Philippines · Compliance
Philippine Data Privacy Act compliance in the Philippines
Achieve Philippine Data Privacy Act compliance with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- Compliance, end to end
- Manila office team
- Effivity software included
- Academy training included
Who asks for Philippine Data Privacy Act in the Philippines
Clients include
Philippine Data Privacy Act compliance in the Philippines at a glance
Data Privacy Act of 2012 (Republic Act No. 10173) is the instrument itself: it applies to the organisations within its scope, and buyers and partners in the Philippines ask for evidence that you meet it.
Republic Act No. 10173, the Data Privacy Act of 2012, reaches further than many companies expect. It applies to the processing of all types of personal information, including by controllers and processors not established in the Philippines that use equipment located there or maintain an office, branch or agency in the country, and it extends to processing that relates to Philippine citizens or residents. The National Privacy Commission administers and enforces it. At its core is a security duty: controllers must implement reasonable and appropriate organisational, physical and technical measures to protect personal information. Compliance is not a certificate; it is a set of documented decisions, controls and records that the Commission can ask to see. For BPOs, banks, hospitals and platforms, the practical work covers a data inventory, privacy impact assessments, accountable officers, breach procedures and privacy notices. Sterling delivers this from its Manila office and, where clients want a certifiable framework, aligns it with ISO/IEC 27701.
Who needs Philippine Data Privacy Act in the Philippines, and what happens without it
These are the organisations in the Philippines that most often need to show Philippine Data Privacy Act.
- BPOs and shared-service centres processing foreign clients' personal dataThe Act applies to processors in the Philippines and to entities with an office, branch or agency there.
- Banks, e-money issuers and fintechsBSP Circular No. 982 lists the Data Privacy Act among the laws the information security programme must consider.
- Hospitals, clinics and health-information servicesThey process sensitive personal information about patients.
- Foreign companies processing data of Philippine citizens or residentsThe Act has extraterritorial reach in defined cases.
Not sure which of these applies to you?Answer a short set of questions and your readiness report arrives by e-mail.
Take the Data Privacy Act (Philippines) readiness checkPhilippine Data Privacy Act requirements in the Philippines
Strip away the vocabulary and the Philippine Data Privacy Act requires an organisation to comply in six areas of personal information processing.
In the Philippines these six sit alongside the local laws and regulations listed under drivers below; one system can evidence both. The detail is on the global hub: Philippine Data Privacy Act explained →
How to achieve Philippine Data Privacy Act compliance in the Philippines
One team from the Manila office carries the work from scoping to sign-off. Metro Manila and other Philippine sites, on-site from the Makati office; remote delivery for distributed teams.
- Discovery call and scopeEntities, locations, regulators and target date, agreed before any proposal.
- Gap assessment against Philippine Data Privacy Act and the Philippine requirements that apply to youControls you already run for your regulators and customers are reused, not rebuilt.
- Your system built with your team in EffivityRisks, controls, evidence, incidents and reviews in one live system the auditor can see.
- Internal audit, management review and corrective actionsYour internal auditors trained by Sterling; the evidence proven before any external review.
- Reviews by regulators, customers and auditorsSterling supports the reviews your regulators, customers and auditors run.
- End to end, from one team
- Effivity ISO & GRC software
- Preferential Sterling Academy access, with complimentary awareness training for your people
- Internal auditor training for your audit team, as applicable to your standard
- Vulnerability assessment on ISMS engagements
The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements.Sterling does not certify. Certification decisions stay with independent bodies.
How long does Philippine Data Privacy Act compliance take in the Philippines?
There is no standard duration: it depends on your scope and on how much of the system already runs. In the Philippines these are the factors that set the timeline.
- Number of processing systems, sites and outsourcing relationships
- Volume of sensitive personal information processed
- State of existing inventories, notices and breach procedures
Sterling agrees a dated plan with you on the discovery call, once the scope is known.
How much does Philippine Data Privacy Act compliance cost in the Philippines?
The cost has two parts: the consulting work to build and prove the system, and any external assessor’s fees, which are quoted separately. In the Philippines these factors move both.
- Number of business units and processing activities to map
- Privacy impact assessments required
- Training volume across shifts
Sterling gives one customised, all-inclusive proposal after the discovery call, never before the scope is agreed.
Philippine Data Privacy Act consultants and assessors in the Philippines
Two different organisations are involved. A consultant helps you build the system and prove it works; your regulators, customers and auditors then audits or assesses it and decides. Keeping the two separate is what makes the result credible to buyers and regulators.
- Check that the body’s accreditation or approval covers Philippine Data Privacy Act and your sector, and that its certificates can be verified online.
- Ask the consultant how the local requirements in the Philippines are mapped into the same system, so nothing runs twice.
- Ask for client references in your sector; Sterling’s client letters are available on request.
- Agree who owns the evidence and the tool after the engagement; with Sterling the system stays yours, in Effivity.
Laws and regulations that drive Philippine Data Privacy Act in the Philippines (2)
| Instrument | How it treats the standard |
|---|---|
| Data Privacy Act of 2012 (Republic Act No. 10173) | The instrument itself Compliance obligations for personal information controllers and processors; administered and enforced by the National Privacy Commission. |
| BSP Circular No. 982, Series of 2017 | Related Lists the Data Privacy Act of 2012 among the laws BSFIs must consider in designing their information security programme. |
Accreditation, audit language and remote audits in the Philippines
Compliance, not certification: the National Privacy Commission administers and enforces the Act and does not issue compliance certificates. ISO/IEC 27701 certification by an accredited body can evidence a privacy management system but does not replace the Act's obligations. Edition and transition details: Philippine Data Privacy Act hub →
Audit language
Notices and policies are usually in English; consider Filipino versions where data subjects need them.
Remote and on-site
Compliance work combines remote document review with on-site process walkthroughs.
Philippine Data Privacy Act in the Philippines: questions clients ask
Does the Data Privacy Act apply to a foreign company?
Possibly. Under the Act's scope note, controllers and processors not established in the Philippines are covered if they use equipment located there or maintain an office, branch or agency there, and it can reach processing outside the country tied to Philippine citizens or residents. Take advice from your counsel.
Is there a Data Privacy Act certification?
No. The National Privacy Commission administers and enforces the Act, and there is no Data Privacy Act certification that proves compliance. ISO/IEC 27701 is a separate certifiable standard that can evidence a privacy management system, but it does not replace the Act's obligations. Confirm what the Commission expects of you with your counsel.
What security does the Act require?
The Act requires controllers to implement reasonable and appropriate organisational, physical and technical measures to protect personal information. It does not prescribe a particular framework and does not require ISO certification. Decide what is reasonable for your processing with your counsel.
More on Philippine Data Privacy Act for Philippine organisations
Other standards Philippine businesses ask Sterling for
Organisations in the Philippines often combine Philippine Data Privacy Act with one of these, under one management system where the scopes allow.
Start with a free discovery call from the Manila office
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Data Privacy Act of 2012 (Republic Act No. 10173) — privacy.gov.ph (accessed 5 Oct 2026)
- BSP Circular No. 982, Series of 2017 — bsp.gov.ph (accessed 5 Oct 2026)
Talk to a consultant
Plan your certification with the Manila team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
philippines@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice