ConsentXDPDPA is now in force in India. Run a free privacy scan on your site. Scan now
ConsentXData Privacy Act of 2012 (Republic Act No. 10173)
The Philippines Data Privacy Act of 2012 (Republic Act No. 10173) is the country's principal data protection law. It protects the fundamental right to privacy while supporting the free flow of information for innovation, growth and national development. The law applies to personal information processing in both the private and government sectors, subject to the Act's scope and exclusions.
The law is implemented and enforced by the National Privacy Commission (NPC), which issues regulations, circulars, advisories and guidance for organisations processing personal data.
The Philippine privacy framework covers personal information controllers (PICs) and personal information processors (PIPs) and establishes requirements covering lawful processing, transparency, security, data-subject rights, data-sharing, breach notification, registration and accountability.
For businesses operating websites, applications, e-commerce platforms, SaaS products, marketing systems or other digital services in the Philippines, compliance involves more than obtaining a cookie-banner consent. Organisations need to understand the applicable legal basis, provide appropriate privacy notices, implement security measures, manage data-subject rights, assess third-party processing and maintain appropriate compliance evidence.
The Philippines' privacy framework is primarily based on:
Consent is one lawful basis for processing, but it is not the only lawful basis under the Philippine framework. Processing may also be lawful when necessary for a contract, legal obligation, protection of vital interests, national emergency or public order, or other circumstances recognised by the Act and its implementing rules.
The NPC administers and enforces the DPA and provides guidance for organisations and data subjects.
| Requirement | Philippines DPA |
|---|---|
| Primary law | Republic Act No. 10173 |
| Common name | Data Privacy Act of 2012 |
| Implementing authority | National Privacy Commission |
| Core regulated entities | Personal Information Controllers and Personal Information Processors |
| Consent | One lawful basis; not universal |
| Sensitive data | Sensitive Personal Information receives additional protection |
| DPO | Required under applicable NPC requirements |
| Registration | Required for specified PICs/PIPs and processing systems |
| Breach notification | 72 hours where mandatory-notification conditions are met |
| Data-subject rights | Includes access, correction, objection, erasure/blocking, portability and complaint |
| Cross-border processing | Can be subject to the Act's extraterritorial provisions |
| Automated decision-making | Subject to transparency, rights and notification requirements |
| Supervisory authority | National Privacy Commission |
| Country | Philippines |
Philippines
In force since 2012
Asia & Africa
The DPA applies to organisations and individuals involved in the processing of personal information, including:
The implementing rules define a Personal Information Controller (PIC) as an entity that controls the processing of personal data or instructs another party to process personal data on its behalf. A Personal Information Processor (PIP) is an entity to which a PIC outsources or instructs processing.
The DPA establishes criminal penalties for various privacy violations, including certain unauthorised processing, negligent handling, unauthorised access, improper disposal and concealment of security breaches.
The exact penalty depends on:
For example, the NPC states that concealment of security breaches involving sensitive personal information can carry imprisonment from one year and six months to five years and a fine from PHP 500,000 to PHP 1 million.
Administrative fines may also apply under NPC rules. The NPC's breach guidance notes that certain failures to notify can result in administrative fines under the applicable NPC framework.
Organisations should therefore avoid presenting a single headline fine as the penalty for all DPA violations.
Consent is an important part of the Philippine privacy framework, but processing is not automatically unlawful simply because consent was not obtained.
The implementing rules recognise multiple criteria for lawful processing.
The applicable legal basis should therefore be determined for each processing activity rather than assuming that a consent banner solves every privacy obligation.
Yes, in specified circumstances.
Section 6 of the DPA provides for extraterritorial application where an act or processing outside the Philippines relates to personal information about a Philippine citizen or resident and the entity has a qualifying link with the Philippines.
Relevant links can include:
International businesses should therefore assess their Philippine connections and processing activities rather than assuming that physical location outside the Philippines removes DPA obligations.
The DPA broadly protects information from which an individual can be directly or indirectly identified.
Examples may include:
The concept of processing is broad and includes activities such as collection, recording, organisation, storage, updating, retrieval, consultation, use, disclosure, blocking, erasure and destruction.
The Philippines DPA provides enhanced protection for Sensitive Personal Information (SPI).
