Book a 30-minute call
Independent Executive Advisory • Metro Manila, Philippines

Data Privacy & AI Governance.
Fixed scope. No dual roles.

Independent Fractional DPO and Fractional CAIO services for enterprise and mid-market organizations. Your designated officer remains on your payroll. I manage the operational workload.

Work with me, and let's secure your business together!

Charlemagne R. Dumaya • Juris Doctor, University of the Philippines • WIPO AIII Technical Exchange Network, first cohort • LinkedIn

Select your primary objective

Choose a service area to tailor this page to your specific requirements:

Data Privacy
I need a Fractional DPO
NPC registrations and filings, privacy impact assessments, breach readiness, and vendor contract checks. Fix the structure behind segregation-of-duties findings.
View DPO scope & retainers
AI Safety
I need a Fractional CAIO
Coordinate AI system audits with your DPO, confirm lawful bases, and put required disclosures in place. Philippine rules apply today. If your AI reaches the EU, so do its transparency rules.
View CAIO scope & retainers
Prefer to review all options? Browse all services below ↓
Need a single project instead of a monthly retainer? View one-off services and fixed pricing ↓
ISO 27001 A.5.3 Structural segregation of duties
RA 10173 NPC registrations, filings & breach response
December 2, 2026 EU AI Act marking deadline for generative AI already on the market
Fixed Retainers Published rates from ₱55,000/mo
Practice areas

Executive Oversight with Clear Boundaries

Appointing a CTO, General Counsel, or Operations Head as DPO creates a structural conflict of interest: the person who designs data processing systems cannot independently audit them. Auditors can flag this arrangement. I provide a compliant structural alternative on one condition: your designated officer cannot be someone who decides why or how your organization processes personal data. My findings also go to your board or audit committee.

Governance Mandate: Strict Separation of DPO and CAIO Roles

NPC guidance states that Data Protection Officers should work independently and receive a significant degree of autonomy. An executive making AI deployment decisions cannot independently audit those deployments. To prevent conflicts of interest, VitrifAI accepts either the DPO mandate or the CAIO mandate for an entity, never both simultaneously. Organizations requiring both services must engage two separate providers. NPC Advisory 2017-01 • ISO/IEC 27001:2022 A.5.3

NPC Registration & Filings

I manage mandatory regulatory filings and keep them on schedule.

  • Register processing systems and your designated officer Circular 2022-04
  • Notify the NPC of automated decision-making and profiling systems
  • Submit Annual Security Incident Reports by March 31
  • Conduct privacy impact assessments and maintain processing logs
Triggers: 250+ staff • sensitive data on 1,000+ people • rights risk

ISO 27001 / 27701 Audit Support

I address segregation-of-duties audit findings through compliant organizational structures.

  • Separate conflicting operational and oversight duties ISO 27001 A.5.3
  • Establish clear reporting structures for external auditors
  • Implement standard data subject request workflows
  • Check data sharing and outsourcing agreements against NPC requirements
Changing a job title without structural separation can fail audits

Breach Response

The regulatory notification clock begins upon discovery, not business hours.

  • Notify the NPC and affected individuals within 72 hours Circular 16-03
  • Submit the full breach report within five days of discovery Advisory 2026-02
  • Report without delay when 100 or more people are affected, or when disclosure of their data would harm them
  • Manage procedural filings for postponement or exemption correctly
Filing an exemption request does not pause the five-day report

AI Inventory & Governance

Pasting customer records into public AI tools constitutes regulated processing.

  • Inventory all active AI tools across operational teams
  • Establish a valid lawful basis for each tool or restrict use Advisory 2024-04
  • Draft practical internal policies for AI tool usage
  • Check vendor terms and data retention schedules
Advisory 2024-04 covers full AI lifecycle and offshore processors

Retrieval & Training Data

I evaluate data sourcing and access controls for retrieval systems.

