Philippines Data Privacy Act Compliance

Regulatory framework

The Philippine privacy framework is primarily based on:

• Republic Act No. 10173 - Data Privacy Act of 2012
• Implementing Rules and Regulations of the Data Privacy Act
• NPC circulars and regulations
• NPC advisories and guidelines
• Sector-specific privacy requirements where applicable

Consent is one lawful basis for processing, but it is not the only lawful basis under the Philippine framework. Processing may also be lawful when necessary for a contract, legal obligation, protection of vital interests, national emergency or public order, or other circumstances recognised by the Act and its implementing rules.

The NPC administers and enforces the DPA and provides guidance for organisations and data subjects.

Organisations covered by the Act

The DPA applies to organisations and individuals involved in the processing of personal information, including:

• Personal Information Controllers
• Personal Information Processors
• Private-sector organisations
• Government agencies within the Act's scope
• Businesses operating websites and applications
• E-commerce platforms
• Financial organisations
• Healthcare organisations
• Educational institutions
• Technology companies
• Marketing and advertising businesses
• Outsourced service providers
• Other entities processing personal information

For businesses operating websites, applications, e-commerce platforms, SaaS products, marketing systems or other digital services in the Philippines, compliance involves more than obtaining a cookie-banner consent. Organisations need to understand the applicable legal basis, provide appropriate privacy notices, implement security measures, manage data-subject rights, assess third-party processing and maintain appropriate compliance evidence.

Does the Philippines DPA apply to companies outside the Philippines?

Yes, in specified circumstances. Section 6 of the DPA provides for extraterritorial application where an act or processing outside the Philippines relates to personal information about a Philippine citizen or resident and the entity has a qualifying link with the Philippines.

Relevant links can include:

• A contract entered into in the Philippines
• A Philippine branch, agency, office or subsidiary
• Central management and control in the Philippines in specified circumstances
• Carrying on business in the Philippines
• Personal information collected or held by an entity in the Philippines

International businesses should therefore assess their Philippine connections and processing activities rather than assuming that physical location outside the Philippines removes DPA obligations.

What is personal information?

The DPA broadly protects information from which an individual can be directly or indirectly identified. Examples may include:

• Name
• Contact details
• Email address
• Identification information
• Account information
• Location information
• Online identifiers
• Employment information
• Financial information
• Health information
• Other information associated with an identifiable individual

The concept of processing is broad and includes activities such as collection, recording, organisation, storage, updating, retrieval, consultation, use, disclosure, blocking, erasure and destruction.

Sensitive Personal Information

The Philippines DPA provides enhanced protection for Sensitive Personal Information (SPI). The Act includes information relating to matters such as:

• Race
• Ethnic origin
• Marital status
• Age
• Colour
• Religious, philosophical or political affiliations
• Health
• Education
• Genetic or sexual life
• Proceedings for offences and their disposition
• Government-issued information peculiar to an individual, such as certain social security, health, licence or tax information
• Information specifically classified as confidential by law or executive action

The distinction between personal information and sensitive personal information is important because additional restrictions and safeguards can apply to SPI.

Consent requirements

Where consent is relied upon, Philippine privacy rules require consent to be:

• Freely given
• Specific
• Informed
• Demonstrable

The IRR provides that consent may be evidenced by written, electronic or recorded means.

A practical consent mechanism should therefore make it possible to establish:

• Who provided consent
• What the person agreed to
• The purpose for which consent was given
• When consent was provided
• What information was presented
• Whether the person later withdrew consent
• What processing occurred based on that consent

Consent should not be bundled unnecessarily

Where consent is required, organisations should avoid making unrelated purposes dependent on a single ambiguous permission.

For example, a business may have separate processing activities involving:

• Account creation
• Service delivery
• Analytics
• Advertising
• Personalisation
• Direct marketing
• Third-party data sharing

These activities should be assessed individually to determine the applicable legal basis and transparency requirements.

Privacy notices and transparency

The DPA's transparency requirements require organisations to provide data subjects with appropriate information concerning the processing of their personal information.

A privacy notice should address relevant matters such as:

• What personal information is being collected
• The purposes of processing
• The method and extent of processing
• The identity and contact details of the controller or representative
• The retention period
• Relevant recipients or disclosures
• Data-subject rights
• How a data subject can exercise those rights or lodge a complaint

The IRR specifically recognises the data subject's right to be informed about processing and relevant rights.

Data subject rights

The National Privacy Commission identifies several rights granted to data subjects under the DPA, including:

• Right to be informed
• Right to access
• Right to object
• Right to rectify
• Right to erasure or blocking
• Right to data portability
• Right to file a complaint
• Right to damages

Organisations should therefore maintain a formal privacy-request process that can:

• Receive the request
• Authenticate the requester
• Identify relevant data
• Determine applicable exemptions
• Coordinate with processors
• Respond within the applicable period
• Maintain evidence of the response

Right to access

The right to access allows data subjects to obtain information concerning the processing of their personal data. Depending on the circumstances, this can include information concerning:

• The personal information being processed
• The purposes of processing
• The methods and extent of processing
• Recipients or categories of recipients
• The source of the data where applicable
• Other information recognised by the DPA

Businesses should have a process for locating personal information across databases, applications and third-party systems.

Right to correction

Data subjects may exercise their right to rectify inaccurate or incomplete personal information. Organisations should maintain processes that allow:

• Identification of the relevant records
• Verification of the requested correction
• Updating of internal systems
• Propagation of corrections to relevant processors or recipients where required
• Documentation of the request and outcome

Right to erasure or blocking

The DPA recognises a right to erasure or blocking in specified circumstances. This should not be interpreted as an unconditional right to delete every record immediately.

Organisations should determine whether:

• The data is no longer necessary
• The processing is unlawful
• The data subject has a valid objection
• Retention is required by another law
• The information is necessary for a legal claim
• Another statutory exception applies

Right to object

Data subjects have the right to object to certain processing. The implementing rules specifically recognise objections involving:

• Direct marketing
• Automated processing
• Profiling

Where an objection is valid, the controller must stop the relevant processing unless an applicable exception permits continued processing.

Right to data portability

The Philippines recognises a right to data portability. The NPC explains that a data subject may obtain a copy of personal data and/or have it transmitted from one PIC to another in an electronic or structured format that is commonly used.

The right can apply where:

• Processing is based on consent or contract
• The personal data is processed electronically in a structured and commonly used format

Examples of potentially portable information can include:

• Names
• Addresses
• Usernames
• Transaction history
• Access logs
• Location data

Data Protection Officer

Organisations covered by the Philippine privacy framework should establish appropriate privacy governance, including the appointment of a Data Protection Officer (DPO) where required. The DPO is responsible for supporting organisational compliance with the DPA and NPC requirements.

A DPO may be involved in:

• Privacy compliance
• Data protection policies
• Privacy impact assessments
• Data-subject requests
• Breach management
• NPC engagement
• Employee awareness
• Vendor management
• Privacy-by-design initiatives

The NPC provides a registration system through which PICs and PIPs can register their DPO and data-processing systems where applicable.

Data Processing System registration

Registration obligations depend on the organisation and nature of its processing. Under NPC requirements, mandatory registration can apply where, among other circumstances:

• A PIC or PIP employs at least 250 employees
• Processing includes sensitive personal information of at least 1,000 individuals
• Processing is likely to pose a risk to data subjects
• Processing is not occasional
• Automated decision-making or profiling is involved in circumstances covered by NPC requirements

The NPC has also stated that data-processing systems involving automated decision-making or profiling are subject to registration requirements under the applicable rules.

Businesses should assess registration requirements rather than assuming that registration is mandatory for every organisation.

Security requirements

The DPA requires PICs and PIPs to implement reasonable and appropriate organisational, physical and technical measures to protect personal information. Security controls should take into account factors such as:

• Nature of the personal information
• Risks associated with processing
• Organisational environment
• Applicable industry standards
• Cost of implementation
• Potential impact on data subjects

A practical privacy-security programme can include:

• Access controls
• Authentication
• Encryption
• Network security
• Application security
• Logging and monitoring
• Vulnerability management
• Backups
• Disaster recovery
• Employee training
• Incident response
• Vendor security controls

The NPC's breach guidance specifically calls for organisational, physical and technical measures designed to prevent or minimise breaches and support timely detection and response.

Personal data breach notification

Not every security incident requires notification to the NPC and affected individuals. Mandatory notification applies when the conditions established by the DPA and NPC rules are met.

The NPC identifies three key elements:

• The breach involves sensitive personal information or other information that may enable identity fraud.
• There is reason to believe that the information was acquired by an unauthorised person.
• The PIC believes the breach is likely to give rise to a real risk of serious harm to the affected data subject.

Examples of information that may enable identity fraud include:

• Financial or economic information
• Usernames and passwords
• Biometric data
• Government-issued identification documents
• Unique government identifiers
• Similar information capable of affecting decisions concerning an individual

72-hour breach notification

Where mandatory notification applies, the NPC requires the Personal Data Breach Notification Form to be submitted within 72 hours upon knowledge of or reasonable belief that a personal data breach has occurred. Affected data subjects must also be notified within the applicable 72-hour period where the notification requirement applies.

The NPC operates a Data Breach Notification Management System (DBNMS) for breach notifications. Organisations should therefore maintain an incident-response process capable of:

• Detecting incidents
• Assessing whether personal data is affected
• Determining notification thresholds
• Escalating incidents
• Preparing notification information
• Contacting affected individuals
• Documenting remediation
• Preventing recurrence

Data breach notification and processors

Outsourcing processing does not eliminate the controller's responsibility for applicable breach notification. The NPC states that the obligation to notify remains with the Personal Information Controller even when processing has been outsourced or subcontracted to a Personal Information Processor.

Contracts with processors should therefore establish:

• Security requirements
• Incident notification timelines
• Investigation cooperation
• Evidence preservation
• Data-subject support
• Regulatory cooperation
• Remediation responsibilities

Data sharing and third-party processors

Organisations frequently rely on third parties to process personal information. Examples include:

• Cloud providers
• CRM platforms
• Analytics providers
• Advertising platforms
• Payment processors
• Customer-support providers
• Marketing automation platforms
• HR systems
• SaaS providers

The PIC should understand:

• What information is shared
• Why it is shared
• Who receives it
• Where it is processed
• What security controls apply
• How long it is retained
• Whether further processors are involved
• What happens after termination

The NPC has issued guidance and circulars concerning data-sharing arrangements and privacy accountability.

Cross-border and international processing

The DPA can apply to processing performed outside the Philippines where the statutory extraterritorial conditions are met. International businesses should assess their Philippine connections, including:

• Philippine customers or residents
• Philippine contracts
• Philippine branches or subsidiaries
• Philippine operations
• Data collected or held in the Philippines
• Access by foreign parent or affiliate organisations

The DPA's extraterritorial provision specifically addresses processing outside the Philippines where the relevant statutory links exist.

Automated decision-making and profiling

The Philippine privacy framework recognises automated processing and profiling as important privacy considerations. The NPC has specific rules concerning registration and notification for automated decision-making, and the DPA provides data-subject rights relating to automated processing and profiling.

Businesses using the following should assess their processing:

• AI systems
• Automated eligibility decisions
• Credit scoring
• Behavioural profiling
• Personalised advertising
• Fraud detection
• Recommendation systems
• Other automated decision systems

The assessment should cover:

• What personal data is being used
• The purpose of the automated processing
• Whether the system significantly affects individuals
• Transparency requirements
• Objection rights
• Registration obligations
• Security
• Third-party processing
• Human review where appropriate

The NPC has also issued AI-specific guidance concerning the application of the DPA and its implementing rules to AI systems processing personal data.

Privacy by design and privacy engineering

The NPC has issued recent guidance concerning privacy engineering in systems life-cycle processes. Businesses should incorporate privacy considerations during:

• Product design
• Website development
• Application development
• Vendor selection
• Data architecture
• AI development
• Analytics implementation
• Security design
• System changes

Privacy should therefore be addressed before personal-data processing begins rather than only after a product is launched.

Cookies and online tracking

The Philippines DPA does not simply classify every cookie as requiring consent. The appropriate approach is to determine:

• Whether the cookie or tracker processes personal information
• What information it collects
• For what purpose
• Who receives the information
• What legal basis applies
• Whether the technology involves sensitive information
• Whether third-party processing is involved
• What transparency and choice requirements apply

Website operators should pay particular attention to:

• Advertising cookies
• Retargeting pixels
• Analytics
• Social-media pixels
• Conversion tracking
• Device identifiers
• Behavioural analytics
• Session technologies
• Third-party SDKs

Where consent is the applicable legal basis, ConsentX can help organisations control when selected technologies execute and maintain records of user choices.

Direct marketing

The DPA provides data subjects with rights concerning direct marketing. Businesses conducting email, SMS, advertising or other personalised marketing should review:

• The source of marketing data
• The purpose for which it was collected
• Applicable consent
• Opt-out mechanisms
• Preference management
• Third-party disclosures
• Profiling
• Advertising platforms
• Data retention

The right to object expressly includes processing for direct marketing.

Data retention

Organisations should establish retention practices appropriate to the purpose and nature of processing. A retention programme should cover:

• Customer accounts
• Marketing databases
• Consent records
• Website analytics
• Cookies and tracking information
• Support records
• Employee information
• Data-subject requests
• Security logs
• Vendor-held personal data

Data should not be retained indefinitely simply because storage is technically available.

Retention should also be coordinated with legal, regulatory, contractual and litigation requirements.

Children and vulnerable data subjects

Businesses processing information about children or other vulnerable individuals should apply heightened privacy safeguards. The NPC's registration framework identifies vulnerable data subjects, including minors, patients, elderly persons and others in situations where there may be an imbalance between the data subject and the organisation, as relevant risk factors.

Child-focused products should therefore assess:

• Age verification
• Appropriate notices
• Consent requirements
• Parental involvement where applicable
• Data minimisation
• Security
• Retention
• Profiling
• Third-party disclosures

Philippines DPA compliance checklist

Use this checklist as a starting point for your compliance programme:

• Identify all personal information collected
• Identify sensitive personal information
• Map processing purposes
• Determine the applicable lawful processing criterion
• Review consent mechanisms
• Maintain consent evidence
• Publish appropriate privacy notices
• Identify PIC and PIP roles
• Review processor contracts
• Assess data-sharing arrangements
• Review cross-border processing
• Establish data-subject request procedures
• Support access requests
• Support correction requests
• Support erasure/blocking requests
• Support objections
• Support data portability
• Review direct-marketing practices
• Assess automated decision-making
• Review profiling activities
• Assess NPC registration requirements
• Maintain DPO governance
• Implement reasonable security measures
• Establish breach-response procedures
• Assess the 72-hour notification requirement
• Review child and vulnerable-person processing
• Scan cookies and trackers
• Block selected technologies before applicable consent
• Regularly review website and vendor changes