🇵🇭Philippines

The Philippines privacy framework is built around accountability, proportionality and an active regulator

The Philippines’ data protection regime is anchored by Republic Act No. 10173, the Data Privacy Act of 2012. The Act protects individual personal information in information and communications systems used by both government and private sector organisations. Its policy balance is explicit: protect the fundamental human right of privacy while allowing the free flow of information needed for innovation and growth.

The framework is administered by the National Privacy Commission, an independent body attached to the Department of Information and Communications Technology. The Commission receives complaints, investigates, facilitates settlement, adjudicates, issues cease-and-desist orders, recommends prosecution, approves privacy codes, coordinates with foreign regulators and supports cross-border enforcement.

The three ideas to understand first

Transparency, legitimate purpose and proportionality are the Act’s central privacy principles. Personal information must be collected for specified and legitimate purposes, processed fairly and lawfully, kept accurate where necessary, limited to what is adequate and not excessive, and retained only as long as necessary for the declared purpose or a lawful ground.

Controllers remain accountable. A personal information controller controls collection, holding, processing or use of personal information, including where it instructs another party to process on its behalf. A controller may subcontract processing, but it remains responsible for ensuring proper safeguards and compliance. Accountability continues even where processing is outsourced domestically or internationally.

Sensitive personal information receives stricter treatment. The Act defines sensitive personal information to include data on race, ethnic origin, marital status, age, colour, religious, philosophical or political affiliations, health, education, genetics, sexual life, proceedings for offences, government-issued identifiers and other information classified by law or executive order. Processing this category is prohibited unless a specific exception applies.

How the law works in practice

The Data Privacy Act applies to processing of all types of personal information and to natural and juridical persons involved in personal information processing. It also has extraterritorial reach where processing relates to Philippine citizens or residents, where the entity has a link with the Philippines, or where the entity carries on business in the Philippines or collected or holds the information through an entity in the Philippines.

The Act distinguishes between personal information controllers and personal information processors. The controller decides the purposes and means of processing. The processor handles personal data for the controller. The controller must ensure that processors and third parties apply required safeguards, including security measures and confidentiality obligations.

The Act is not built only around consent. Consent is one lawful basis for ordinary personal information, but processing may also be permitted where necessary for contract, legal obligation, vital interests, national emergency, public order and safety, public authority functions, or legitimate interests not overridden by constitutional rights and freedoms. Sensitive personal information is treated separately and requires one of the specific grounds under section 13.

What organisations should prioritise

Start with purpose mapping. Every collection point should identify the specified and legitimate purpose, the type of personal information being processed, the lawful basis relied on, and whether the data is ordinary personal information, sensitive personal information or privileged information.

Then build a rights and notice workflow. Data subjects have rights to be informed, to access personal information, to dispute inaccuracies, to request suspension, withdrawal, blocking, removal or destruction in appropriate cases, to obtain data portability for electronically processed data in structured formats, and to lodge complaints with the National Privacy Commission.

Finally, test security and breach response. The Act requires reasonable and appropriate organisational, physical and technical measures. Controllers must notify the Commission and affected data subjects where sensitive personal information or information that may enable identity fraud is reasonably believed to have been acquired by an unauthorised person and there is a real risk of serious harm.