The Act includes information relating to matters such as:
The distinction between personal information and sensitive personal information is important because additional restrictions and safeguards can apply to SPI.
Where consent is relied upon, Philippine privacy rules require consent to be:
The IRR provides that consent may be evidenced by written, electronic or recorded means.
A practical consent mechanism should therefore make it possible to establish:
Where consent is required, organisations should avoid making unrelated purposes dependent on a single ambiguous permission.
For example, a business may have separate processing activities involving:
These activities should be assessed individually to determine the applicable legal basis and transparency requirements.
The DPA's transparency requirements require organisations to provide data subjects with appropriate information concerning the processing of their personal information.
A privacy notice should address relevant matters such as:
The IRR specifically recognises the data subject's right to be informed about processing and relevant rights.
The National Privacy Commission identifies several rights granted to data subjects under the DPA, including:
Organisations should therefore maintain a formal privacy-request process that can:
The right to access allows data subjects to obtain information concerning the processing of their personal data.
Depending on the circumstances, this can include information concerning:
Businesses should have a process for locating personal information across databases, applications and third-party systems.
Data subjects may exercise their right to rectify inaccurate or incomplete personal information.
Organisations should maintain processes that allow:
The DPA recognises a right to erasure or blocking in specified circumstances.
This should not be interpreted as an unconditional right to delete every record immediately.
Organisations should determine whether:
Data subjects have the right to object to certain processing.
The implementing rules specifically recognise objections involving:
Where an objection is valid, the controller must stop the relevant processing unless an applicable exception permits continued processing.
The Philippines recognises a right to data portability.
The NPC explains that a data subject may obtain a copy of personal data and/or have it transmitted from one PIC to another in an electronic or structured format that is commonly used.
The right can apply where:
Examples of potentially portable information can include:
Organisations covered by the Philippine privacy framework should establish appropriate privacy governance, including the appointment of a Data Protection Officer (DPO) where required.
The DPO is responsible for supporting organisational compliance with the DPA and NPC requirements.
A DPO may be involved in:
The NPC provides a registration system through which PICs and PIPs can register their DPO and data-processing systems where applicable.
Registration obligations depend on the organisation and nature of its processing.
Under NPC requirements, mandatory registration can apply where, among other circumstances:
The NPC has also stated that data-processing systems involving automated decision-making or profiling are subject to registration requirements under the applicable rules.
Businesses should assess registration requirements rather than assuming that registration is mandatory for every organisation.
The DPA requires PICs and PIPs to implement reasonable and appropriate organisational, physical and technical measures to protect personal information.
Security controls should take into account factors such as:
A practical privacy-security programme can include:
The NPC's breach guidance specifically calls for organisational, physical and technical measures designed to prevent or minimise breaches and support timely detection and response.
Not every security incident requires notification to the NPC and affected individuals.
Mandatory notification applies when the conditions established by the DPA and NPC rules are met.
The NPC identifies three key elements:
Examples of information that may enable identity fraud include:
Where mandatory notification applies, the NPC requires the Personal Data Breach Notification Form to be submitted within 72 hours upon knowledge of or reasonable belief that a personal data breach has occurred.
Affected data subjects must also be notified within the applicable 72-hour period where the notification requirement applies.
The NPC operates a Data Breach Notification Management System (DBNMS) for breach notifications.
Organisations should therefore maintain an incident-response process capable of:
Outsourcing processing does not eliminate the controller's responsibility for applicable breach notification.
The NPC states that the obligation to notify remains with the Personal Information Controller even when processing has been outsourced or subcontracted to a Personal Information Processor.
Contracts with processors should therefore establish:
Organisations frequently rely on third parties to process personal information.
Examples include:
The PIC should understand:
The NPC has issued guidance and circulars concerning data-sharing arrangements and privacy accountability.
The DPA can apply to processing performed outside the Philippines where the statutory extraterritorial conditions are met.
International businesses should assess their Philippine connections, including:
The DPA's extraterritorial provision specifically addresses processing outside the Philippines where the relevant statutory links exist.
The Philippine privacy framework recognises automated processing and profiling as important privacy considerations.
