Compliance walkthrough
How to comply with the Philippine Data Privacy Act: video walkthrough
A walkthrough of building a compliance programme for the Philippines' Data Privacy Act of 2012, for personal information controllers and processors.
Key takeaways
- The Act applies to government and private organisations processing personal information.
- Three principles: transparency, legitimate purpose and proportionality.
- Controllers answer for processors they engage, at home or abroad.
- A DPO, privacy impact assessments and breach management are core elements.
- There is no certificate of compliance; the NPC oversees the Act.
The Philippines' data privacy law
The Data Privacy Act of 2012, Republic Act No. 10173, is the Philippines' law on the processing of personal information. It covers government and private organisations of every size, holds every use of personal information to three principles, transparency, legitimate purpose and proportionality, gives data subjects enforceable rights and makes the personal information controller answerable for its processing, including by processors it engages at home or abroad. The National Privacy Commission administers and implements it through the Implementing Rules and Regulations, circulars and advisories.
No certificate of compliance with the Act exists. The NPC oversees it through registration, breach notifications, compliance checks and complaints. This short film walks through how a programme is built.
Built, run, then shown
Decide what the programme has to cover: the entities and sites, the organisation's role as controller or processor for each system, any exemption or extraterritorial link, the registration thresholds and client contract conditions. A processor has its own obligations too: it designates a data protection officer, secures the data, reports breaches to its controller and registers where it crosses the thresholds.
A gap analysis then compares current practice with the Act and the NPC's issuances. Implementation builds a data inventory for each processing system with purpose, lawful criterion, retention and disposal; notices at each collection point; a lawful basis for processing personal and sensitive personal information; a designated data protection officer; privacy impact assessments; organisational, physical and technical security measures; procedures for data subjects' rights; contracts with processors; and a breach management process that meets the NPC's notification rules. Registration with the NPC is completed where thresholds apply. The programme then runs and its evidence is kept for the NPC and for clients' own audits.
Sterling's expert and experienced consultants design and implement the programme with your people under Sterling OS™. The NPC's voluntary Philippine Privacy Mark requires ISO/IEC 27001 and ISO/IEC 27701 certification; legal interpretation stays with your counsel.
Data Privacy Act (Philippines) at a glance
- Purpose
- Data privacy in the Philippines: personal information processed lawfully and securely, data subjects' rights honoured, breaches reported and accountability demonstrated
- Relevant to
- Government and private organisations processing personal information in the Philippines, as controller or processor, and entities abroad processing information about Philippine citizens or residents with a link to the country
- Edition
- Republic Act No. 10173, approved 15 August 2012, with its Implementing Rules and Regulations and NPC circulars and advisories
- Certification
- No certificate of compliance with the Act exists. The NPC oversees it through registration, breach notifications, compliance checks and complaints; its voluntary Philippine Privacy Mark requires ISO/IEC 27001 and ISO/IEC 27701 certification
- Sterling's role
- Programme design and consulting with your team, Effivity, training, internal audit and NPC readiness, then Sustain™
- Cost and timing
- Total investment for a Data Privacy Act compliance programme depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 3 to 6 months
Data Privacy Act (Philippines): questions people ask
Is there a Data Privacy Act certification?
No certificate of compliance with the Act exists. Organisations that register receive an NPC certificate of registration and Seal of Registration, each valid for a year, which show registration, not compliance. NPC Circular No. 2023-05 makes ISO/IEC 27001 and ISO/IEC 27701 certification the prerequisites for the NPC's voluntary Philippine Privacy Mark, assessed by certification bodies. Both standards strengthen your evidence, but neither replaces the decisions the Act requires of you, and accountability stays with you.
Do we have to register with the National Privacy Commission?
Under NPC Circular No. 2022-04 you register your processing systems and DPO if you employ 250 or more people, process sensitive personal information of 1,000 or more individuals, or carry out processing likely to pose a risk to data subjects' rights and freedoms. Registration is online only and renewed yearly, and automated decision-making or profiling must also be notified. Apply the test to each legal entity in a group.
Do we need a Data Protection Officer?
Yes. The IRR requires controllers and processors to designate one, and NPC Advisory No. 2017-01 sets out the role: monitoring compliance, ensuring privacy impact assessments, advising on requests and complaints, managing breaches, building awareness and acting as the contact for data subjects and the NPC. The DPO needs expertise and independence and should not hold a role that decides the purposes and means of processing; Compliance Officers for Privacy can support in branches.
What must we do within 72 hours of a personal data breach?
Where a breach involves sensitive personal information or information usable for identity fraud, and unauthorised acquisition is likely to give rise to a real risk of serious harm, NPC Circular 16-03 requires notice to the NPC and affected data subjects within 72 hours of knowledge or reasonable belief. Delay is allowed only as far as needed to establish the scope, prevent further disclosure or restore system integrity. Every incident is documented and summarised to the NPC annually.
We are a BPO processing data about our clients' foreign customers. Does the Act apply?
Partly, and more than many assume. Section 4 excludes personal information originally collected from residents of foreign jurisdictions under their laws and processed in the Philippines, but the IRR limits the exemption to the minimum extent necessary and keeps the security requirements in force. Employee and applicant data, anything collected locally and your DPO and registration duties are fully in scope. Confirm the analysis with legal counsel.
Keep exploring
Related to this video
Read next
The complete guide
Everything on Data Privacy Act (Philippines)
Start with the Data Privacy Act (Philippines) page, or go straight to the guide you need.
On the Data Privacy Act (Philippines) page
- What are the main Data Privacy Act requirements?
- How do you become Data Privacy Act compliant?
- How much does Data Privacy Act compliance cost?
- How long does Data Privacy Act compliance take?
- Who needs to comply with the Data Privacy Act?
- How a Data Privacy Act programme protects clients, contracts and reputation
- Frequently asked questions about the Data Privacy Act
Often combined with Data Privacy Act (Philippines)
More videos: Privacy and data protection
- How to comply with India's DPDP Act 2023Compliance walkthrough · 3 min 15 s
- India's DPDP Act 2023 requirements explainedTwo-minute brief · 2 min
- How to comply with Singapore's PDPACompliance walkthrough · 3 min 15 s
- Singapore PDPA requirements explainedTwo-minute brief · 2 min
- How to comply with Saudi Arabia's PDPLCompliance walkthrough · 3 min 15 s
- Saudi PDPL requirements explainedTwo-minute brief · 2 min
- How to comply with the UAE PDPLCompliance walkthrough · 3 min 15 s
- UAE PDPL requirements explainedTwo-minute brief · 2 min
- How to comply with HIPAACompliance walkthrough · 3 min 24 s
Talk to a consultant
Plan your Data Privacy Act compliance with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice