Last materially reviewed: September 21, 2026
Direct answer
Philippine employers may use AI to support hiring, performance and disciplinary processes, but they should not treat an opaque score as the final decision. The Data Privacy Act applies to applicant and employee data, including profiling and automated decision-making. Employment decisions must also remain tied to legitimate, documented standards and—where discipline or dismissal is involved—substantive and procedural due process. Use meaningful notice, data minimization, validation, human review and a channel to correct errors.
Where AI leads to roles being abolished rather than redesigned, see the future of Philippine BPO jobs with AI for the redundancy rules and next steps.
Authority-to-action bridge
| Question | Cybercode answer |
|---|---|
| What the authority says | RA 10173 and NPC rules govern profiling and automated decision-making; labor law governs valid grounds and due process. |
| What it means | Buying an AI tool does not shift responsibility for a discriminatory, inaccurate or unsupported employment decision. |
| What changes the answer | Risk depends on the data used, role of the score, effect on the person, accuracy, validation and availability of genuine human review. |
| What to do next | Map the decision, test the system, disclose material processing and require a trained human to verify the facts before action. |
Key takeaways
- Resume ranking, video analysis, productivity scoring and misconduct detection can all process personal data.
- A human who merely approves the AI recommendation without checking it is not meaningful oversight.
- Sensitive attributes and proxies can create unfair results even when the model does not ask directly about sex, age, disability or health.
- Disciplinary notices should state actual facts and policy violations, not only an algorithmic risk score.
- Applicants and employees need a way to correct inaccurate data and challenge material errors.
Privacy duties and employment due process
The Data Privacy Act requires lawful, transparent and proportionate processing. The NPC rules on registration and automated decision-making systems are relevant when processing produces decisions with legal or similarly significant effects.
The NPC AI guidelines emphasize accountability, fairness, transparency, privacy by design, security and data-subject rights. Employers should document the tool’s purpose, data sources, limitations, vendor role and review process.
AI does not create a new ground for dismissal. If discipline or termination is contemplated, the employer still needs a lawful ground, evidence and the applicable notice and opportunity-to-explain process.
Evidence to preserve
The employer should be able to reconstruct why a person was screened out, flagged or disciplined.
- Job-related criteria and validation records for the role.
- Data fields, inferred attributes, model version and vendor documentation.
- Applicant or employee notices and policy acknowledgments.
- Human review notes, corrected records and alternative evidence.
- Notices to explain, responses, investigation records and final decision reasons.
What to do next
- Identify every AI or algorithmic system influencing employment decisions.
- Classify the decision’s impact and the personal or sensitive data used.
- Run a privacy impact assessment and job-related bias or error testing.
- Give understandable notice and a method to access or correct relevant data.
- Prohibit fully automated adverse decisions unless a clearly supported legal and governance basis exists.
- Require trained human reviewers to examine source evidence and record independent reasons.
- Audit outcomes and suspend the system when errors or unjustified disparities appear.
Common mistakes
- Calling a system merely a productivity tool when it materially influences discipline.
- Using facial, voice or emotion inference without strong necessity and validation.
- Letting a vendor refuse all explanation while the employer still acts on the score.
- Copying the AI output into a notice to explain without investigating facts.
Frequently asked questions
Can an applicant demand the source code?
Not necessarily. Transparency does not always require disclosure of proprietary source code, but the person should receive meaningful information about the processing and have a route to correct data or challenge a material error.
Can AI detect employee dishonesty?
AI may flag patterns, but a probabilistic signal is not proof of misconduct. Investigate the underlying records and allow the employee to respond.
Is employee consent enough?
Consent in employment can be problematic where refusal is not genuinely free. Employers should identify the proper lawful basis and still satisfy necessity, proportionality, security and transparency duties.
Related Cybercode guides
- AI Governance Framework for Philippine Businesses
- AI and Data Privacy Philippines
- ChatGPT and AI at Work
Official sources
- Republic Act No. 10173 — Data Privacy Act
- NPC Circular No. 2022-04
- NPC AI Guidelines
- Labor Code provisions as amended by RA 6715
Important: This article provides general educational information about Philippine law, regulation, cybersecurity, technology, or business compliance. It is not legal advice and does not create an attorney-client relationship. Laws, agency procedures, technical standards, platform rules, and the facts of each situation may change the result. Verify current requirements through the cited official sources and seek qualified professional advice when your rights, deadlines, money, safety, or legal exposure may be affected.