Two-minute brief
Philippine Data Privacy Act requirements explained: video brief
A two-minute brief on the provisions of Republic Act No. 10173 that shape a data privacy programme in the Philippines.
Key takeaways
- Section 11 sets the general data privacy principles.
- Sensitive personal information has stricter processing conditions.
- Data subjects have rights including access, rectification and erasure.
- Notifiable breaches are reported to the NPC and affected data subjects.
- Controllers and processors each need a data protection officer.
Principles and lawful processing
The Data Privacy Act sets the obligations, and the Implementing Rules and Regulations and the National Privacy Commission's issuances say how to meet them. This short film maps the provisions that shape a programme. Legal interpretation stays with counsel.
Section 11 sets the general data privacy principles: collect for specified, legitimate purposes declared before or soon after collection; process fairly and lawfully; and keep information accurate, adequate, not excessive and no longer than necessary. In practice that means a data inventory per processing system with purpose, criterion, retention and disposal, and notices at each collection point. Sections 12 and 13 set the lawful criteria for processing personal information and the stricter conditions for sensitive personal information, from consent, contract and legal obligation to vital interests and public authority.
Rights, security, breaches and accountability
Data subjects have rights to be informed, to object, to access, to rectification, to erasure or blocking, to damages, and to data portability, and organisations need procedures to honour them. The security provisions require organisational, physical and technical measures to protect personal information, and personal data breaches meeting the notification criteria are reported to the NPC and to affected data subjects. Accountability means the personal information controller answers for the information it processes, including through processors at home or abroad, and designates a data protection officer.
Processors carry duties of their own, including a data protection officer, security, breach reporting to the controller and registration above the thresholds. The Act, approved on 15 August 2012, applies to government and private organisations processing personal information in the Philippines and to entities abroad with a link to the country. No certificate of compliance exists; the NPC oversees the Act through registration, breach notifications, compliance checks and complaints.
Registration with the NPC, required above thresholds set in its circulars, produces a certificate of registration that shows registration, not compliance. Where a breach involving sensitive personal information is likely to cause serious harm, the NPC and affected individuals are notified within 72 hours.
Data Privacy Act (Philippines) at a glance
- Purpose
- Data privacy in the Philippines: personal information processed lawfully and securely, data subjects' rights honoured, breaches reported and accountability demonstrated
- Relevant to
- Government and private organisations processing personal information in the Philippines, as controller or processor, and entities abroad processing information about Philippine citizens or residents with a link to the country
- Edition
- Republic Act No. 10173, approved 15 August 2012, with its Implementing Rules and Regulations and NPC circulars and advisories
- Certification
- No certificate of compliance with the Act exists. The NPC oversees it through registration, breach notifications, compliance checks and complaints; its voluntary Philippine Privacy Mark requires ISO/IEC 27001 and ISO/IEC 27701 certification
- Sterling's role
- Programme design and consulting with your team, Effivity, training, internal audit and NPC readiness, then Sustain™
- Cost and timing
- Total investment for a Data Privacy Act compliance programme depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 3 to 6 months
Data Privacy Act (Philippines): questions people ask
Is there a Data Privacy Act certification?
No certificate of compliance with the Act exists. Organisations that register receive an NPC certificate of registration and Seal of Registration, each valid for a year, which show registration, not compliance. NPC Circular No. 2023-05 makes ISO/IEC 27001 and ISO/IEC 27701 certification the prerequisites for the NPC's voluntary Philippine Privacy Mark, assessed by certification bodies. Both standards strengthen your evidence, but neither replaces the decisions the Act requires of you, and accountability stays with you.
Do we have to register with the National Privacy Commission?
Under NPC Circular No. 2022-04 you register your processing systems and DPO if you employ 250 or more people, process sensitive personal information of 1,000 or more individuals, or carry out processing likely to pose a risk to data subjects' rights and freedoms. Registration is online only and renewed yearly, and automated decision-making or profiling must also be notified. Apply the test to each legal entity in a group.
Do we need a Data Protection Officer?
Yes. The IRR requires controllers and processors to designate one, and NPC Advisory No. 2017-01 sets out the role: monitoring compliance, ensuring privacy impact assessments, advising on requests and complaints, managing breaches, building awareness and acting as the contact for data subjects and the NPC. The DPO needs expertise and independence and should not hold a role that decides the purposes and means of processing; Compliance Officers for Privacy can support in branches.
What must we do within 72 hours of a personal data breach?
Where a breach involves sensitive personal information or information usable for identity fraud, and unauthorised acquisition is likely to give rise to a real risk of serious harm, NPC Circular 16-03 requires notice to the NPC and affected data subjects within 72 hours of knowledge or reasonable belief. Delay is allowed only as far as needed to establish the scope, prevent further disclosure or restore system integrity. Every incident is documented and summarised to the NPC annually.
We are a BPO processing data about our clients' foreign customers. Does the Act apply?
Partly, and more than many assume. Section 4 excludes personal information originally collected from residents of foreign jurisdictions under their laws and processed in the Philippines, but the IRR limits the exemption to the minimum extent necessary and keeps the security requirements in force. Employee and applicant data, anything collected locally and your DPO and registration duties are fully in scope. Confirm the analysis with legal counsel.
Keep exploring
Related to this video
Read next
The complete guide
Everything on Data Privacy Act (Philippines)
Start with the Data Privacy Act (Philippines) page, or go straight to the guide you need.
On the Data Privacy Act (Philippines) page
- What are the main Data Privacy Act requirements?
- How do you become Data Privacy Act compliant?
- How much does Data Privacy Act compliance cost?
- How long does Data Privacy Act compliance take?
- Who needs to comply with the Data Privacy Act?
- How a Data Privacy Act programme protects clients, contracts and reputation
- Frequently asked questions about the Data Privacy Act
Often combined with Data Privacy Act (Philippines)
More videos: Privacy and data protection
- How to comply with India's DPDP Act 2023Compliance walkthrough · 3 min 15 s
- India's DPDP Act 2023 requirements explainedTwo-minute brief · 2 min
- How to comply with Singapore's PDPACompliance walkthrough · 3 min 15 s
- Singapore PDPA requirements explainedTwo-minute brief · 2 min
- How to comply with Saudi Arabia's PDPLCompliance walkthrough · 3 min 15 s
- Saudi PDPL requirements explainedTwo-minute brief · 2 min
- How to comply with the UAE PDPLCompliance walkthrough · 3 min 15 s
- UAE PDPL requirements explainedTwo-minute brief · 2 min
- How to comply with HIPAACompliance walkthrough · 3 min 24 s
Talk to a consultant
Plan your Data Privacy Act compliance with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice