There is no single penalty for every privacy violation or data breach. Criminal liability under RA 10173, Sections 25–33 depends on the specific offense. Section 25 sets the unauthorized-processing ranges; Section 28 can reach seven years for unauthorized purposes involving sensitive personal information. NPC administrative fines and compensation are separate consequences, not automatic results of every incident. Start by identifying the conduct, data involved and applicable authority.
Is the Data Privacy Act a criminal case?
It can be, but it is not only that. RA 10173 creates genuine crimes — Sections 25 to 33 each carry imprisonment and a fine — so a privacy violation can end in a criminal conviction. It is a mistake, though, to assume that every privacy complaint is a criminal case. The same facts can produce a criminal prosecution, an NPC administrative penalty and a civil claim for compensation, and these proceed under different rules, before different bodies, with different standards of proof.
The table below separates the three tracks.
| Track | What it decides | Who handles it | What it can impose |
|---|---|---|---|
| Criminal | Whether a specific offence under RA 10173 Sections 25–33 was committed, proved beyond reasonable doubt. | The NPC may investigate and recommend prosecution; the Department of Justice prosecutes and a court decides. | Offense-specific imprisonment and fines. Section 28 reaches seven years; Section 33 has a separate ₱5 million fine ceiling. |
| Administrative | Whether a personal information controller or processor broke RA 10173, its IRR or an NPC issuance. | The National Privacy Commission, under its own rules of procedure. | Administrative fines under NPC Circular No. 2022-01, plus compliance, cease-and-desist and other orders. |
| Civil | Whether the data subject is entitled to be compensated for the harm suffered. | The NPC may award indemnity under Section 7(b); courts decide separate claims for damages. | Indemnity or damages. Section 37 states that restitution is governed by the New Civil Code. |
Two practical consequences follow. First, an NPC decision and fine is not a criminal conviction, and a company that pays an administrative fine has not thereby been convicted of anything. Second, dropping or settling one track does not automatically end the others.
Who prosecutes a Data Privacy Act case — the NPC or the DOJ?
The NPC investigates and adjudicates; the DOJ prosecutes. Section 7(b) of RA 10173 empowers the Commission to receive complaints, institute investigations, facilitate settlement, adjudicate and award indemnity. Section 7(i) empowers it to recommend to the Department of Justice (DOJ) the prosecution and imposition of penalties. The Commission therefore cannot send anyone to prison on its own; the criminal track begins when the matter reaches prosecutors, who decide whether to file a case in court.
For an NPC complaint, normally first notify the organization in writing and retain proof of receipt. Under Rule II, Section 2 of the NPC Rules, the relevant alternatives are failure to take timely or appropriate action, or no response within 15 calendar days. The NPC may waive the requirement for properly alleged and proved good cause or a serious violation with the specified risk of harm. This is not an unconditional instruction to wait through ongoing harm. Use the official complaint requirements and attach the relevant facts, evidence and notice history.
Related: how to file a data privacy complaint with the NPC, and your data privacy rights under RA 10173.
What is the penalty for data privacy in RA 10173?
There is no single penalty. For improper disposal of personal information, Section 27(a) prescribes 6 months to 2 years and ₱100,000–₱500,000. Section 28 reaches 2–7 years and ₱500,000–₱2 million for processing sensitive personal information for unauthorized purposes. Section 33 separately prescribes 3–6 years and ₱1–₱5 million for a combination or series of acts. Do not combine the highest imprisonment term from one offense with the highest fine from another and call it a universal penalty. Verify the applicable section in the Act.
Three provisions can raise the exposure further. Under Section 34, where the offender is a corporation, partnership or other juridical person, the penalty is imposed on the responsible officers who participated in the offence or allowed it through gross negligence. Under Section 35, the maximum penalty in the scale applies when the personal information of at least one hundred (100) persons is harmed. Under Section 36, a public officer additionally suffers disqualification from public office for double the term of the criminal penalty.
The offence-by-offence table below sets out every range, and the NPC administrative fines section covers the separate regulatory track.
What is the penalty for unauthorized processing of personal information?
Under Section 25 of RA 10173: unauthorized processing of personal information carries 1–3 years of imprisonment and a ₱500,000–₱2 million fine. For sensitive personal information, the range is 3–6 years and ₱500,000–₱4 million. These are the Section 25 ranges, not a single penalty for every privacy violation. Whether an offense is established depends on the facts and applicable legal authority for processing; lack of consent alone does not settle that question.
Check RA 10173, Section 25, then use the offense-by-offense table or the privacy complaint guide.
Other privacy violations: Violating the Philippine Data Privacy Act can lead to criminal penalties, administrative fines, and potentially other legal consequences depending on the offense. Republic Act No. 10173 sets specific imprisonment terms and monetary fines for acts such as unauthorized processing, negligent access, improper disposal, processing for unauthorized purposes, intentional breaches, concealment of certain security breaches, malicious disclosure, and unauthorized disclosure. Separately, the National Privacy Commission (NPC) may impose administrative fines under NPC Circular No. 2022-01.
Primary authority: Republic Act No. 10173 — Data Privacy Act of 2012; see also NPC Circular No. 2022-01 on administrative fines.
Evidence and Action
| Decision point | What to verify or do |
|---|---|
| Two systems | Criminal penalties under RA 10173 and NPC administrative fines are different enforcement tracks with different elements and procedures. |
| Not every breach is a crime | A breach, mistake or complaint does not automatically establish a criminal offense. The particular statutory act, mental state, evidence and defenses matter. |
| Administrative exposure | Covered PICs and PIPs may face administrative sanctions under current NPC rules even when a criminal conviction has not been established. |
| Responsible officers | Corporate structure does not automatically prevent personal exposure where a responsible officer participated in an offense or gross negligence falls within the statutory rule. |
| Evidence | Preserve processing records, access logs, policies, notices, contracts, incident records, decisions, remediation and communications with affected people or regulators. |
| Source gate | Verify the offense and range directly against RA 10173, its IRR and the current NPC administrative-fine issuance cited below. |
Choose Your Route
- Individual or complainant: identify the conduct and evidence before selecting a complaint or criminal route.
- Business or officer: preserve records, contain continuing harm and obtain advice before making admissions.
- Breach case: use the separate notification and incident-response guides; do not treat the penalties table as the response plan.
Key Takeaways
- There is no single universal fine for violating the Data Privacy Act.
- Different offenses under RA 10173 carry different imprisonment and fine ranges.
- Offenses involving sensitive personal information often carry heavier penalties than offenses involving ordinary personal information.
- A combination or series of prohibited acts can lead to penalties of 3 to 6 years imprisonment and ₱1 million to ₱5 million in fines (RA 10173).
- The NPC may also impose administrative fines on Personal Information Controllers and Personal Information Processors.
- For a single act resulting in one or multiple administrative infractions, NPC Circular No. 2022-01 states that the total imposable administrative fine shall not exceed ₱5 million.
- Responsible corporate officers may face criminal liability when they participated in, or through gross negligence allowed, the offense.
Jump to a Section
- Is it a criminal case?
- Who prosecutes: NPC or DOJ
- Penalties under RA 10173
- Quick penalty table
- Unauthorized processing
- Negligent access
- Improper disposal
- Unauthorized purposes
- Unauthorized access or intentional breach
- Concealment of a security breach
- Malicious and unauthorized disclosure
- NPC administrative fines
- Company and officer liability
- FAQs
Decision Snapshot
| Question | Practical Answer |
|---|---|
| Can a Data Privacy Act violation lead to imprisonment? | Yes. Specific criminal offenses under RA 10173 carry imprisonment. |
| Can fines reach millions of pesos? | Yes. Depending on the offense, statutory criminal fines can reach several million pesos. |
| Are sensitive-data offenses treated more seriously? | Often, yes. Several statutory penalty ranges are higher. |
| Can the NPC impose fines even outside criminal prosecution? | Yes. NPC Circular No. 2022-01 establishes administrative fines. |
| Can a company officer be personally liable? | Potentially, yes. RA 10173 addresses responsible officers who participate in or grossly negligently allow an offense. |
| Does every privacy mistake automatically mean jail? | No. The particular statutory offense, facts, intent or negligence, and applicable proceedings matter. |
Quick Table: Criminal Penalties Under RA 10173
| Offense | Imprisonment | Fine |
|---|---|---|
| Unauthorized processing — personal information | 1 to 3 years | ₱500,000 to ₱2,000,000 |
| Unauthorized processing — sensitive personal information | 3 to 6 years | ₱500,000 to ₱4,000,000 |
| Negligent access — personal information | 1 to 3 years | ₱500,000 to ₱2,000,000 |
| Negligent access — sensitive personal information | 3 to 6 years | ₱500,000 to ₱4,000,000 |
| Improper disposal — personal information | 6 months to 2 years | ₱100,000 to ₱500,000 |
| Improper disposal — sensitive personal information | 1 to 3 years | ₱100,000 to ₱1,000,000 |
| Processing for unauthorized purpose — personal information | 1 year 6 months to 5 years | ₱500,000 to ₱1,000,000 |
| Processing for unauthorized purpose — sensitive personal information | 2 to 7 years | ₱500,000 to ₱2,000,000 |
Source: RA 10173, Sections 25–28.
Access, Concealment and Disclosure Offenses
| Offense | Imprisonment | Fine |
|---|---|---|
| Unauthorized access or intentional breach | 1 to 3 years | ₱500,000 to ₱2,000,000 |
| Concealment of qualifying security breach | 1 year 6 months to 5 years | ₱500,000 to ₱1,000,000 |
| Malicious disclosure | 1 year 6 months to 5 years | ₱500,000 to ₱1,000,000 |
| Unauthorized disclosure — personal information | 1 to 3 years | ₱500,000 to ₱1,000,000 |
| Unauthorized disclosure — sensitive personal information | 3 to 5 years | ₱500,000 to ₱2,000,000 |
| Combination or series of acts under Sections 25–32 | 3 to 6 years | ₱1,000,000 to ₱5,000,000 |
These are statutory ranges. The actual consequence in a real case depends on the offense charged, evidence, applicable defenses, and the outcome of the relevant proceedings.
1. Unauthorized Processing of Personal Information
Processing personal information without consent or another lawful authorization can be a criminal offense under Section 25 of RA 10173.
For ordinary personal information, the statutory penalty is 1 to 3 years imprisonment and a fine of ₱500,000 to ₱2 million.
For sensitive personal information, the range increases to 3 to 6 years imprisonment and ₱500,000 to ₱4 million.
This does not mean that every instance where consent is absent is automatically criminal. Consent is not the only lawful basis for processing. The question is whether the processing was authorized under RA 10173 or another applicable law.
2. Accessing Personal Information Due to Negligence
Section 26 penalizes situations where, because of negligence, unauthorized access to personal information is provided.
For ordinary personal information, the penalty is 1 to 3 years imprisonment plus ₱500,000 to ₱2 million.
For sensitive personal information, the range is 3 to 6 years imprisonment plus ₱500,000 to ₱4 million.
This is particularly important for businesses because a privacy problem does not need to result from deliberate theft. Weak access controls, careless credential handling, or negligent system administration can create serious legal exposure depending on the facts.
3. Improper Disposal of Personal Information
Section 27 addresses knowingly or negligently discarding or abandoning personal information in a publicly accessible area or placing it in a container for trash collection in the manner described by the law.
For ordinary personal information, the penalty is 6 months to 2 years imprisonment and ₱100,000 to ₱500,000.
For sensitive personal information, the penalty is 1 to 3 years imprisonment and ₱100,000 to ₱1 million.
Examples of risky conduct can include throwing unshredded customer files, employee records, medical records, identification copies, or account documents into ordinary public trash where they may be accessed.
4. Processing for Unauthorized Purposes
Section 28 applies where personal information is processed for a purpose that is not authorized by the data subject or otherwise permitted by the Data Privacy Act or existing law.
For ordinary personal information, the statutory range is 1 year and 6 months to 5 years imprisonment and a fine of ₱500,000 to ₱1 million.
For sensitive personal information, the range is 2 to 7 years imprisonment and ₱500,000 to ₱2 million.
A company that collected data for one legitimate purpose should not assume that it may automatically repurpose that information for an unrelated use.
5. Unauthorized Access or Intentional Breach
Section 29 penalizes knowingly and unlawfully breaking into a system where personal or sensitive personal information is stored, including conduct that violates data confidentiality and security.
The statutory penalty is 1 to 3 years imprisonment and a fine of ₱500,000 to ₱2 million.
Depending on the facts, the same incident may also raise issues under the Cybercrime Prevention Act or other laws.
6. Concealment of Certain Security Breaches
Section 30 penalizes a person who knows of a security breach and knows of an obligation to notify the National Privacy Commission under the applicable provision, but intentionally or by omission conceals the breach.
The statutory penalty is 1 year and 6 months to 5 years imprisonment and a fine of ₱500,000 to ₱1 million.
This is not the same as every late or disputed breach notification. The statutory offense has specific elements, including knowledge of the breach and the notification obligation.
7. Malicious Disclosure
Section 31 applies to a Personal Information Controller, Personal Information Processor, or their officials, employees, or agents who, with malice or in bad faith, disclose unwarranted or false information relating to personal or sensitive personal information obtained by them.
The penalty is 1 year and 6 months to 5 years imprisonment and ₱500,000 to ₱1 million.
8. Unauthorized Disclosure
Section 32 separately penalizes disclosure to a third party without the data subject’s consent in the circumstances covered by that section.
For ordinary personal information, the statutory range is 1 to 3 years imprisonment and ₱500,000 to ₱1 million.
For sensitive personal information, the range is 3 to 5 years imprisonment and ₱500,000 to ₱2 million.
Whether a disclosure is actually unauthorized still requires examination of the applicable lawful basis, statutory authority, and surrounding facts.
9. Combination or Series of Privacy Offenses
Section 33 provides a separate penalty where there is a combination or series of acts defined in Sections 25 to 32.
The statutory penalty is 3 to 6 years imprisonment and a fine of ₱1 million to ₱5 million.
This provision matters in complex incidents where conduct may involve multiple stages—for example, unlawful collection followed by unauthorized use and disclosure.
NPC Administrative Fines
Criminal penalties are not the only possible consequence. NPC Circular No. 2022-01 establishes an administrative-fine framework for Personal Information Controllers and Personal Information Processors that violate RA 10173, its Implementing Rules and Regulations, or applicable NPC issuances.
Grave Infractions
NPC Circular No. 2022-01 provides for administrative fines of 0.5% to 3% of the annual gross income of the immediately preceding year for specified grave infractions. These include certain violations of general privacy principles or data-subject rights affecting more than 1,000 data subjects, as well as repetition of the same infraction covered by the Circular.
Major Infractions
Specified major infractions may result in administrative fines of 0.25% to 2% of annual gross income of the immediately preceding year.
Examples listed by the Circular include certain violations affecting 1,000 or fewer data subjects, failure to implement reasonable and appropriate security measures, failure to ensure appropriate security by third-party processors, and certain failures to notify the NPC and affected data subjects of a personal data breach.
The percentage ranges above come from NPC Circular 2022-01, Section 2. They are not a fixed invoice for every breach, and an administrative fine is not compensation paid to the affected person.
Maximum Administrative Fine for a Single Act
NPC Circular No. 2022-01 states that the total imposable administrative fine for a single act of a PIC or PIP, whether resulting in single or multiple infractions, shall not exceed ₱5 million.
The actual administrative fine depends on the classification of the infraction and the factors specified by the NPC.
Can Failure to Report a Data Breach Result in a Fine?
