Data Privacy Act Philippines: Rights, Duties, and Penalties

The Data Privacy Act of the Philippines, Republic Act No. 10173, is the country’s primary law on how personal information about Philippine residents is collected, stored, used, and shared. It applies to nearly every organization that handles such data, gives individuals eight enforceable rights over their own information, and backs its rules with criminal penalties of up to six years in prison and fines reaching ₱4 million. The National Privacy Commission (NPC) enforces the law and can investigate complaints, issue cease-and-desist orders, and recommend prosecution.

Who the Law Reaches

The Act applies to any person or organization that processes personal data, whether based inside the Philippines or abroad. It draws a line between personal information controllers, who decide how and why data is processed, and personal information processors, who handle data on a controller’s behalf under specific instructions.¹

Its reach extends beyond Philippine borders. A foreign company falls under the law if it uses equipment located in the Philippines, maintains a local office or branch, or processes the personal data of Philippine residents. Servers or staff sitting in another country do not create an escape hatch. The protections follow the data subject, not the organization’s address.²

Processors carry their own obligations. If a processor subcontracts to another party, the processor remains responsible for any violation by that subcontractor. A controller is liable for a subcontractor’s actions only if the controller’s specific instructions led to the violation.¹

Section 4 carves out situations the law does not cover, and it is worth knowing them because a common assumption is that every use of personal data is regulated. Information about a public officer’s title, office address, work phone number, salary range, and job responsibilities is not protected, and the same applies to government contractors’ service-related information. Processing for journalistic, artistic, literary, or research purposes is exempt. Data processed by the central monetary authority, law enforcement, and regulatory agencies to carry out their constitutionally mandated roles falls outside the law, and the Secrecy of Bank Deposits Act and the Foreign Currency Deposit Act are expressly preserved. Financial institutions processing data to comply with the Credit Information System Act or the Anti-Money Laundering Act are exempt. Personal information first collected from residents of other countries under those countries’ laws, and merely processed in the Philippines, is not covered. And an individual who collects or uses personal information purely for personal, family, or household purposes is not treated as a controller.¹

What Information Is Protected

The law recognizes three categories of protected data, each with a different level of restriction.

Personal information is the broadest. It covers any data that can identify someone directly, or that combined with other data would certainly identify them. Names, home addresses, email addresses, and phone numbers are typical examples.¹

Sensitive personal information gets stricter protection because disclosure can cause serious harm. It includes identity characteristics (race, ethnic origin, marital status, age, color, and religious or political affiliations), health and legal records (medical history, genetic data, sexual life, education records, and information on criminal proceedings or alleged offenses), and government-issued identifiers (SSS numbers, tax identification numbers, health records, and professional licenses, including denials, suspensions, or revocations). Processing sensitive data is prohibited by default and permitted only under narrow exceptions.³

Privileged information covers communications protected by the Rules of Court or other statutes because of a professional relationship, such as conversations between lawyer and client or between doctor and patient during treatment.³

When Data Processing Is Lawful

Processing personal information is legal only when at least one of six bases in Section 12 applies: the data subject has consented; the processing is necessary to perform a contract with the data subject or to take steps the subject requested toward one; the controller must process the data to comply with a legal obligation; the processing protects the data subject’s life or health; the processing responds to a national emergency, public safety need, or public authority mandate; or the controller or a third party has a legitimate interest that is not overridden by the data subject’s constitutional rights and freedoms. At least one basis must exist before collection begins.¹

Sensitive personal information and privileged information face a higher bar. Processing is generally prohibited unless a narrower exception applies: the data subject gave prior consent for a specific legitimate purpose, an existing law authorizes the processing without consent, the processing is necessary to protect life or health when the subject cannot consent, a medical professional needs the data for treatment, or the data is needed for court proceedings or legal claims.²

Whatever the basis, the processing must be transparent about what is collected and why, tied to a legitimate declared purpose, and proportionate. Collecting more data than the purpose requires, or keeping it longer than needed, violates the law even when there was a valid basis for collecting the data in the first place.²

What Counts as Valid Consent

Consent is the most commonly used basis, and NPC Circular No. 2023-04 sets detailed rules for it. Consent must be freely given, meaning no pressure or adverse consequences for refusing. It must be specific to each declared purpose; if data will be used for several unrelated purposes, the organization has to let the data subject choose among them rather than bundling everything into one agreement. It must be informed, delivered in plain language the subject can understand. It must be shown through a clear affirmative action — silence, pre-ticked boxes, and implied consent do not count. And it must be evidenced in written, electronic, or recorded form. Consent can be withdrawn at any time, and withdrawal must be as easy as giving it.⁴

Your Rights as a Data Subject

The Act gives individuals eight enforceable rights. If an organization refuses to honor them, you can file a complaint with the NPC.

Right to be informed. Before your data enters a processing system, you must be told what is being collected, why, and who will receive it.
Right to object. You can refuse processing for direct marketing, automated profiling, or other purposes. Once you object, the organization must stop unless a legal obligation requires otherwise.
Right to access. You can demand a copy of your personal data along with details on how it was obtained, who received it, and how it was processed.
Right to correct. If your data is inaccurate, incomplete, or outdated, you can require immediate correction.
Right to erasure or blocking. You can order suspension, removal, or destruction of your data from a filing system, particularly when it is no longer needed or was obtained unlawfully.
Right to damages. You are entitled to compensation for harm caused by false, incomplete, outdated, unlawfully obtained, or unauthorized use of your data.
Right to data portability. You can obtain your personal data in a commonly used, machine-readable format such as XML, JSON, or CSV, and have it transmitted to another organization. This applies when the processing was based on consent or a contract and was done electronically.

The right to be informed and the right to access come directly from the statute and its implementing rules.⁵ The portability right is limited to information you actively provided (such as your name and address) and data observed through your use of a service (such as transaction history or location).⁶

What Organizations Must Do

Appoint a Data Protection Officer

Every organization that processes personal data must designate a Data Protection Officer. The DPO is the primary contact for privacy matters, coordinates with the NPC, and is responsible for ensuring Privacy Impact Assessments are run to identify and reduce risks in processing activities.⁷

Register with the NPC When Thresholds Apply

Registration with the NPC is mandatory for any organization that meets one of these conditions:

Employs 250 or more people.
Processes sensitive personal information of 1,000 or more individuals.
Processes data likely to pose a risk to data subjects’ rights and freedoms.
Is a government agency or instrumentality.

Organizations that fall below these thresholds may register voluntarily.⁸

Put Security Measures in Place

Controllers must adopt organizational, physical, and technical safeguards against accidental or unlawful destruction, alteration, disclosure, and other unauthorized processing. At minimum, the law requires safeguards against unauthorized network access, a written security policy, a process for identifying vulnerabilities and responding to incidents, and regular monitoring for breaches. The appropriate level of security depends on the nature of the data, the risks involved, the organization’s size, current best practices, and cost.³

Employees, agents, and representatives involved in processing must keep personal information strictly confidential. The duty continues after they leave the organization, transfer roles, or end their contract.³

Report Data Breaches Within 72 Hours

Notification is mandatory when three conditions are all present: the breach involves sensitive personal information or data that could enable identity fraud, there is reason to believe an unauthorized person acquired the information, and the unauthorized access is likely to create a real risk of serious harm.⁹

Both the NPC and the affected data subjects must be notified within 72 hours of the organization learning about the breach. No delay is permitted when at least 100 data subjects are affected or when sensitive personal information that could harm the individual is involved; the initial notification must go out within the 72-hour window based on the information available, followed by a full report within five days. Every controller and processor must have a breach response team with defined responsibilities, alongside preventive safeguards.¹⁰

Protect Data Sent Overseas

A controller remains responsible for personal data even after transferring it to a third party abroad, and must use contractual or other reasonable means to ensure the receiving party provides comparable protection.³ The NPC has published Model Contractual Clauses that organizations may include in their agreements. Adoption is voluntary and the NPC will not review individual contracts, but organizations remain obligated to ensure whatever mechanism they choose meets the law’s protection standard. The NPC recognizes several international frameworks as reference points, including ASEAN MCCs, EU Standard Contractual Clauses, and the UK International Data Transfer Agreement.¹¹

Penalties for Violations

The Act imposes criminal sanctions, not just administrative ones. The penalty scales with the type of data and the nature of the violation.

Unauthorized processing of personal information carries one to three years in prison and fines between ₱500,000 and ₱2 million. When sensitive personal information is involved, the penalty rises to three to six years and fines between ₱500,000 and ₱4 million.³

Negligent access carries the same penalties as unauthorized processing. If an organization’s carelessness lets an unauthorized person reach personal data, the responsible individuals face one to three years for ordinary personal information, or three to six years for sensitive data, with the same fine ranges.³

Improper disposal of personal data in publicly accessible areas carries six months to two years and fines between ₱100,000 and ₱500,000 for ordinary data, and one to three years and fines between ₱100,000 and ₱1 million for sensitive data.³

Processing for unauthorized purposes and intentional or malicious disclosure carry additional penalties under later sections of the law, with imprisonment reaching up to five or six years depending on the offense. Concealing a security breach from the NPC or affected data subjects is itself a criminal act.¹ When the offender is a corporation, the penalty falls on the officers who participated in or knowingly allowed the violation.

Beyond prosecution, the NPC can issue Cease and Desist Orders that require an organization to stop processing immediately when continued processing would expose data subjects to grave and irreparable harm such as identity theft, fraud, or reputational damage. The authority is drawn from Section 7 of the Act, Section 9 of the Implementing Rules, and NPC Circular 2020-02.¹²

How to File a Complaint With the NPC

If you believe your rights under the Act have been violated, download the complaint affidavit form from the NPC website, fill it out, have it notarized, and submit it in person, by courier, or by emailing a scanned copy to complaints@privacy.gov.ph.¹³

Before filing, gather documentation of the alleged violation: any communications with the organization, evidence of the processing in question, and records of any harm you suffered. The NPC publishes a schedule of fees for complaint processing under NPC Circular No. 2023-01. Because the law grants a right to damages, a substantiated complaint may entitle you to compensation on top of any penalties imposed on the organization.

1
National Privacy Commission. Republic Act 10173 – Data Privacy Act of 2012
2
Supreme Court E-Library. IRR of Republic Act No. 10173 – Implementing Rules and Regulations
3
The Lawphil Project. Republic Act 10173 – Data Privacy Act of 2012
4
National Privacy Commission. NPC Circular No. 2023-04 – Guidelines on Consent
5
National Privacy Commission. Rights of a Data Subject
6
National Privacy Commission. Right to Data Portability
7
National Privacy Commission. Appointing a Data Protection Officer
8
National Privacy Commission. Frequently Asked Questions on Registration and Compliance
9
National Privacy Commission. Breach Management and Reporting
10
National Privacy Commission. NPC Circular 16-03 – Personal Data Breach Management
11
National Privacy Commission. Model Contractual Clauses for Cross-Border Transfers of Personal Data
12
National Privacy Commission. NPC Issues Cease and Desist Order Against Tools for Humanity
13
National Privacy Commission. Filing Formal Complaints