Protecting IP and Confidential Data When Using an Employer of Record (EOR)

Author: Philip Murphy, COO & Founding Partner
Reviewed by: Martin English, CEO & Founding Partner
Date Uploaded: Aug 14, 2025
Updated: May 28, 2026
Disclosure: Informational only. Not legal, cybersecurity, or data privacy advice.

TL;DR

Companies protect intellectual property and confidential data when using an Employer of Record through four layers:

Protection Layer	What It Covers
Employment and legal protections	DOLE-aligned contracts, confidentiality clauses, IP assignment, acceptable-use terms, return-of-property clauses
Payroll and employment proof	Payroll records, payslips, statutory handling, 13th-month pay records, and employment documentation
Technical safeguards	MFA, password manager, role-based access, device rules, encryption, logging, and offboarding access removal
Data privacy governance	Privacy notices, access rules, breach response, cross-border data safeguards, and data processing accountability

An EOR helps with the local employment layer, but the client company must still control system access, security policies, permissions, passwords, customer data, source code, documents, and operational tools.

A compliant Philippines EOR should provide:

Compliance Proof	Why It Matters
DOLE-aligned employment contract	Shows a proper local employment structure
Confidentiality and IP clauses	Protects company data, work product, code, documents, SOPs, designs, and client information
Payroll records	Shows salary, deductions, allowances, and pay cycle
Payslips	Gives employee-facing payroll transparency
SSS contribution evidence	Shows social security contribution handling
PhilHealth contribution evidence	Shows health insurance contribution handling
Pag-IBIG contribution evidence	Shows housing fund contribution handling
13th-month pay records	Shows mandatory annual pay is tracked and paid
Remittance receipts or summaries	Supports audit, finance review, and due diligence
Final pay / offboarding records	Supports clean exits and access removal

For the full employment proof standard, see Philippines EOR Compliance.

Quick Answer

To protect IP and confidential data when using an EOR, companies should combine:

1. local employment contracts with confidentiality and IP assignment clauses
2. documented payroll and employment compliance proof
3. strict access controls and least-privilege permissions
4. secure device, password, and MFA policies
5. clear onboarding and offboarding checklists
6. privacy and incident-response procedures
7. regular access reviews and evidence packs

The EOR should support compliant employment documentation. The client company should control operational security.

The safest model is:

Local employment proof + IP assignment + confidentiality clauses + controlled access + fast offboarding.

Who This Guide Is For

This guide is for:

• founders hiring remote employees through an EOR
• CFOs reviewing offshore employment risk
• HR and People teams managing EOR hires
• legal teams checking IP ownership and confidentiality
• CTOs and security teams protecting source code and systems
• operations teams hiring VAs, SDRs, support agents, developers, data analysts, and finance staff
• companies using a Philippines EOR to hire employees without setting up a local entity
• buyers comparing EOR providers by compliance and security controls

This guide is not a replacement for legal or cybersecurity advice. It is a practical buyer checklist for protecting IP and confidential data in an EOR model.

What IP and Confidential Data Are at Risk?

EOR employees may access sensitive information depending on their role.

Asset Type	Examples
Intellectual property	Source code, designs, product ideas, documentation, workflows, SOPs, training materials, playbooks
Confidential business information	Financial models, pricing, strategy, product roadmap, vendor terms, sales pipeline
Customer data	Names, emails, addresses, tickets, payment metadata, account notes, support history
Employee data	Contracts, payroll information, IDs, benefits records, performance notes
Sales and marketing data	Lead lists, CRM records, outreach sequences, buyer personas, campaign data
Technical systems	Code repositories, cloud platforms, analytics dashboards, admin panels
Operational data	Process maps, internal reports, dashboards, QA records, workflow documentation
Client information	Customer contracts, sensitive client files, project briefs, account details

The more access the role needs, the stronger the legal, technical, and offboarding controls should be.

What Role Does an EOR Play in IP and Data Protection?

An EOR handles local employment documentation and payroll compliance. It can help protect IP and confidential data by embedding the right terms and processes into the employment relationship.

Area	EOR Role	Client Company Role
Employment contract	Issues local employment contract	Confirms role, scope, and required clauses
Confidentiality clauses	Includes local confidentiality obligations	Defines what is confidential
IP assignment clauses	Includes work-product ownership terms	Confirms what output and systems are covered
Payroll documentation	Provides payroll records and payslips	Reviews payroll and compliance proof
Statutory compliance	Handles SSS, PhilHealth, Pag-IBIG, and 13th-month pay	Reviews evidence
HR support	Supports policy communication and offboarding	Manages daily conduct and performance
Data access	Usually not responsible for client systems	Owns tool access, permissions, MFA, passwords, logs
Security enforcement	Supports employment consequences	Owns security architecture and monitoring

The EOR is not a substitute for the client’s IT, security, legal, and operational controls.

The Four-Layer Protection Model

Layer 1: Employment and Legal Protections

Legal protections create the foundation for confidentiality and ownership.

Control	What It Should Cover
Local employment contract	Legal employer, role, salary, benefits, work arrangement, policies
Confidentiality clause	Company information, customer data, pricing, strategy, processes, client information
IP assignment clause	Work product, code, designs, documents, SOPs, reports, workflows, inventions
Acceptable-use policy	Proper use of systems, devices, data, communication tools, and company files
Return-of-property clause	Devices, files, credentials, documents, materials, and company assets
Non-solicitation where appropriate	Clients, employees, vendors, and business relationships
Policy acknowledgement	Employee confirms they understand confidentiality, data handling, and security rules

NDAs alone are not enough. They should be paired with IP assignment, access controls, and offboarding procedures.

Layer 2: Payroll and Employment Compliance Proof

Employment proof matters because IP and confidentiality protections are stronger when the worker’s legal employment structure is clear.

A Philippines EOR should provide:

Proof Item	Why It Matters
DOLE-aligned employment contract	Shows a local employment relationship
Signed employee record	Confirms role, salary, start date, benefits, and employment terms
Payroll register	Shows salary, deductions, allowances, employer costs, and net pay
Payslips	Shows employee-facing payroll transparency
SSS evidence or summary	Shows social security contribution handling
PhilHealth evidence or summary	Shows health insurance contribution handling
Pag-IBIG evidence or summary	Shows housing fund contribution handling
13th-month pay record	Shows mandatory annual pay is tracked and paid
BIR withholding process	Shows tax withholding documentation where applicable
Offboarding and final pay record	Supports clean exit and termination of access

If a provider cannot show employment and payroll proof, the buyer should not rely on vague claims that the worker is “covered.”

Layer 3: Technical Safeguards

Technical controls limit what an EOR employee can access and what happens if an account or device is compromised.

Control	Why It Matters
Least-privilege access	Employees only access tools, files, and data required for the role
MFA	Protects email, CRM, code, finance, helpdesk, and cloud systems
Password manager	Prevents passwords being shared in chat or spreadsheets
Role-based permissions	Separates admin, editor, viewer, billing, and export permissions
Device policy	Sets standards for laptop, antivirus, OS updates, disk encryption, and screen lock
Data export controls	Limits bulk download, customer exports, and file sharing
Logging and audit trails	Tracks access, changes, downloads, and admin activity
Secure file sharing	Keeps documents in approved cloud systems
Email and calendar delegation	Avoids direct password sharing
Offboarding access removal	Removes accounts, sessions, devices, and shared files immediately

Technical safeguards should be built before access is granted, not after a problem occurs.

Layer 4: Data Privacy and Incident Governance

Companies using an EOR must also consider privacy obligations, especially when employees handle personal data.

The Philippine Data Privacy Act is administered by the National Privacy Commission, and the NPC provides guidance on breach reporting. The NPC’s breach reporting page states that a full personal data breach report must be submitted within five days unless additional time is granted. (privacy.gov.ph)

Governance Area	What to Define
Personal data inventory	What employee, customer, candidate, vendor, and user data is processed
Data owner	Who controls the data and decides processing purposes
Data processor roles	Whether the EOR, client, or another vendor processes data
Privacy notices	How employees and relevant data subjects are informed
Cross-border transfer safeguards	How data moves between jurisdictions
Incident response	Who investigates, escalates, documents, and reports incidents
Breach notification process	When the NPC, clients, employees, or customers must be notified
Retention and deletion	How long data is kept and when it is deleted
Access review cadence	How often permissions are checked

Privacy governance should be clear before employees access customer, employee, financial, or health-related data.

IP Ownership: What to Put in the Contract

The employment contract should clearly address ownership of work product.

Contract Area	What to Include
Work product ownership	Output created during employment belongs to the appropriate company or client
Covered materials	Code, documents, reports, dashboards, content, designs, SOPs, workflows, inventions
Present and future rights	Covers work created during employment and related future rights where enforceable
Assignment obligation	Employee agrees to sign further documents if needed
Moral rights treatment	Address waiver or consent where legally appropriate and enforceable
Third-party materials	Employee must not include unauthorized third-party IP
Open-source use	Rules for code libraries, licenses, and approvals
Confidential information	Broad definition of protected company, customer, and client information
Return and deletion	Employee must return or delete company materials on exit

The contract should be reviewed locally and aligned with the employment structure.

Confidentiality: What to Cover

Confidentiality clauses should be specific enough to protect real business assets.

Confidential Information Type	Examples
Customer information	Names, contacts, account data, tickets, contracts, support history
Company information	Strategy, pricing, product roadmap, financial data, board materials
Technical information	Source code, architecture, credentials, API keys, system diagrams
Operations information	SOPs, training materials, workflows, QA rubrics, reporting processes
Sales and marketing information	Lead lists, CRM records, campaign data, outreach scripts, buyer personas
HR and payroll information	Employee records, salaries, benefits, performance information
Client information	Client files, project materials, deliverables, confidential communications

Confidentiality should survive the end of employment.

Role-Based Risk Matrix

Different roles need different controls.

Role	Common Access	Risk Level	Required Controls
Virtual Assistant	Inbox, calendar, files, CRM	Medium	MFA, delegated access, least privilege, confidentiality, offboarding checklist
Executive Assistant	Executive inbox, travel, files, sensitive communications	High	Strong confidentiality, restricted file access, access log, device policy
Customer Support Agent	Helpdesk, customer records, order data	Medium to high	Role-based permissions, PII handling SOP, ticket logging
SDR	CRM, email, LinkedIn, prospect lists	Medium	CRM permissions, export controls, confidentiality, outreach data rules
Bookkeeper	Finance files, invoices, accounting tools	High	Finance approval controls, MFA, file restrictions, audit logs
Data Analyst	Databases, dashboards, customer data	High	Data minimization, export controls, logging, approved datasets
Developer	Code repositories, staging systems, credentials	High	Repo permissions, secrets management, branch controls, device policy
Salesforce Admin	CRM admin access, customer records, automations	High	Permission governance, sandbox-first changes, access review
Operations/Admin Staff	SOPs, task tools, internal files	Medium	File permissions, process documentation, confidentiality

Access should match the role, not the job title alone.

Onboarding Checklist for IP and Data Protection

Before the employee starts, complete this checklist.

Onboarding Control	Confirmed?
Employment contract signed
Confidentiality clause included
IP assignment clause included
Acceptable-use policy acknowledged
Data handling policy acknowledged
Role access list approved
MFA enabled
Password manager set up
Device policy confirmed
Email/calendar access delegated properly
CRM/helpdesk/code/file permissions reviewed
PII handling rules explained
Incident reporting channel shared
Manager and escalation path assigned
Offboarding checklist prepared in advance

Do not give broad access before legal, payroll, and security setup are complete.

Access-Control Checklist

Use this checklist for each employee.

System Type	Access Rule
Email	Delegated access where possible, no shared passwords
Calendar	Delegated permissions only as needed
CRM	Role-based access, limited export, no unnecessary admin rights
Helpdesk	Queue-based permissions, limited customer data access
Finance tools	Approval workflows, limited bank/payment permissions
Code repositories	Repo-specific access, branch rules, no shared credentials
Cloud storage	Folder-level access, no public links unless approved
Analytics tools	Limited datasets, no unnecessary raw-data export
Password manager	Shared vaults by role, access removed on exit
Communication tools	Channels limited by function and confidentiality

Quarterly access reviews are useful for small teams. Monthly reviews may be better for high-risk roles.

Offboarding Checklist for IP and Confidential Data

Offboarding is one of the highest-risk moments in an EOR relationship.

Offboarding Control	Why It Matters
Resignation or termination record	Confirms exit basis and date
Final pay process	Closes employment cleanly
Prorated 13th-month pay	Supports compliance where applicable
Return-of-property confirmation	Recovers laptop, headset, files, documents, and materials
Account deactivation	Removes email, CRM, file, code, helpdesk, finance, and task access
Session revocation	Logs out active sessions
Password rotation	Protects shared systems and service accounts
Device wipe or return	Reduces data leakage risk
File ownership transfer	Keeps documents with the company
Confidentiality reminder	Confirms continuing obligations
Final payslip / record	Supports payroll closure
Access removal evidence	Shows systems were secured

Access removal should happen immediately at exit, not days later.

What to Request From an EOR Provider

Before choosing an EOR, ask for examples of the documents and controls that protect employment structure, IP, and confidential data.

Request	Why It Matters
Sample employment contract	Shows local employment structure
Confidentiality clause sample	Shows protected information is covered
IP assignment clause sample	Shows work-product ownership approach
Employee policy acknowledgement process	Shows policies are communicated
Data protection policy summary	Shows employee and client data handling approach
Payroll register format	Shows payroll proof and buyer control
Payslip sample	Shows employee-facing payroll transparency
SSS / PhilHealth / Pag-IBIG evidence format	Shows statutory proof process
13th-month pay tracking method	Shows mandatory annual pay handling
Offboarding workflow	Shows exit, final pay, and access coordination
Incident escalation process	Shows security/privacy issue handling
Security certification or policy summary	Shows maturity of information security controls

A strong EOR should be comfortable showing sample documentation before you scale.

Security Certifications and Standards to Look For

Certifications are not mandatory for every provider, but they can be useful signals.

Standard / Framework	What It Signals
ISO 27001	Information security management system maturity
SOC 2	Controls around security, availability, confidentiality, processing integrity, and privacy
Data privacy policy	Documented personal data handling
Incident response policy	Process for security incidents and breach escalation
Access-control policy	How permissions are granted, reviewed, and removed
Vendor management policy	How third-party tools and processors are reviewed
Business continuity policy	How service continuity is handled during disruption

Certifications do not replace contract review, access controls, or payroll proof. They are additional evidence.

Payroll and Employment Compliance Still Matter

IP and data protection are stronger when employment is structured correctly.

A Philippines EOR should provide:

Compliance Proof	Why It Matters
DOLE-aligned employment contract	Shows local employment structure
Signed employee records	Confirms role, salary, start date, and employment terms
Payroll register	Shows salary, deductions, allowances, employer costs, and net pay
Payslips	Shows employee-facing payroll transparency
SSS evidence or summary	Shows social security contribution handling
PhilHealth evidence or summary	Shows health insurance contribution handling
Pag-IBIG evidence or summary	Shows housing fund contribution handling
13th-month pay record	Shows mandatory annual pay is tracked and paid
BIR withholding and year-end process	Shows tax withholding documentation where applicable
Leave and holiday records	Shows local HR administration
Offboarding and final pay records	Shows proper employee exit handling

For the full checklist, see Philippines EOR Compliance.

Payroll Compliance in the Philippines

Payroll compliance should show what was earned, deducted, contributed, paid, and documented.

Payroll Item	What Should Be Documented
Gross salary	Agreed salary for the pay period
Allowances	Internet, equipment, night shift, transport, or role-specific allowances
Deductions	Statutory and approved deductions
Employee contributions	Employee-side statutory deductions
Employer contributions	Employer-side statutory obligations
Tax withholding	Compensation withholding where applicable
Net pay	Final amount paid to employee
Payslip	Employee-facing payroll record
Payroll register	Employer-facing payroll record
13th-month accrual	Monthly accrual and annual payment treatment
Remittance evidence	SSS, PhilHealth, Pag-IBIG, and tax records or summaries
Approval trail	Review and sign-off before payroll release

A buyer should be able to inspect payroll before release and inspect statutory evidence after remittance.

Statutory Benefits for Employees in the Philippines

Philippines-based employees generally require statutory contribution and payroll administration.

Statutory / Payroll Item	Why It Matters
SSS	Social security contribution administration
PhilHealth	Health insurance contribution administration
Pag-IBIG	Housing fund contribution administration
13th-month pay	Mandatory annual pay for covered employees
Payslips	Payroll transparency and documentation
Payroll records	Finance, audit, and employee support
Leave records	Workforce planning and HR documentation
Final pay records	Clean offboarding

Optional benefits may include HMO, allowances, bonuses, equipment, training support, and enhanced leave depending on the role and package.

The key question is not only whether statutory benefits are “included.” The provider should be able to show how they are calculated, paid, and documented.

IP and Data Protection Proof Pack

Use this as a buyer checklist.

Proof Item	Required?	Received?
Employment contract sample	Yes
Confidentiality clause sample	Yes
IP assignment clause sample	Yes
Acceptable-use policy	Yes
Data handling policy	Yes
Payroll register format	Yes
Payslip sample	Yes
SSS / PhilHealth / Pag-IBIG evidence format	Yes
13th-month pay tracking method	Yes
Offboarding workflow	Yes
Return-of-property procedure	Yes
Access removal checklist	Yes
Incident escalation process	Yes
Data privacy policy summary	Recommended
Security certification or controls summary	Recommended
Device policy	Recommended
Quarterly access review process	Recommended

This proof pack should be requested before headcount grows or sensitive system access expands.

Red Flags in EOR IP and Data Protection

Red Flag	Why It Matters
No IP assignment language	Ownership of work product may be unclear
NDA only, no access controls	Legal protection is not enough
No confidentiality clause sample	Sensitive information may be weakly defined
No local employment contract sample	Employment structure is unclear
No payroll proof	Worker status and employment records are harder to verify
No payslip sample	Payroll transparency is weak
No statutory evidence process	Employment compliance proof is weak
No offboarding workflow	Access and final pay may be mishandled
No return-of-property procedure	Devices and files may remain outside company control
No breach escalation process	Incidents may be handled too slowly
No role-based access policy	Employees may receive excessive permissions
No named security or HR contact	Escalation becomes unclear

The strongest providers make both employment compliance and data protection easy to inspect.

Common Mistakes Companies Make

Mistake	Result
Assuming the EOR controls all data risk	Client-side systems remain exposed
Using NDAs without IP assignment	Confidentiality exists, but ownership may be unclear
Giving full admin access too early	Excessive system risk
Sharing passwords in chat	Credential exposure
No access log	Hard to know who can access what
No device policy	Endpoint risk
No offboarding checklist	Accounts and files remain active
No final pay process	Exit disputes increase
No proof pack	Compliance is hard to verify
No incident-response process	Breach response becomes improvised

IP protection is not a one-time contract clause. It is an operating system.

Why Smart Outsourcing Solution Fits This Use Case

Smart Outsourcing Solution is a strong fit for companies that want to hire Philippines-based employees through an EOR model while maintaining employment, payroll, IP, confidentiality, and data protection controls.

SOS can support:

• EOR hiring in the Philippines
• DOLE-aligned employment documentation
• confidentiality and IP protection clauses
• payroll administration
• payroll records and payslips
• SSS, PhilHealth, and Pag-IBIG handling
• 13th-month pay handling
• remittance evidence or summaries
• onboarding and offboarding workflows
• final pay records
• access-removal coordination
• local HR and employment support
• compliance visibility for global teams

SOS is strongest when a company wants direct team control, local employment support, payroll visibility, and a Philippines-focused EOR partner.

When SOS May Not Be the Right Fit

SOS may not be the right fit if:

• you need one EOR platform across many countries immediately
• you want to outsource the entire business function instead of managing employees directly
• you only need short-term freelancers
• you are ready to open and operate your own Philippine entity
• you need the EOR provider to replace your internal IT, security, or legal team
• you do not want to manage tool access, permissions, KPIs, or performance

EOR supports local employment. It does not replace the buyer’s responsibility to manage systems, data, and security.

FAQs

How do companies protect IP when using an EOR?

Companies protect IP when using an EOR through local employment contracts, confidentiality clauses, IP assignment clauses, access controls, MFA, password managers, device rules, offboarding checklists, and documented payroll and employment compliance proof.

Is an NDA enough to protect IP when using an EOR?

No. An NDA helps protect confidentiality, but it should be combined with IP assignment, local employment documentation, role-based access, secure systems, return-of-property terms, and offboarding access removal.

Who owns work created by an EOR employee?

Ownership should be defined in the employment contract and IP assignment language. The contract should clearly state how work product, code, documents, designs, workflows, SOPs, and inventions created during employment are assigned or owned.

What role does an EOR play in data protection?

An EOR supports the employment layer by issuing contracts, maintaining employment records, supporting confidentiality and IP clauses, and helping with offboarding. The client company usually remains responsible for system access, permissions, customer data, passwords, security tools, and operational controls.

What compliance proof should a Philippines EOR provide?

A Philippines EOR should provide DOLE-aligned employment contracts, payroll registers, payslips, SSS contribution evidence, PhilHealth contribution evidence, Pag-IBIG contribution evidence, 13th-month pay records, remittance receipts or summaries, and final pay or offboarding records.

How does payroll compliance work in the Philippines?

Payroll compliance should show gross salary, allowances, deductions, employee and employer contributions, tax withholding where applicable, net pay, payslips, payroll registers, statutory evidence, 13th-month accrual and payment, and payroll approval trails.

What statutory benefits do Philippines employees need?

Philippine employees generally require statutory contribution administration for SSS, PhilHealth, and Pag-IBIG, plus 13th-month pay and proper payroll records. Employers may also provide HMO, allowances, bonuses, equipment, training, and enhanced leave depending on the employment package.

What data privacy law applies in the Philippines?

The Philippines has the Data Privacy Act, administered by the National Privacy Commission. Companies handling employee, customer, or personal data should define processing roles, privacy notices, access controls, incident response, retention, and cross-border data safeguards.

What should be included in EOR offboarding for IP and data protection?

EOR offboarding should include final pay, prorated 13th-month pay where applicable, return of company property, confidentiality reminder, file transfer, account deactivation, session revocation, password rotation, device return or wipe, and access removal evidence.

Can SOS help protect IP and confidential data when hiring through EOR?

Yes. SOS can support EOR hiring in the Philippines with employment documentation, confidentiality and IP protection clauses, payroll records, payslips, statutory handling, 13th-month pay, remittance evidence, onboarding support, offboarding workflows, and local HR compliance visibility.

Protect IP Before You Give Access

Before hiring through an EOR, ask for the employment proof, IP clauses, confidentiality language, payroll documentation, and offboarding process.

Request:

• employment contract sample
• confidentiality clause sample
• IP assignment clause sample
• acceptable-use policy
• data handling policy
• payroll register format
• payslip sample
• statutory evidence format
• 13th-month pay tracking method
• offboarding workflow
• access removal checklist
• incident escalation process

Read Philippines EOR Compliance
View Data Security & IP Protection in Offshore Teams
Speak with a specialist and get a quote

Recommended SOS reads

• Philippines EOR Compliance
• Philippines Payroll Compliance Proof Pack
• Data Security & IP Protection in Offshore Teams
• Payroll Transparency & Approval Process
• Employer of Record Philippines
• How to Implement Employer of Record in the Philippines
• Is Employer of Record Legal in the Philippines?
• EOR Pricing Philippines
• Best EOR Providers Philippines
• EOR vs Entity Setup
• EOR vs Freelancer Philippines
• Convert Contractors to Employees Philippines
• Philippines Labor Law Updates 2026
• Hire Salesforce Administrators in the Philippines
• Hire Data Analysts in the Philippines
• Hire Developers in the Philippines
• Hire Executive Assistants in the Philippines