Yes, when notification is required and the applicable conditions are met. The NPC’s current breach-reporting guidance states that a failure to notify the NPC and affected data subjects as required under Section 20(f), when not punishable as concealment under Section 30, can be administratively liable for a fine equivalent to 0.25% to 2% of the annual gross income of the immediately preceding year.
This is why organizations should have a documented breach-assessment and notification process rather than deciding informally whether an incident is serious enough to report.
Can Company Officers Be Personally Liable?
Potentially, yes. Section 34 of RA 10173 provides that when an offender is a corporation, partnership, or other juridical person, the criminal penalty is imposed on responsible officers who participated in the crime or, through gross negligence, allowed its commission.
This means corporate structure does not automatically shield every decision-maker from personal criminal exposure.
Can Foreigners Be Deported After a Conviction?
RA 10173 provides that if an offender is an alien, the person may be deported after serving the imposed sentence, without further proceedings, subject to the wording and application of the statute.
Can Public Officials Face Additional Consequences?
The Data Privacy Act also contains provisions addressing offenses committed by public officers or employees. Depending on the offense and circumstances, additional consequences involving disqualification from public office may apply.
Do Administrative Fines Replace Criminal Penalties?
No. Administrative and criminal consequences arise under different enforcement mechanisms. An administrative fine does not automatically mean a criminal offense has been established, and criminal liability requires the applicable legal elements and proceedings.
A single incident can also create other exposure, such as contractual claims, employment consequences, regulatory orders, or civil claims, depending on the facts.
Does Every Data Breach Mean Someone Will Be Fined?
No. A data breach and a proven violation are not automatically the same thing.
An investigation may consider factors such as the safeguards in place, how the incident happened, the type of information involved, how quickly the organization responded, whether notification obligations applied, and whether the organization complied with applicable privacy requirements.
For the broader violation analysis, see What Counts as a Data Privacy Violation in the Philippines?
What Should a Business Do After a Potential Violation?
- Contain the incident. Stop ongoing unauthorized access, disclosure, or processing where possible.
- Preserve evidence. Keep logs, emails, system records, notices, audit trails, screenshots, and incident timelines.
- Identify the data involved. Determine whether ordinary personal information or sensitive personal information was affected.
- Determine the roles involved. Identify the PIC and any PIP.
- Assess notification requirements. Review current NPC breach-notification rules.
- Document decisions. Record why the organization took—or did not take—specific actions.
- Correct the root cause. Fix security, access-control, policy, retention, training, or vendor-management failures.
What Should an Individual Do If Their Data Was Misused?
Preserve evidence before deleting messages, posts, emails, or account records. Consider contacting the organization or its Data Protection Officer and clearly identify the information and conduct involved.
You may also have relevant data privacy rights under RA 10173, including the right to file a complaint with the National Privacy Commission in qualifying circumstances.
Prepare a Privacy Incident Fact Sheet
This optional preparation aid helps a data subject, DPO or adviser separate facts from possible legal consequences. It is not an official complaint form, a fine calculator or a finding of liability. Keep it privately with securely stored supporting records.
- Conduct and dates: What was collected, accessed, used, disclosed, lost or concealed? Separate what you observed from what you suspect.
- Data and people: List the types of information, why any may be sensitive, and the supported count of affected people. Mark unknown facts as unknown.
- Authority and roles: Identify the organization, PIC/PIP roles, stated purpose, consent or other claimed lawful basis, and people involved in the decisions.
- Evidence: Record where originals, messages, logs, notices and contracts are kept, who holds them and when copies were made. Do not obtain evidence by accessing accounts or systems without authority.
- Response and harm: Record containment, continuing exposure, actual harm, notice to the organization, proof of receipt and its response.
- Next route: For a complaint, prepare the NPC complaint materials. For an organizational incident, promptly assess breach notification with the DPO. For potential criminal exposure or compensation, obtain advice on the specific offense, remedy and evidence.
Example: A customer list sent to the wrong recipient is not enough, by itself, to select a criminal sentence or administrative percentage. Establish the data types, authorization, safeguards, access, response and harm first. Notification assessment and containment should proceed without waiting for a final liability finding.
Frequently Asked Questions
Is the Data Privacy Act a criminal case?
It can be. Sections 25 to 33 of RA 10173 are criminal offences carrying imprisonment and fines. The same facts can also give rise to an NPC administrative case and a separate civil claim for compensation, so a privacy matter is not automatically — or only — a criminal case.
What is the penalty for data privacy in RA 10173?
It depends on the offense. Section 25 sets separate unauthorized-processing ranges for personal and sensitive personal information. Section 28 can reach seven years for unauthorized purposes involving sensitive information, while Section 33 carries 3–6 years and ₱1–₱5 million for a combination or series of acts. No one range applies to every privacy incident.
Does the National Privacy Commission send people to jail?
No. The NPC investigates, adjudicates and may impose administrative fines. Under Section 7(i) it may recommend prosecution to the Department of Justice, which decides whether to bring a criminal case. Only a court can convict and impose imprisonment.
Do I have to complain to the company before going to the NPC?
Normally, notify the organization in writing and keep proof. Rule II, Section 2 covers inadequate action or no response within 15 calendar days and permits NPC waiver for good cause or qualifying serious harm. Explain and support any request for waiver; it is not automatic.
What is the maximum criminal fine under the Data Privacy Act?
For a combination or series of acts under Sections 25 to 32, Section 33 provides a fine of up to ₱5 million, together with imprisonment of 3 to 6 years. Individual offenses have their own ranges.
Can someone go to jail for violating RA 10173?
Yes. Sections 25 to 33 establish imprisonment for specific criminal offenses.
What is the penalty for unauthorized processing of personal information?
For ordinary personal information, Section 25 provides 1 to 3 years imprisonment and a fine of ₱500,000 to ₱2 million. The statutory range is higher for sensitive personal information.
What is the penalty for leaking sensitive personal information?
The applicable offense must first be identified. For unauthorized disclosure under Section 32(b), the statutory range is 3 to 5 years imprisonment and ₱500,000 to ₱2 million.
Can the National Privacy Commission fine a company?
Yes. NPC Circular No. 2022-01 establishes administrative fines applicable to covered PICs and PIPs.
Can an employee be personally liable for a privacy violation?
Potentially. Several criminal provisions expressly refer to officials, employees, or agents, while the exact liability depends on the conduct and statutory offense.
Is failure to notify the NPC about a breach punishable?
Potentially, yes. Depending on the circumstances, it may create administrative liability, and intentional concealment of a qualifying security breach can fall under Section 30.
Are administrative fines based on company revenue?
For grave and major infractions under NPC Circular No. 2022-01, the fine ranges are expressed as percentages of the annual gross income of the immediately preceding year, subject to the Circular’s rules and limits.
Official Sources
- Republic Act No. 10173 — Data Privacy Act of 2012, National Privacy Commission
- Implementing Rules and Regulations of RA 10173 — National Privacy Commission
- NPC Circular No. 2022-01 — Guidelines on Administrative Fines
- NPC Breach Reporting Guidance
- Mechanics for Complaints — National Privacy Commission
- 2021 Rules of Procedure of the NPC, as amended — National Privacy Commission
Related Cybercode Guides
- Data Privacy Act of 2012 Philippines: Complete Guide to RA 10173
- Data Privacy Rights in the Philippines
- What Is Personal Information Under the Data Privacy Act?
- What Is Sensitive Personal Information Under RA 10173?
- Personal Information Controller vs Personal Information Processor
- What Counts as a Data Privacy Violation in the Philippines?
Sources rechecked as of: October 5, 2026
Disclaimer
Important: This article provides general educational information about Philippine law, regulation, cybersecurity, technology, or business compliance. It is not legal advice and does not create an attorney-client relationship. Laws, agency procedures, technical standards, platform rules, and the facts of each situation may change the result. Verify current requirements through the cited official sources and seek qualified professional advice when your rights, deadlines, money, safety, or legal exposure may be affected.