The NPC has specific rules concerning registration and notification for automated decision-making, and the DPA provides data-subject rights relating to automated processing and profiling.
Businesses using:
Should assess:
The NPC has also issued AI-specific guidance concerning the application of the DPA and its implementing rules to AI systems processing personal data.
The NPC has issued recent guidance concerning privacy engineering in systems life-cycle processes.
Businesses should incorporate privacy considerations during:
Privacy should therefore be addressed before personal-data processing begins rather than only after a product is launched.
The Philippines DPA does not simply classify every cookie as requiring consent.
The appropriate approach is to determine:
Website operators should pay particular attention to:
Where consent is the applicable legal basis, ConsentX can help organisations control when selected technologies execute and maintain records of user choices.
The DPA provides data subjects with rights concerning direct marketing.
Businesses conducting email, SMS, advertising or other personalised marketing should review:
The right to object expressly includes processing for direct marketing.
Organisations should establish retention practices appropriate to the purpose and nature of processing.
A retention programme should cover:
Data should not be retained indefinitely simply because storage is technically available.
Retention should also be coordinated with legal, regulatory, contractual and litigation requirements.
Businesses processing information about children or other vulnerable individuals should apply heightened privacy safeguards.
The NPC's registration framework identifies vulnerable data subjects, including minors, patients, elderly persons and others in situations where there may be an imbalance between the data subject and the organisation, as relevant risk factors.
Child-focused products should therefore assess:
Country: Philippines
The Philippines Data Privacy Act applies to personal information processing within its scope and can also apply to certain processing activities conducted outside the Philippines where the statutory extraterritorial conditions are met.
Businesses operating internationally may also need to assess:
The applicable requirements depend on the organisation, processing activity, individuals involved and relevant jurisdiction.
ConsentX can support the website and consent-management layer of a broader Philippine privacy programme.
ConsentX can scan websites to identify:
Where consent is the applicable legal basis, ConsentX can provide configurable consent experiences that allow visitors to make informed choices.
ConsentX can help prevent selected non-essential tracking technologies from executing before the applicable consent decision.
ConsentX can maintain records of consent choices, helping organisations demonstrate:
ConsentX can support workflows for receiving and managing applicable data-subject requests.
ConsentX can configure region-specific privacy experiences so organisations can manage different requirements across jurisdictions.
Regular scans can identify newly introduced cookies, trackers and third-party technologies that may affect privacy compliance.
ConsentX can support the website and consent-management layer of a broader Philippine privacy programme.
Use ConsentX to identify cookies, trackers, scripts, pixels and third-party technologies.
Identify what information is collected, why it is collected and which parties receive it.
Determine whether the processing relies on consent, contract, legal obligation, vital interests, public order or another applicable criterion.
Ensure website notices accurately describe the relevant processing purposes and data-subject rights.
Where consent is required, provide a clear mechanism that captures a freely given, specific and informed choice.
Configure prior-script blocking for selected non-essential tracking technologies where processing should not begin before the applicable permission.
Maintain structured consent evidence that can support internal audits and regulatory inquiries.
Allow users to withdraw or modify applicable consent choices.
Identify analytics, advertising, CRM, cloud and other vendors that process personal information.
Establish processes for access, correction, objection, erasure/blocking, portability and complaints.
Determine whether your organisation or processing systems fall within mandatory NPC registration requirements.
Maintain an incident-response process capable of identifying qualifying breaches and supporting the 72-hour notification requirement.
This page provides a plain-English overview of the Philippines Data Privacy Act of 2012 (Republic Act No. 10173), its implementing rules and related NPC issuances for general informational purposes. It is not legal advice.
Applicable requirements depend on the organisation, processing activity, individuals involved and relevant jurisdiction. ConsentX supports the website privacy layer and does not replace legal advice, security controls, DPO governance or the organisation's broader compliance programme.
Philippines
Pilipinas
GDPR
UK GDPR
CCPA / CPRA
VCDPA
Colorado CPA
CTDPA
UCPA
TDPSA
Oregon OCPA
Montana MCDPA
Florida FDBR
LGPD
PIPEDA
DPDPA
PDPA
POPIA
FADP
Law 25
LFPDPPP
PDPL
Law 21.719
Law 1581
Law 29733
Law 18.331