  • Enforce access boundaries on vector stores and RAG systems
  • Check web-scraped training datasets before deployment Advisory 2026-01
  • Integrate privacy controls into software architecture Advisory 2025-02
  • Use NPC model clauses for cross-border data transfers Advisory 2024-01
Publicly accessible data still requires a valid lawful basis

EU AI Act & Compliance

EU rules apply when your AI systems or their output reach the EU. I help you meet them on schedule.

  • Meet Article 50 transparency duties, which have applied since August 2, 2026
  • If you provide generative AI, mark its output in machine-readable form. Systems on the market before August 2, 2026, have until December 2, 2026.
  • Prepare high-risk AI documentation for 2027 and 2028 deadlines
  • Align AI systems with the NIST AI Risk Management Framework
Regulation (EU) 2024/1689 • Digital Omnibus, Regulation (EU) 2026/1744
Operating method

Solving Compliance Contradictions

Compliance and operational speed are often treated as opposing priorities. I apply structured engineering practices to meet regulatory requirements without delaying product delivery.

Contradiction 01

Operational Insight vs. Independence

Challenge: A DPO must understand system architecture, but directly managing systems creates an audit conflict.

Resolution: Your internal officer retains statutory accountability and primary regulatory contact. I carry out DPO functions under a formal delegation agreement that separates operational build duties from audit functions.
Contradiction 02

Model Context vs. Privacy Limits

Challenge: AI models require detailed contextual data, but transmitting unredacted personal records triggers strict processing requirements.

Resolution: Define permissible data boundaries before system deployment. I establish explicit lawful bases per use case, enforce data minimization at API gateways, and document technical retention policies.
Contradiction 03

Compliance Rigor vs. Deployment Speed

Challenge: Overly complex policies are ignored by operational teams, passing legal reviews but failing in daily operations.

Resolution: I write operational controls specifically for technical and frontline staff. Every policy uses plain language, assigns clear dates, and defines exact response steps.
Transparent pricing

Fixed-Scope Retainer Calculator

I offer fixed monthly pricing based on your operational complexity rather than billable hours. Hourly billing creates incentives for delayed delivery.

Need a single engagement instead? See one-off options ↓

Add-ons correspond to your selected practice area. DPO and CAIO services remain strictly separated. Retainer clients pay ₱10,000 less than the one-off price for the same project.

Monthly Retainer
₱55,000 / month, excluding taxes

Includes delegated DPO functions, monthly leadership reporting, incident response support, and help during NPC compliance checks. 12-month initial term. Prepayment discounts: 5% quarterly, 10% annual.

Base retainer: ₱55,000
Scale adjustment: ₱0
Monthly retainer: ₱55,000
First three months: ₱165,000
Project add-ons: ₱0
Total for first three months: ₱165,000
Then, each month: ₱55,000
Total for the 12-month term: ₱660,000
Book a 30-minute call

Booking opens Calendly. See how I handle your details.

Start here

Not sure what you are exposed to?

Many organizations discover what they owe the Commission after the deadline has passed. A system diagnostic answers that question in writing, against a date agreed before work starts.

  • Which filings you owe, and which are already overdue
  • Whether your breach procedure survives the 72-hour clock
  • Where personal data actually sits, including tools nobody approved
  • A written finding that ranks the fixes and puts dates on them

Some engagements end here. That is why it is priced as its own piece of work.

On its own ₱75,000 One-off, excluding taxes. No retainer and no term. Buy it on its own ↓
With a retainer No extra cost Start a retainer within 60 days and the full ₱75,000 comes off your first three months.

Charlemagne R. Dumaya

Founder & Principal Consultant

Direct Email Contact LinkedIn Profile
Juris Doctor, University of the Philippines (Class 2024)
First Filipino in World Intellectual Property Organization AI Infrastructure Interchange Technical Exchange Network (First Cohort)
15 years of experience, including 13 in global BPO
AI model training and evaluation, including xAI (Grok)
Leadership Background

Direct Leadership on Every Engagement

Compliance advice often arrives either as theoretical legal memos that technical teams cannot implement or as administrative tasks delegated to engineers without regulatory context. I bridge this operational gap.

I hold a Juris Doctor from the University of the Philippines with coursework in artificial intelligence and society, and I am the first Filipino named to the first cohort of the WIPO AI Infrastructure Interchange Technical Exchange Network (AIII TEN). My 15 years of professional experience includes 13 years in large-scale operations at one of the world's largest BPOs, where I built knowledge systems and led product and communications training. It also includes two years of deep immersion in AI systems across both regulatory and creative domains, including model training and evaluation work for xAI (Grok).

Operational experience: Thirteen years within large-scale BPO operations provided firsthand experience watching corporate policies meet frontline execution. Having built knowledge systems and trained frontline teams, I design compliance controls that staff can follow reliably. A privacy control that frontline teams cannot execute fails in production.

Technical capabilities & AI immersion: Two years of focused immersion in AI systems bridges the gap between regulatory mandates and practical deployment. Experienced in model training and evaluation (including work for xAI on Grok), prompt architecture, and creative AI applications, I regularly train teams on proper AI usage and risk mitigation across corporate and technical environments.

Practice structure: I trade as VitrifAI and am registered with the Bureau of Internal Revenue. VitrifAI is not a law firm and does not provide formal legal opinions or courtroom representation. When matters require formal legal representation, I coordinate directly with your legal counsel.

Book a 30-minute call
Clarity & terms

Frequently Asked Questions

Clear answers regarding my executive advisory services and regulatory requirements.

NPC Advisory 2017-01 says your DPO should be a full-time or organic employee of your organization. The same advisory allows you to outsource DPO functions under two conditions: your internal DPO oversees the provider's performance to the extent possible, and your internal DPO remains the official contact point for the Commission. Your internal employee retains the official title, while I carry out operational DPO tasks under a formal delegation agreement. That employee should not be someone who decides why or how your organization processes personal data. NPC Advisory 2017-01 • NPC Circular 2022-04
Combining both roles creates a conflict of interest. A DPO must evaluate compliance independently without operational instruction. An executive who makes AI deployment decisions cannot independently audit those deployments. That is why, as CAIO, I coordinate audits of models and algorithms with your DPO. To protect your organization during regulatory audits, I take only one of these seats per entity. NPC Advisory 2017-01 • NPC Advisory Opinion 2020-025
Your engineering leadership builds and deploys software products. The CAIO establishes permissible data parameters, confirms lawful processing bases, and implements required transparency disclosures. Audits of models and algorithms run through your DPO, and the CAIO coordinates them. NPC Advisory 2024-04 applies data privacy obligations across the complete AI lifecycle, including offshore entities processing data of Philippine residents. NPC Advisory 2024-04 (December 19, 2024)
My retainer agreements cover incident management directly. I prepare initial notifications for the NPC and affected individuals within 72 hours of discovery, followed by the full breach report within five days of discovery. Filing a postponement or exemption request does not pause that five-day report. When 100 or more people are affected, or when disclosure of their data would harm them, you must report without delay. NPC Circular 16-03 • NPC Advisory 2026-02
The Data Privacy Act sets criminal penalties, including imprisonment and fines, for offenses such as unauthorized processing and concealing a breach that involves sensitive personal information. When the offender is a company, the penalty falls on the responsible officers who took part in the offense or allowed it through gross negligence. Separately, the NPC can impose administrative fines of 0.5% to 3% of annual gross income for grave infractions, 0.25% to 2% for major infractions, and ₱50,000 to ₱200,000 for other infractions. These fines scale with gross income until they reach a cap of ₱5,000,000. The cap applies per act or omission, however many infractions that act produces, so an incident that involves several acts can draw several capped fines. RA 10173, Chapter VIII • NPC Circular 2022-01