Data Privacy Act of 2012 · Republic Act No. 10173 · Philippines
Data Privacy Act compliance consulting in the Philippines, for a privacy programme that holds up when the National Privacy Commission checks.
Build a Data Privacy Act compliance programme for your operations in the Philippines that the National Privacy Commission and your clients can test: a Data Protection Officer in place, privacy impact assessments done, security working, breaches handled within 72 hours and processors under contract. Sterling's expert and experienced consultants build it with your people from our office in Manila, prepare the evidence and stay with you. We ensure a successful Data Privacy Act compliance programme for our clients.
- Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced data privacy consultants, advising on management systems across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling builds the privacy programme and the evidence; the National Privacy Commission enforces the Act
8,100+ client engagements in 60+ countries.
Data Privacy Act client experience
What it is
What is the Philippine Data Privacy Act and what does it require?
The Data Privacy Act of 2012, Republic Act No. 10173, is the Philippines' law on the processing of personal information. It covers government and private organisations of every size, holds every use of personal information to three principles (transparency, legitimate purpose and proportionality), gives data subjects enforceable rights and makes the personal information controller answerable for its processing, including by processors it engages at home or abroad. The National Privacy Commission (NPC), the independent body the Act created to administer and implement it, adds the detail through the Implementing Rules and Regulations (IRR), circulars and advisories.
No certificate of compliance comes at the end. Section 21 makes the controller responsible for personal information in its custody, including information passed to a third party for processing, and requires it to designate the individuals accountable for compliance. The IRR and NPC issuances turn that into duties: a Data Protection Officer, registration above set thresholds, privacy impact assessments, security measures, breach notification within 72 hours and contracts with processors. Chapter VIII makes particular failures, from unauthorised processing to concealing a security breach, crimes punishable by imprisonment and a fine.
Current text. Republic Act No. 10173, approved on 15 August 2012, is in force with its IRR, amended on data sharing by NPC Circular No. 2020-03. Much of the working detail sits in NPC issuances, among them NPC Circular No. 2022-04 on registration (in effect since 11 January 2023), NPC Circular 16-03 on breach management and NPC Circular No. 2023-06 on security. In September 2026 the NPC opened public consultation on a draft circular on data subject rights; until it is issued, the Act, the IRR and NPC Advisory No. 2021-01 govern rights requests.
Who it is for
Who needs to comply with the Data Privacy Act?
The Act applies to anyone processing personal information in the Philippines, including controllers and processors based elsewhere that use equipment in the country or keep an office, branch or agency there, and Section 6 reaches acts done abroad that concern Philippine citizens or residents where the entity has a link with the country. Section 4 excludes a short list, such as journalistic, artistic, literary or research processing and information collected from residents of other countries under their laws and processed in the Philippines; the IRR keeps those exemptions to the minimum necessary and the security requirements in force. Organisations come to Sterling from four starting points:
- You serve overseas clients from the Philippines. BPOs and shared service centres process data foreign clients collected under foreign law, which Section 4 may exempt; the security requirements stay, your workforce's data is fully in scope and client contracts ask for Data Privacy Act evidence. At 250 or more employees, NPC registration follows.
- The NPC has written, a complaint has arrived, or a breach has happened. A compliance check, a complaint or a 72-hour deadline shows quickly whether the DPO, the assessments and the breach procedure work or only exist in a folder.
- You hold sensitive personal information at scale. Hospitals, schools, lenders, payment apps, HR and payroll providers: health, education and government-issued identifiers are sensitive personal information under Section 3(l), processed only on a Section 13 ground, and holding it for 1,000 or more individuals makes registration mandatory.
- You are launching a system that watches people or decides about them. A new app, CCTV network, biometric attendance system or AI model needs a privacy impact assessment before it goes live, and NPC Circular No. 2022-04 requires notice to the NPC of automated decision-making or profiling.
The thresholds decide whether you must register, not whether the Act applies: a small organisation still needs a DPO, a lawful criterion for each processing activity, security measures, a breach procedure and agreements with its processors.
Business benefits
How a Data Privacy Act programme protects clients, contracts and reputation
Privacy work pays for itself when personal information is under pressure: a client questionnaire, a payroll file sent to the wrong address, a stolen laptop, an access request, a letter from the NPC. We give each moment an owner, a procedure and a record.
- Client audits that close quicklyOutsourcing agreements, the inventory, assessments and security evidence ready before a client's vendor-risk team asks.
- Breaches handled inside the deadlineA breach response team, the notification test and templates ready, so a notifiable breach is reported within 72 hours.
- A DPO who can do the jobDesignated with the independence, time and access NPC Advisory No. 2017-01 expects, and involved from the start.
- Registration that stays currentSystems registered from an inventory that matches reality, renewed each year, with the Seal of Registration displayed.
- Sensitive information under firm controlHealth and education records and government-issued identifiers held only on a Section 13 ground, with access limited, retention defined and disposal recorded.
- Ready for overseas clients' laws tooThe inventory, assessments and controls built for the Act also answer GDPR, HIPAA and PCI DSS questions.
Track measures the NPC and your clients would recognise: systems with a current assessment, hours from discovery to a breach decision, requests answered on time, processors under signed agreements. A count of policies is not among them.
Requirements
What are the main Data Privacy Act requirements?
The Act sets the obligations; the IRR and NPC issuances say how to meet them. Processors carry duties of their own, including a DPO, security, breach reporting to the controller and registration above the thresholds. The table maps the provisions that shape a programme to practice; legal interpretation stays with your counsel.
| Section | What it requires of you | What it looks like in practice |
|---|---|---|
| Sec. 11 General data privacy principles | Collect for specified, legitimate purposes declared before or soon after collection; process fairly and lawfully; keep information accurate, adequate, not excessive and no longer than necessary | A data inventory per processing system with purpose, criterion, retention and disposal, and notices at each collection point |
| Sec. 12 and 13 Lawful processing of personal and sensitive personal information | Rely on a Section 12 criterion, from consent, contract and legal obligation to vital interests, public authority functions and legitimate interests; process sensitive and privileged information only on a Section 13 ground, such as purpose-specific consent, a law providing for it, medical treatment or legal claims | The criterion recorded per system, consent records (NPC Circular No. 2023-04), legitimate-interest assessments (NPC Circular No. 2023-07) and Section 13 grounds for HR, health and ID data |
| Sec. 16 to 18 Rights of the data subject | Inform people before processing; honour the rights to be informed, to object, to access, to rectification, to erasure or blocking, to damages and to data portability | Notices per audience, a request procedure with identity checks and a log, and records retrievable by person |
| Sec. 20 Security of personal information | Apply reasonable and appropriate organisational, physical and technical measures against accidental or unlawful destruction, alteration and disclosure; bind staff to confidentiality that outlasts their role | Access control, encryption where appropriate, secure rooms and disposal under IRR Sections 26 to 28 and NPC Circular No. 2023-06, with ISO/IEC 27001 controls where you run them |
| Sec. 20(f) Personal data breach management | Notify the NPC and affected data subjects within 72 hours of a breach involving sensitive personal information or information enabling identity fraud, where unauthorised acquisition is likely to give rise to a real risk of serious harm; document every incident and report an annual summary | A breach response team, the 72-hour clock, templates, filing through the NPC's Data Breach Notification Management System and an incident register (NPC Circular 16-03; IRR Sections 38 to 42) |
| Sec. 21 Accountability and the Data Protection Officer | Designate the individuals accountable for compliance: every controller and processor designates a DPO (IRR Section 26(a); NPC Advisory No. 2017-01), with Compliance Officers for Privacy possible in branches | A designation letter, a role covering the advisory's functions, conflicts addressed and contact details published |
| NPC Circular No. 2022-04 Registration of processing systems | Register processing systems and the DPO on the NPC's platform at 250 or more employees, sensitive personal information of 1,000 or more individuals, or processing likely to pose a risk to data subjects' rights and freedoms; notify automated decision-making or profiling | An NPC Registration System account, entries that match the inventory, and the certificate and Seal of Registration renewed yearly |
| NPC Advisory No. 2017-03 Privacy impact assessment and privacy management programme | Assess each processing system before adoption and periodically after, with the DPO involved; embed privacy in strategy and daily operations through a privacy management programme | An assessment per system rating risk by likelihood and impact, with controls tracked; a privacy manual and a programme with owners and an annual review |
| Sec. 14 and 21 Outsourcing, data sharing and cross-border transfers | Remain responsible for information you subcontract or transfer, locally or abroad, and secure comparable protection by contract or other reasonable means; use outsourcing agreements with the terms in IRR Sections 43 to 45, such as documented instructions, confidentiality, security, help with rights requests and return or deletion | A processor register, outsourcing and data sharing agreements (NPC Circular No. 2020-03), a transfer map and the NPC's model contractual clauses for transfers abroad (NPC Advisory No. 2024-01) where they fit |
What does useful Data Privacy Act evidence look like?
A DPO designation and, where required, the NPC certificate of registration; an inventory that matches what systems do; assessment reports with risk ratings and actions; the privacy manual, notices and consent records; signed outsourcing and data sharing agreements; a breach register that includes incidents you chose not to notify, and why; a rights-request log; training records; and an internal audit and management review. We build these from your real processing and keep them in Effivity from the first workshop, so an NPC compliance check or a client audit meets a programme that runs.
Data Privacy Act requirements explained, section by sectionCompliance process
How do you become Data Privacy Act compliant?
Compliance is built, then run, then shown. Sterling designs and builds the programme with your people; the NPC oversees the Act through registration, breach notifications, compliance checks and complaints, and your clients run their own audits.
- 01Decide what the programme has to cover.Entities and sites, your role as controller or processor per system, any Section 4 exemption or Section 6 link, the registration thresholds and client contract conditions.
- 02Gap analysis: review the current position against the Act, the IRR and NPC issuances.The gap analysis inventories systems and data flows, tests the DPO arrangement, notices, consents, contracts, security and breach procedure, keeps what works and agrees actions, owners and dates.
- 03Implement, register and keep the evidence as you go.Designate the DPO, complete the assessments, write the privacy manual and notices, sign the agreements, apply the security measures, register where required and train the people who handle personal information.
- 04Audit, review and address the findings.An internal audit, a management review with the DPO and a breach drill show what operates; findings are raised by us first and closed with evidence.
- 05Complete the regulator or customer review.Answer an NPC compliance check, a client audit or a questionnaire from evidence that already exists; for a certificate, take the programme to ISO/IEC 27001 and ISO/IEC 27701 certification by an accredited body.
- 06Keep the programme running after go-live.Renew the registration each year, assess new systems before launch, review requests and incidents, file the annual security incident report and keep the audit and review cycle turning.
Judge an offer by what your DPO can defend afterwards: who builds the inventory, who runs the assessments, whether the documents fit your systems and where the evidence lives. A registration filed for you is one obligation among many, and the NPC issues no "DPA certified" badge. How to choose a credible Data Privacy Act provider · The certification buyer's checklist
Cost
How much does Data Privacy Act compliance cost?
Cost follows the number of processing systems, the volume and sensitivity of the information, the processors and client contracts involved and what already exists: a single clinic and a multi-site BPO need very different programmes. In a Sterling proposal every component is visible and nothing is added later.
| Cost component | What affects it |
|---|---|
| Consulting and implementation | Systems and data flows to map, controller and processor roles, entities and sites, the assessments and documents to produce, and how much of the work your team takes on (Design™ or Drive™) |
| Independent review | Fees of any ISO/IEC 27001 or ISO/IEC 27701 certification body or other assessor you choose, shown separately; any NPC fees follow its published schedule |
| Internal resources and legal | DPO and process-owner time, IT effort for access, retention, disposal and security changes, training hours and legal review of notices and contracts |
| Software and learning | Included in a Sterling engagement: Effivity for the programme and Sterling Academy access for your people, with users, courses and access period confirmed in the proposal |
| Continued support | Internal audits, assessments of new systems, registration renewals, incident and request reviews, a watch on new NPC issuances and refresher learning under Sustain™ |
What moves the price
- Processing systems, entities and sites, and whether an inventory exists
- Sensitive personal information, and how many people it covers
- Controller, processor or both, and client contracts with their own privacy terms
- Other regimes in scope: the GDPR, HIPAA or PCI DSS
- A deadline from the NPC, a client audit or a contract renewal
What a Sterling proposal always shows
- Deliverables, responsibilities, assumptions and exclusions, in writing
- Certification-body and legal fees identified separately, so the full programme cost is comparable
- Effivity, training and Academy access itemised at no additional cost
- Payment milestones tied to deliverables, not to the calendar
- One all-inclusive proposal. No surprises, ever
Timeline
How long does Data Privacy Act compliance take?
Three to six months is typical for one organisation: less where a DPO, an inventory and an ISO/IEC 27001 system exist, more where many sites, systems and processors are involved. Decisions set the pace more than drafting: who the DPO is, which criterion supports each system, which risks an assessment accepts and how long controls must run before an audit can see them. Our plan is built around those decisions, with milestones tracked in Effivity.
| Phase | What determines the pace |
|---|---|
| Scope and gap analysis | Access to system owners, HR, IT and contracts, and the pace of the data inventory |
| Build and implementation | DPO designation, privacy impact assessments, notices and consents, outsourcing agreements, security changes, NPC registration and training |
| Evidence and review | Controls operating long enough to leave records, a breach drill, then internal audit and management review |
| Regulator or customer review | The timing of NPC compliance checks, client audits or questionnaires and, for certification, the certification body's schedule |
If an NPC deadline, a client audit or a renewal date exists, tell us at the start; we will say what can be ready and which decisions cannot wait. Full compliance promised within a week, before anyone has seen how data moves through your business, is a sales line, not a plan.
Challenges
Common Data Privacy Act implementation challenges
Most Data Privacy Act programmes stall on the same five problems. Each has a practical answer.
The DPO is a name on a form, with no time or authority.
We define the role from NPC Advisory No. 2017-01, agree the time it needs, remove conflicts with roles that decide on processing and give the DPO a seat in management meetings.
The registration does not match the real processing systems.
We build the inventory with each system's owners and prepare the registration from it, so the NPC record, the assessments and the notices describe the same processing.
Client data from abroad is treated as entirely out of scope.
We separate what the Section 4 exemption may cover from what it cannot, keep the security measures the IRR still requires, bring employee data fully in and record the analysis for your counsel.
Privacy impact assessments were done once, for the wrong systems.
A screening question in every project and purchase decides when an assessment is due, one method rates likelihood and impact across teams, and each assessment has a review date.
Breaches are found late and the 72 hours are already gone.
Escalation routes from IT, HR and the front line, a breach response team with named decision owners, ready templates and a rehearsed filing route.
Your engagement
What your Data Privacy Act engagement includes
The agreed scope covers what a working programme and a prepared team need, from one team under one all-inclusive proposal.
Scope, gap analysis and implementation plan
Entities, roles, systems and registration duties confirmed, every requirement tested, and actions, owners and dates agreed before work starts.
Data inventory, assessments and documentation
The system inventory, privacy impact assessments, privacy manual, notices, consent wording, agreements and breach and request procedures, on Sterling's template sets adapted to your processing.
Effivity ISO & GRC software
Your programme runs in Effivity from day one, included with the engagement at no additional cost.
Training for everyone
Internal auditor training for your audit team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Internal audit and management review
Conducted or facilitated as agreed, with findings closed with evidence before the NPC, a client or a certification body looks.
NPC registration and review support
Registration and renewal on the NPC's platform, preparation for compliance checks and client audits, breach notification support, and ISO/IEC 27001 and ISO/IEC 27701 certification if you pursue it.
Sterling consults; it does not give legal opinions, and the National Privacy Commission alone enforces the Act.
How we deliver
How Sterling supports your Data Privacy Act implementation
Every Data Privacy Act engagement runs on Sterling OS™, our delivery operating system: five phases, each with named deliverables, decision owners and evidence. Choose how much of the work your team carries; method, software and accountability stay the same.
- 01Design™Guided implementation: your DPO and process owners build the programme with Sterling's structure, templates, workshops and coaching.
- 02Drive™Fully managed consulting: Sterling consultants carry the inventory, assessment, drafting and registration work with your teams and legal counsel.
- 03Sustain™After go-live: registration renewals, new-system assessments, request and incident reviews, the annual internal audit and refresher training.
- 04Automate™The programme in Effivity: processing systems, assessments, risks, requests, incidents, processors, audits and management review in one workspace.
- 05Revise™New NPC circulars and advisories, such as the draft on data subject rights, and changes in your systems, sites or clients.
In week one we fix the engagement team, the weekly session with your DPO and the deliverables, then review progress against them, so a stalled assessment shows early, not when the NPC asks.
How Sterling OS™ worksOften combined with
Standards organisations pair with Data Privacy Act (Philippines)
- ADGM Data Protection Regulations 2021ADGM data protection compliance for entities under the 2021 Regulations: lawful bases, DPO, impact assessments, 72-hour breach notice and transfers, all-inclusive proposal.
- APEC CBPRAPEC CBPR certification and requirements explained: Global CBPR and PRP, Accountability Agent review, annual renewal and how Sterling prepares your team.
- APPI (Japan)APPI compliance for Japan's Act on the Protection of Personal Information: the requirements, PPC breach reporting, cross-border rules and an all-inclusive programme.
- Bahrain PDPLBahrain PDPL compliance and requirements explained: consent, notification to the Authority, transfers abroad, 72-hour breach reporting, rights, cost and timing.
- CCPA / CPRACCPA compliance and requirements under the CPRA: notices, consumer rights, opt-outs, risk assessments, cybersecurity audits and ADMT, in an all-inclusive programme.
- Cyber and Data Protection Act (Zimbabwe)Zimbabwe's Cyber and Data Protection Act [Chapter 12:07]: POTRAZ licensing, lawful processing, security and transfers, built into a programme.
Effivity · Data Privacy Act programme software, included in every engagement
How Effivity helps you fulfil, automate and simplify the requirements of the Data Privacy Act of 2012.
Every Sterling Data Privacy Act engagement includes Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant configures the privacy workspace within the agreed scope, from processing systems, assessments, risks and agreements to requests, incidents, registration records, training, audits and management review, so the DPO runs the programme from one place and an NPC check sees a live system, not a binder. Sterling consulting clients get their Effivity subscription included with the engagement, at no additional cost.
Processing systems, purposes and retention
Each system recorded with its declared purpose, information categories, retention and disposal, so the three principles are shown per system, not asserted in a policy.
Criteria, consent and sensitive information
The Section 12 criterion behind every system, consent records with wording and date, legitimate-interest assessments and the Section 13 ground for sensitive information.
Requests logged, verified and answered
One log for access, correction, objection, erasure or blocking and portability requests, with identity checks, owners, due dates and the response kept as evidence.
Processors, agreements and transfers
A processor register with agreement status against the IRR's terms, data sharing agreements and transfers abroad with their safeguard.
Organisational, physical and technical measures
A privacy risk register linked to the measures that treat each risk, with access reviews, encryption decisions, disposal records and confidentiality undertakings.
Incidents, the 72-hour clock and the annual report
Each event assessed against the notification conditions, the breach response team alerted, the clock started, notices drafted and the annual summary built from the register.
Screening, assessment and review
A screening step for new systems and changes, likelihood and impact ratings, the DPO's input and controls tracked to completion.
DPO, registration, audits and review
DPO designations, registration and renewal dates, the audit programme, training records linked to Sterling Academy and management review decisions, adapted without code.
What this means at the audit
An NPC compliance check asks for the DPO designation, the registration, the assessments, the privacy manual and the breach records; a client's auditor adds the outsourcing agreement and training records. Effivity shows each on a screen, with dates, owners and evidence attached, and Sustain™ runs in the same workspace, so next year's renewal starts from a system that kept running.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Your inventory, registers and records migrated, not retyped
- Admin and user training for your team
- ISMS, PIMS, QMS and BCMS modules when you add ISO/IEC 27001, ISO/IEC 27701 or other standards
Data Privacy Act client experience
Client letters on file, available on request.
Signed client letters for the Data Privacy Act are available on request. The client feedback wall lists every letter by standard.
Programmes with the Data Privacy Act in scope
Where the Data Privacy Act sits in an integrated programme.
- 01Integrated management systems
BPO and shared services: the Data Privacy Act inside an integrated security and privacy programme
For a Philippine BPO or shared service centre, the Act is usually one layer of a wider programme: ISO/IEC 27001 for information security, ISO/IEC 27701 for privacy management, and GDPR, HIPAA or PCI DSS terms added through client contracts. One inventory feeds the NPC registration, the assessments and client records; one incident procedure meets the 72-hour NPC deadline and each client's notice terms; one internal audit covers every requirement in scope.
Sterling Academy · Data Privacy Act e-learning
Train every employee on the Data Privacy Act, not just the DPO.
Sterling Academy teaches the people who handle personal information every day and those who run the programme: video lessons, practice checkpoints, a final exam and a numbered Certificate of Completion for each learner, verifiable online. Sterling consulting clients benefit from preferential course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
- Data Privacy Act awareness for every employee, the organisation-wide awareness NPC Advisory No. 2017-01 asks the DPO to build
- Practitioner courses for the DPO, Compliance Officers for Privacy and the people who answer requests and handle incidents
- Internal auditor training for the people who will audit the programme, as applicable to your standard, as part of the engagement
- Learner progress by department, ready for an NPC check or a client audit
- New hires trained as they join, so records stay current
- A Sterling consultant reachable when a learner needs one
Where we work
Where Sterling delivers Data Privacy Act (Philippines)
Keep exploring
Explore more about Data Privacy Act (Philippines)
Watch a video on how to comply with Philippines Data Privacy Act here.
