🇵🇭Data Privacy Act of 2012

← Back to laws in Philippines

A privacy law built around transparency, legitimate purpose and proportionality

The Philippines Data Privacy Act of 2012, Republic Act No. 10173, is designed to protect individual personal information in information and communications systems used by both government and private sector organisations. Its policy statement is important: the State protects the fundamental human right of privacy while recognising the need for free flow of information to promote innovation and growth.

The Act is therefore not an anti-data law. It is a controlled-processing law. Personal information may be processed, but only where the controller can show a legitimate basis, a specific purpose, proportional collection, appropriate safeguards and respect for the rights of the data subject.

Who the Act covers — and when it reaches outside the Philippines

The Act applies to the processing of all types of personal information and to any natural or juridical person involved in personal information processing. This includes personal information controllers and processors that are not found or established in the Philippines if they use equipment located in the Philippines or maintain an office, branch or agency in the Philippines.

Section 6 extends the Act to acts or practices done outside the Philippines where the processing relates to personal information about a Philippine citizen or resident. It also applies where the entity has a link with the Philippines, such as a contract entered in the Philippines, central management and control in the Philippines, or a branch, agency, office or subsidiary in the Philippines where the parent or affiliate has access to personal information. The law can also apply where the entity carries on business in the Philippines or where the personal information was collected or held by an entity in the Philippines.

The Act also contains exclusions. These include certain information about government officers or contractors relating to their positions or services, certain discretionary government benefits, personal information processed for journalistic, artistic, literary or research purposes, information necessary for public authority functions, and certain financial-sector and foreign-jurisdiction processing contexts. These exclusions should be analysed carefully because they do not remove ordinary commercial processing from the Act simply because a business interacts with government or finance.

Key roles — controller, processor and data subject

The data subject is the individual whose personal information is processed. A personal information controller is the person or organisation that controls the collection, holding, processing or use of personal information, including an organisation that instructs another party to collect, hold, process, use, transfer or disclose personal information on its behalf.

A personal information processor is the person or entity to whom a personal information controller may outsource processing. The controller-processor distinction is operationally important. Section 14 allows subcontracting of processing, but the controller remains responsible for ensuring proper safeguards, confidentiality, prevention of unauthorised use and compliance with the Act.

Section 21 makes the accountability principle explicit. The personal information controller remains responsible for personal information under its control or custody, including information transferred to a third party for processing, whether domestically or internationally. The controller must use contractual or other reasonable means to provide a comparable level of protection while information is being processed by a third party.

Personal information, sensitive personal information and privileged information

Personal information means information, whether recorded in material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or where information put together with other information would directly and certainly identify the individual.

Sensitive personal information includes information about race, ethnic origin, marital status, age, colour, religious, philosophical or political affiliations, health, education, genetics, sexual life, criminal proceedings and government-issued identifiers such as social security numbers, health records, licences and tax returns. It also includes information specifically classified by executive order or by an Act of Congress.

Privileged information refers to data that constitutes privileged communication under the Rules of Court and other laws. Section 15 allows personal information controllers to invoke privileged communication over privileged information they lawfully control or process, subject to existing laws and regulations.

The general data privacy principles

Section 11 allows processing of personal information only subject to compliance with the Act and adherence to the principles of transparency, legitimate purpose and proportionality. These principles are the spine of the law.

Personal information must be collected for specified and legitimate purposes determined and declared before, or as soon as reasonably practicable after, collection. It must later be processed only in a way compatible with those declared purposes. It must be processed fairly and lawfully, kept accurate and up to date where necessary, and inaccurate or incomplete data must be rectified, supplemented, destroyed or restricted from further processing.

The proportionality principle is direct. Personal information must be adequate and not excessive in relation to the purposes for which it is collected and processed. It must be retained only for as long as necessary for the fulfilment of the purpose, for legal claims, for legitimate business purposes, or as provided by law.

Lawful processing of ordinary personal information

Section 12 permits processing of ordinary personal information only if it is not otherwise prohibited by law and at least one recognised condition exists. These include consent, necessity for contract or pre-contractual steps, compliance with legal obligation, protection of vitally important interests including life and health, national emergency, public order and safety, fulfilment of public authority functions, or legitimate interests pursued by the controller or a third party where those interests are not overridden by the data subject's fundamental rights and freedoms under the Philippine Constitution.

This means the Act does not require consent for every processing activity. But the chosen basis must match the actual processing. A controller relying on contract cannot quietly extend processing into unrelated marketing. A controller relying on legitimate interests must still consider whether constitutional rights and freedoms override the controller's interests.

Sensitive personal information — prohibited unless an exception applies

Section 13 starts from a stricter rule: processing sensitive personal information and privileged information is prohibited except in specified cases. Processing may be allowed where the data subject has given specific consent before processing, or where existing laws and regulations provide for the processing and guarantee protection.

Other permitted grounds include necessity to protect life and health where the data subject cannot legally or physically express consent, processing necessary for the lawful and non-commercial objectives of public organisations and associations with safeguards, medical treatment by a medical practitioner or medical treatment institution with adequate protection, and processing necessary for legal claims, court proceedings, or provision to government or public authority.

For practical compliance, sensitive personal information should not be treated as a normal customer field. It needs purpose control, stricter access, stronger security, and a documented legal ground before collection or use begins.

Data subject rights

Section 16 gives data subjects the right to be informed whether personal information about them is being, will be or has been processed. Before personal information enters a processing system, or at the next practical opportunity, the data subject must be furnished with information such as the description of personal information, processing purposes, scope and method of processing, recipients or classes of recipients, automated access methods where applicable, identity and contact details of the controller or representative, retention period and the existence of rights including access, correction and complaint to the Commission.

Data subjects also have a right to reasonable access to the contents of their processed personal information, sources from which it was obtained, names and addresses of recipients, manner of processing, reasons for disclosure, information on automated processes, dates of last access and modification, and the identity and contact information of the controller.

Section 18 provides the right to data portability where personal information is processed electronically and in a structured and commonly used format. The data subject may obtain a copy of data undergoing processing in an electronic or structured format that allows further use.

Section 19 limits the application of some rights where personal information is used only for scientific and statistical research under strict confidentiality and no decisions are taken about the data subject, or where information is gathered for investigations relating to criminal, administrative or tax liabilities.

Security and breach notification

Section 20 requires personal information controllers to implement reasonable and appropriate organisational, physical and technical measures to protect personal information against accidental or unlawful destruction, alteration, disclosure and other unlawful processing. Security must also address natural dangers such as accidental loss or destruction, and human dangers such as unlawful access, fraudulent misuse, unlawful destruction, alteration and contamination.

The appropriate level of security must account for the nature of the personal information, risks represented by processing, organisation size, operational complexity, current privacy best practices and implementation cost. Measures must include network safeguards, a security policy, vulnerability identification and mitigation processes, and regular monitoring for security breaches.

Section 20 also requires controllers to ensure that third parties processing personal information on their behalf implement the required security measures. Employees, agents and representatives involved in processing must maintain strict confidentiality for non-public personal information, and that duty continues after leaving service, changing position or termination of employment or contractual relations.

The breach notification rule is focused on serious-risk situations. The controller must promptly notify the National Privacy Commission and affected data subjects when sensitive personal information or other information that may enable identity fraud is reasonably believed to have been acquired by an unauthorised person, and the controller or Commission believes that such unauthorised acquisition is likely to create a real risk of serious harm. Notification must describe the nature of the breach, the sensitive personal information possibly involved and the measures taken to address the breach.

Government systems and large datasets

The Act imposes specific requirements for sensitive personal information maintained by government. Heads of government agencies and instrumentalities are responsible for securing such information using appropriate standards recognised by the information and communications technology industry and recommended by the Commission.

Off-site access or transport of sensitive personal information held by government is restricted. Where access is approved, the head of the agency must limit access to no more than one thousand records at a time, and technology used to store, transport or access such information must use secure encryption standards recognised by the Commission.

Section 24 extends obligations to government contractors. Where a contract involves access to sensitive personal information from one thousand or more individuals, the agency must require the contractor and its employees to register their personal information processing system with the Commission and comply with the Act.

Penalties — criminal exposure is built into the Act

The Data Privacy Act contains criminal penalties for several violations. These include unauthorised processing of personal information and sensitive personal information, negligent access, improper disposal, processing for unauthorised purposes, unauthorised access or intentional breach, concealment of security breaches involving sensitive personal information, malicious disclosure and unauthorised disclosure.

The penalties include imprisonment and fines, with higher ranges for sensitive personal information. Where the personal information of at least one hundred persons is harmed, affected or involved, section 35 requires the maximum penalty in the applicable scale. Where the offender is a public officer acting in the exercise of duties, section 36 adds disqualification from public office for a term double the criminal penalty imposed.