and the 5-year register can't be reconstructed afterwards. That alone puts most providers ahead of where I expect many will be. Tooling, whether a spreadsheet, a ticketing system or something custom, only needs to make those three habits automatic. ## A caveat I'm an engineer reading legislation, not a lawyer. Some details, including the exact IRR effectivity date, were still reported only by secondary sources when I wrote this, and your obligations depend on your services and registration category. Check your own situation against the current text and NTC/DICT issuances before you rely on any of this. **Need software to stay compliant with RA 12234 as a DTIP?** Message me here or email me at [lutchad@gmail.com](mailto:lutchad@gmail.com), and tell me about your network and what you're tracking today.