Watch a video on Philippines Data Privacy Act requirements here.
Data Privacy Act resources
Services for Data Privacy Act (Philippines)
Why Sterling
Want successful Data Privacy Act compliance? Come to Sterling.
Whether you are a hospital, a lender or a manufacturer putting its privacy programme in order, or a BPO answering an overseas client's due diligence, Sterling builds one Data Privacy Act programme around the way personal information actually moves through your organisation.
Offices in 21 countries, Manila among them
Security and privacy programmes for BPOs, healthcare providers, financial services firms and technology businesses since 2003, with one engagement team accountable for every entity in scope.
All-inclusive proposal
Consulting, Effivity, training and Academy access in one proposal, with certification-body and legal fees identified separately. No surprises, ever.
A programme your people can run
Fewer documents, more control: procedures, training and software tied to the systems people already use, so the DPO manages a programme instead of chasing one.
Expert and experienced consultants
Consultants who have advised on information security and privacy management systems across sectors and countries since 2003 and know what a DPO must defend, so the programme holds when the NPC or a client looks.
The Sterling Promise
What our Data Privacy Act compliance success guarantee means
We stay with you until the agreed Data Privacy Act programme outcome is achieved: the DPO designated and registered where required, assessments complete, manual, notices and agreements in use, controls operating, the breach route rehearsed and your team able to answer the NPC or a client without us. Clear explanations, practical delivery, included software and learning leave a capability, not a shelf of documents.
The engagement defines the entities, systems, scope, outcome and responsibilities. Your organisation provides accurate information about its processing, opens the systems and contracts in scope to review and runs the agreed controls. The National Privacy Commission enforces the Act, and legal interpretation remains with your counsel. Our commitment covers the agreed programme support, not legal advice or a promise that no breach or complaint will occur.
After the programme is in place
What happens after your Data Privacy Act programme is in place?
The programme has its own calendar: registration renewed every year, new systems assessed before launch, the annual incident summary sent to the NPC, requests and incidents reviewed, new staff trained. NPC guidance keeps moving too: in 2026 it has issued advisories on data scraping, on filing breach notifications through its Data Breach Notification Management System and on annual incident reports, and consulted on a draft circular on data subject rights.
Under Sterling OS™ Sustain™ we run that calendar with you, from renewals and new assessments to incident reviews, refresher training and the internal audit, so the programme is current whenever the NPC or a client asks.
FAQs
Frequently asked questions about the Data Privacy Act
Is there a Data Privacy Act certification?
No certificate of compliance with the Act exists. Organisations that register receive an NPC certificate of registration and Seal of Registration, each valid for a year, which show registration, not compliance. NPC Circular No. 2023-05 makes ISO/IEC 27001 and ISO/IEC 27701 certification the prerequisites for the NPC's voluntary Philippine Privacy Mark, assessed by certification bodies. Both standards strengthen your evidence, but neither replaces the decisions the Act requires of you, and accountability stays with you.
Do we have to register with the National Privacy Commission?
Under NPC Circular No. 2022-04 you register your processing systems and DPO if you employ 250 or more people, process sensitive personal information of 1,000 or more individuals, or carry out processing likely to pose a risk to data subjects' rights and freedoms. Registration is online only and renewed yearly, and automated decision-making or profiling must also be notified. Apply the test to each legal entity in a group.
Do we need a Data Protection Officer?
Yes. The IRR requires controllers and processors to designate one, and NPC Advisory No. 2017-01 sets out the role: monitoring compliance, ensuring privacy impact assessments, advising on requests and complaints, managing breaches, building awareness and acting as the contact for data subjects and the NPC. The DPO needs expertise and independence and should not hold a role that decides the purposes and means of processing; Compliance Officers for Privacy can support in branches.
What must we do within 72 hours of a personal data breach?
Where a breach involves sensitive personal information or information usable for identity fraud, and unauthorised acquisition is likely to give rise to a real risk of serious harm, NPC Circular 16-03 requires notice to the NPC and affected data subjects within 72 hours of knowledge or reasonable belief. Delay is allowed only as far as needed to establish the scope, prevent further disclosure or restore system integrity. Every incident is documented and summarised to the NPC annually.
We are a BPO processing data about our clients' foreign customers. Does the Act apply?
Partly, and more than many assume. Section 4 excludes personal information originally collected from residents of foreign jurisdictions under their laws and processed in the Philippines, but the IRR limits the exemption to the minimum extent necessary and keeps the security requirements in force. Employee and applicant data, anything collected locally and your DPO and registration duties are fully in scope. Confirm the analysis with legal counsel.
Does the Act apply to companies outside the Philippines?
It can. Section 6 covers acts done abroad where the information concerns a Philippine citizen or resident and the entity has a link with the country, such as a contract entered there, central management and control there, a local branch, office or subsidiary whose parent or affiliate can access the information, business carried on there, or information collected or held there. Foreign groups with Philippine operations should map those links first.
What are the penalties under the Data Privacy Act?
Chapter VIII makes offences of unauthorised processing, access due to negligence, improper disposal, processing for unauthorised purposes, unauthorised access or intentional breach, concealment of a security breach and malicious or unauthorised disclosure. Each carries imprisonment and a fine, heavier for sensitive personal information: across the chapter, six months to seven years and PHP 100,000 to PHP 5 million, with the maximum applied when at least 100 persons are affected. For companies the penalty falls on the responsible officers who took part or allowed it through gross negligence. The NPC can also issue cease-and-desist orders and administrative fines (NPC Circular No. 2022-01).
Does Sterling give legal advice?
No. Sterling designs and builds the programme, drafts documents, runs the assessments with your teams and trains your people. Interpreting the Act for your facts and approving notices, contracts and positions taken with the NPC rest with your counsel and DPO, and we work beside them.
What do you need to prepare a Data Privacy Act proposal?
Entities, sites and headcount, whether you are controller, processor or both, roughly how many systems and suppliers handle personal information, whether sensitive information is involved and for how many people, what exists today and any deadline. That is enough for a scoped, all-inclusive proposal; the data inventory can wait for the engagement.
Before the first call
Prepare a useful Data Privacy Act readiness brief
No data inventory is needed before the first conversation. Bring a short account of the personal information the business handles and who is asking about it. Seven questions are enough:
- Who is asking, and for what: an NPC letter or compliance check, a client audit or questionnaire, a breach, or your own board?
- Which entities and sites are involved, how many employees does each have, and are you a controller, a processor or both?
- Which systems, cloud services and suppliers hold personal information, and does any leave the Philippines?
- Do you process sensitive personal information, such as health or education records or government-issued identifiers, and for about how many people?
- What exists today: a DPO, an NPC registration, assessments, a privacy manual, agreements, an ISO/IEC 27001 system?
- Who can decide and give time: the DPO, counsel, IT, HR and process owners?
- Is there an NPC deadline, a registration renewal, a client audit or a contract date to plan around?
With these answers the scope and the all-inclusive proposal can be set on facts. They are the basis for a discussion, not a compliance score or a legal opinion.
Don’t be fooled by certification scams
If it takes ten days, it is not Data Privacy Act compliance.
With no certificate of compliance to issue, the market invents substitutes: "DPA certified" badges, a DPO's training certificate presented as company compliance, a registration sold as the whole job, and privacy manuals with another company's name inside. They cost less than a programme until the NPC asks for your assessments or a breach tests the 72-hour route.
How to choose a credible Data Privacy Act provider
- Ask what will exist at the end, from the DPO designation, inventory and assessments to the manual, notices, agreements and trained people, and who produces each.
- Ask exactly what any certificate or seal on offer is. The NPC issues certificates and seals of registration, and its voluntary Philippine Privacy Mark requires ISO/IEC 27001 and ISO/IEC 27701 certification; a "DPA certified" badge from anyone else is not a finding by the NPC.
- Ask how the programme will be built from your real processing, with system owners, HR, IT and your counsel, not from a questionnaire and a template pack.
- Identify who carries each task, which costs are separate, and what support exists when a breach or a compliance check tests the programme.
- Ask what your people will learn and where the records will live. Evidence kept in a consultant's shared drive walks out when the engagement ends.
- Walk away from "DPA compliant in a week", "NPC-approved" seals and a registration filed for you as the entire service. Registration is one obligation; Section 21 makes you accountable for the rest.
Keep exploring
More on Data Privacy Act (Philippines) and related standards
Talk to a consultant
Plan your Data Privacy Act compliance with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice