ConsentXDPDPA is being phased in. Scan your site to see where you stand. Scan now
ConsentXRepublic Act No. 10173, the Data Privacy Act of 2012
Philippines
In force since 2012
Republic Act No. 10173, with its Implementing Rules and Regulations
National Privacy Commission (NPC)
Asia & Africa
Philippines
Republic Act No. 10173
Data Privacy Act of 2012
National Privacy Commission
Personal Information Controllers and Personal Information Processors
One lawful basis; not universal
Sensitive Personal Information receives additional protection
Required under applicable NPC requirements
Required for specified PICs/PIPs and processing systems
72 hours where mandatory-notification conditions are met
Includes access, correction, objection, erasure/blocking, portability and complaint
Can be subject to the Act's extraterritorial provisions
Subject to transparency, rights and notification requirements
National Privacy Commission
The DPA applies to Personal Information Controllers and Personal Information Processors that process personal information in the Philippines, including private-sector organisations, government agencies within the Act's scope, and certain entities outside the Philippines under the Act's extraterritorial provisions. The implementing rules define a Personal Information Controller (PIC) as an entity that controls the processing of personal data or instructs another party to process personal data on its behalf, and a Personal Information Processor (PIP) as an entity to which a PIC outsources or instructs processing.
The DPA establishes criminal penalties for various privacy violations, including certain unauthorised processing, negligent handling, unauthorised access, improper disposal and concealment of security breaches. The exact penalty depends on the offence, the nature of the information, the number of data subjects affected, whether sensitive personal information is involved, whether the conduct was intentional or negligent, and other statutory factors. For example, the NPC states that concealment of security breaches involving sensitive personal information can carry imprisonment from one year and six months to five years and a fine from PHP 500,000 to PHP 1 million. Administrative fines may also apply under NPC rules, and the NPC's breach guidance notes that certain failures to notify can result in administrative fines under the applicable framework. Organisations should therefore avoid presenting a single headline fine as the penalty for all DPA violations.
Consent is an important part of the Philippine privacy framework, but processing is not automatically unlawful simply because consent was not obtained. The applicable legal basis should be determined for each processing activity rather than assuming that a consent banner solves every privacy obligation.
The Philippine privacy framework is primarily based on:
Consent is one lawful basis for processing, but it is not the only lawful basis under the Philippine framework. Processing may also be lawful when necessary for a contract, legal obligation, protection of vital interests, national emergency or public order, or other circumstances recognised by the Act and its implementing rules.
The NPC administers and enforces the DPA and provides guidance for organisations and data subjects.
The DPA applies to organisations and individuals involved in the processing of personal information, including:
For businesses operating websites, applications, e-commerce platforms, SaaS products, marketing systems or other digital services in the Philippines, compliance involves more than obtaining a cookie-banner consent. Organisations need to understand the applicable legal basis, provide appropriate privacy notices, implement security measures, manage data-subject rights, assess third-party processing and maintain appropriate compliance evidence.
Yes, in specified circumstances. Section 6 of the DPA provides for extraterritorial application where an act or processing outside the Philippines relates to personal information about a Philippine citizen or resident and the entity has a qualifying link with the Philippines.
Relevant links can include:
International businesses should therefore assess their Philippine connections and processing activities rather than assuming that physical location outside the Philippines removes DPA obligations.
The DPA broadly protects information from which an individual can be directly or indirectly identified. Examples may include:
The concept of processing is broad and includes activities such as collection, recording, organisation, storage, updating, retrieval, consultation, use, disclosure, blocking, erasure and destruction.
The Philippines DPA provides enhanced protection for Sensitive Personal Information (SPI). The Act includes information relating to matters such as:
The distinction between personal information and sensitive personal information is important because additional restrictions and safeguards can apply to SPI.
Where consent is relied upon, Philippine privacy rules require consent to be:
The IRR provides that consent may be evidenced by written, electronic or recorded means.
A practical consent mechanism should therefore make it possible to establish:
Where consent is required, organisations should avoid making unrelated purposes dependent on a single ambiguous permission.
For example, a business may have separate processing activities involving:
These activities should be assessed individually to determine the applicable legal basis and transparency requirements.
The DPA's transparency requirements require organisations to provide data subjects with appropriate information concerning the processing of their personal information.
A privacy notice should address relevant matters such as:
The IRR specifically recognises the data subject's right to be informed about processing and relevant rights.
The National Privacy Commission identifies several rights granted to data subjects under the DPA, including:
Organisations should therefore maintain a formal privacy-request process that can:
The right to access allows data subjects to obtain information concerning the processing of their personal data. Depending on the circumstances, this can include information concerning:
Businesses should have a process for locating personal information across databases, applications and third-party systems.
Data subjects may exercise their right to rectify inaccurate or incomplete personal information. Organisations should maintain processes that allow:
The DPA recognises a right to erasure or blocking in specified circumstances. This should not be interpreted as an unconditional right to delete every record immediately.
Organisations should determine whether:
Data subjects have the right to object to certain processing. The implementing rules specifically recognise objections involving:
Where an objection is valid, the controller must stop the relevant processing unless an applicable exception permits continued processing.
The Philippines recognises a right to data portability. The NPC explains that a data subject may obtain a copy of personal data and/or have it transmitted from one PIC to another in an electronic or structured format that is commonly used.
The right can apply where:
Examples of potentially portable information can include:
Organisations covered by the Philippine privacy framework should establish appropriate privacy governance, including the appointment of a Data Protection Officer (DPO) where required. The DPO is responsible for supporting organisational compliance with the DPA and NPC requirements.
A DPO may be involved in:
The NPC provides a registration system through which PICs and PIPs can register their DPO and data-processing systems where applicable.
Registration obligations depend on the organisation and nature of its processing. Under NPC requirements, mandatory registration can apply where, among other circumstances:
The NPC has also stated that data-processing systems involving automated decision-making or profiling are subject to registration requirements under the applicable rules.
Businesses should assess registration requirements rather than assuming that registration is mandatory for every organisation.
The DPA requires PICs and PIPs to implement reasonable and appropriate organisational, physical and technical measures to protect personal information. Security controls should take into account factors such as:
A practical privacy-security programme can include:
The NPC's breach guidance specifically calls for organisational, physical and technical measures designed to prevent or minimise breaches and support timely detection and response.
Not every security incident requires notification to the NPC and affected individuals. Mandatory notification applies when the conditions established by the DPA and NPC rules are met.
The NPC identifies three key elements:
Examples of information that may enable identity fraud include:
Where mandatory notification applies, the NPC requires the Personal Data Breach Notification Form to be submitted within 72 hours upon knowledge of or reasonable belief that a personal data breach has occurred. Affected data subjects must also be notified within the applicable 72-hour period where the notification requirement applies.
The NPC operates a Data Breach Notification Management System (DBNMS) for breach notifications. Organisations should therefore maintain an incident-response process capable of:
Outsourcing processing does not eliminate the controller's responsibility for applicable breach notification. The NPC states that the obligation to notify remains with the Personal Information Controller even when processing has been outsourced or subcontracted to a Personal Information Processor.
Contracts with processors should therefore establish:
Organisations frequently rely on third parties to process personal information. Examples include:
The PIC should understand:
The NPC has issued guidance and circulars concerning data-sharing arrangements and privacy accountability.
The DPA can apply to processing performed outside the Philippines where the statutory extraterritorial conditions are met. International businesses should assess their Philippine connections, including:
The DPA's extraterritorial provision specifically addresses processing outside the Philippines where the relevant statutory links exist.
The Philippine privacy framework recognises automated processing and profiling as important privacy considerations. The NPC has specific rules concerning registration and notification for automated decision-making, and the DPA provides data-subject rights relating to automated processing and profiling.
Businesses using the following should assess their processing:
The assessment should cover:
The NPC has also issued AI-specific guidance concerning the application of the DPA and its implementing rules to AI systems processing personal data.
The NPC has issued recent guidance concerning privacy engineering in systems life-cycle processes. Businesses should incorporate privacy considerations during:
Privacy should therefore be addressed before personal-data processing begins rather than only after a product is launched.
The Philippines DPA does not simply classify every cookie as requiring consent. The appropriate approach is to determine:
Website operators should pay particular attention to:
Where consent is the applicable legal basis, ConsentX can help organisations control when selected technologies execute and maintain records of user choices.
The DPA provides data subjects with rights concerning direct marketing. Businesses conducting email, SMS, advertising or other personalised marketing should review:
The right to object expressly includes processing for direct marketing.
Organisations should establish retention practices appropriate to the purpose and nature of processing. A retention programme should cover:
Data should not be retained indefinitely simply because storage is technically available.
Retention should also be coordinated with legal, regulatory, contractual and litigation requirements.
Businesses processing information about children or other vulnerable individuals should apply heightened privacy safeguards. The NPC's registration framework identifies vulnerable data subjects, including minors, patients, elderly persons and others in situations where there may be an imbalance between the data subject and the organisation, as relevant risk factors.
Child-focused products should therefore assess:
Use this checklist as a starting point for your compliance programme:
ConsentX can support the website and consent-management layer of a broader Philippine privacy programme.
Support workflows for receiving and managing applicable data-subject requests.
Help prevent selected non-essential tracking technologies from executing before the applicable consent decision.
Configure region-specific privacy experiences so your organisation can manage different requirements across jurisdictions.
Regular scans can identify newly introduced cookies, trackers and third-party technologies that may affect privacy compliance.
Where consent is the applicable legal basis, provide configurable consent experiences that allow visitors to make informed choices.
Scan your website to identify cookies, analytics scripts, advertising trackers, pixels, third-party scripts, tags and other tracking technologies.
Maintain records of consent choices, helping your organisation demonstrate when consent was given and what purposes were presented.
Each record also captures the choice that was made and which consent configuration applied.
ConsentX can support the website and consent-management layer of a broader Philippine privacy programme. Scan your site, configure the Philippine consent experience, enforce visitor choices, and keep the evidence of those choices in one place.
Use ConsentX to identify cookies, trackers, scripts, pixels and third-party technologies.
Identify what information is collected, why it is collected and which parties receive it.
Determine whether the processing relies on consent, contract, legal obligation, vital interests, public order or another applicable criterion.
Ensure website notices accurately describe the relevant processing purposes and data-subject rights.
Where consent is required, provide a clear mechanism that captures a freely given, specific and informed choice.
Configure prior-script blocking for selected non-essential tracking technologies where processing should not begin before the applicable permission.
Maintain structured consent evidence that can support internal audits and regulatory inquiries.
Allow users to withdraw or modify applicable consent choices.
Identify analytics, advertising, CRM, cloud and other vendors that process personal information.
Establish processes for access, correction, objection, erasure/blocking, portability and complaints.
Determine whether your organisation or processing systems fall within mandatory NPC registration requirements.
Maintain an incident-response process capable of identifying qualifying breaches and supporting the 72-hour notification requirement.
Philippines
Pilipinas
GDPR
UK GDPR
CCPA / CPRA
VCDPA
Colorado CPA
CTDPA
UCPA
TDPSA
Oregon OCPA
Montana MCDPA
Florida FDBR
LGPD
PIPEDA
DPDPA
PDPA
POPIA
FADP
Law 25
LFPDPPP
PDPL
Law 21.719
Law 1581
Law 29733
Law 18.331