Start here for the law: This is CyberCode’s main guide to the Philippine Data Privacy Act—its scope, rights, duties, breaches, offenses and remedies. If you are deciding whether a specific act may be unlawful, see what counts as a data privacy violation.
What is RA 10173?
Republic Act No. 10173, or the Data Privacy Act of 2012, governs the processing of personal information in the Philippines and certain processing connected to the Philippines. It establishes data-subject rights, duties for organizations and individuals that control or process data, regulatory authority for the National Privacy Commission, and criminal penalties for specified violations.
How should I read RA 10173?
Read the Act by the question you need to answer. Start with Section 3 for definitions and Sections 4–6 for scope. Then read Sections 11–13 for processing principles and lawful grounds, Sections 16–19 for rights and limits, Sections 20–21 for security and accountability, and Sections 25–37 for offenses and related penalty provisions.
Read the full text of RA 10173. Apply it with the relevant implementing rules and NPC issuances; a section heading alone does not resolve a specific case.
What does the Data Privacy Act require?
The Data Privacy Act does not prohibit all collection or use of personal information. It requires processing to satisfy the principles of transparency, legitimate purpose, and proportionality and to have an applicable lawful basis. Organizations must protect data, respect enforceable rights, and remain accountable for processing performed on their behalf.
For the broader topic map covering rights, complaints, breaches, CCTV, AI and organizational duties, see Cybercode’s Data Privacy Philippines hub.
Evidence and action
RA 10173 in 60 seconds
| Question | Short answer |
|---|---|
| What does RA 10173 regulate? | The processing of personal information, including duties for controllers and processors and enforceable rights for data subjects. |
| What are the core principles? | Transparency, legitimate purpose and proportionality. |
| Is consent always required? | No. The correct lawful basis depends on the type of information and purpose; sensitive personal information is subject to the stricter conditions in Section 13. |
| What rights do individuals have? | Rights include being informed, access, objection, correction, qualifying erasure or blocking, damages and data portability where applicable. |
| What must organizations do? | Use appropriate security, control processors, provide privacy information, manage retention, respond to rights requests and assess breach-notification duties. |
| Who enforces the law? | The National Privacy Commission administers and enforces the Data Privacy Act; specified violations can also carry criminal penalties through the courts. |
Who and what the law covers
PIC versus PIP: A personal information controller decides the purpose and essential means of processing; a personal information processor handles data on the controller’s instructions. For example, a retailer is ordinarily the controller for its customer orders, while a contracted hosting or payroll provider may be a processor for work done on that retailer’s behalf. A provider may also be a controller for its own independent purposes. Outsourcing does not remove the PIC’s duty to require proper safeguards.
| Role | Practical responsibility under RA 10173 |
|---|---|
| Personal information controller (PIC) | Decides why and how data is processed, chooses the lawful basis and notice, handles rights and breach decisions, and remains accountable for an outsourced processor. |
| Personal information processor (PIP) | Processes data on a PIC’s instructions, secures it, limits use and access, and promptly assists with incidents and requests under the arrangement. |
The Act applies to the processing of personal information by natural and juridical persons, subject to statutory scope rules and exclusions. It can also apply to an entity outside the Philippines when the processing concerns a Philippine citizen or resident and the entity has specified links to the Philippines.
| Term | Practical meaning |
|---|---|
| Data subject | The individual whose personal information is processed |
| Personal information | Information from which a person’s identity is apparent or can reasonably be ascertained, alone or with other information |
| Sensitive personal information | Statutorily protected categories such as specified health, education, government, sexual-life, genetic, and related information |
| Personal information controller (PIC) | The person or organization that controls the collection, holding, processing, or use of personal information |
| Personal information processor (PIP) | A person or organization to which a PIC outsources processing |
What counts as sensitive personal information?
RA 10173 section 3(l) includes these categories; privileged information is defined separately and also receives stricter treatment under section 13.
- Race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations.
- Health, education, genetic or sexual life, and proceedings concerning offenses or alleged offenses, their disposition or sentence.
- Government-issued information peculiar to an individual, including social security numbers, relevant health records, licenses and their denial or revocation, and tax returns.
- Information an executive order or Act of Congress specifically classifies.
The three general data-privacy principles
- Transparency: the data subject should understand the nature, purpose, and extent of processing.
- Legitimate purpose: processing must serve a declared and lawful purpose.
- Proportionality: the information processed should be adequate, relevant, suitable, necessary, and not excessive for the purpose.
Is consent always required?
Under RA 10173, consent is not always required to process ordinary personal information. Section 12 also recognizes lawful processing for contract performance, legal obligations, vital interests, national emergency or public-order functions, and legitimate interests that do not override the data subject’s rights and freedoms. Sensitive personal information and privileged information remain subject to the stricter conditions in Section 13, so a personal information controller must identify the correct statutory condition rather than treat legitimate interest as a universal shortcut.
Section 12 lawful bases besides consent for ordinary personal information:
- Necessity for a contract with the individual or requested steps before a contract.
- Compliance with a legal obligation of the controller.
- Protection of vitally important interests, including life and health.
- Response to a national emergency, requirements of public order and safety, or fulfillment of functions of public authority.
- Legitimate interests of the controller or a recipient, unless overridden by the individual’s fundamental rights and freedoms.
Match the chosen basis to a specific purpose and document why it applies. Sensitive and privileged information follows the narrower section 13 exceptions; legitimate interests under section 12 is not a general basis for it. A lawful basis never removes the duty to give appropriate privacy information and protect the data.
Rights of data subjects
- To be informed about processing
- To access specified information about their data
- To object, subject to lawful exceptions
- To dispute and correct inaccuracies
- To suspend, withdraw, block, remove, or destroy data in circumstances recognized by law
- To receive compensation for damage caused by inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal information
- To data portability where its legal and technical conditions apply
These rights are not absolute deletion-on-demand powers. Other laws, legal claims, contracts, public functions, and statutory retention duties can affect the result. See the National Privacy Commission guide for complaint and enforcement context.
Duties of controllers and processors
- Use appropriate organizational, physical, and technical security measures
- Limit access to people with a legitimate need and authority
- Control processors through accountable arrangements
- Give understandable privacy information: explain the nature, purpose and extent of processing so people can exercise their rights.
- Set defensible retention and disposal rules
- Respond to data-subject requests
- Assess security incidents and provide required notifications
- Demonstrate compliance, not merely claim it
When does a company need a privacy notice?
For any processing of personal data, the PIC should give appropriate notice before processing or at the next practical opportunity, whether it relies on consent, another lawful basis under sections 12 or 13, or an applicable special case. Under NPC Circular 2023-04, a separate notice for a specific activity is unnecessary when its consent form already gives the essential information. A privacy notice informs people; it is not itself consent.
What should a Philippine privacy notice include?
- The PIC’s identity and contact details, with a usable privacy or DPO contact.
- The categories of data collected and the specific purposes and lawful criteria for each activity.
- The scope and method of processing, including relevant automated access or decisions.
- Recipients or classes of recipients, including processors and material sharing or transfers.
- How long the information is kept or the criteria used to set the period.
- The individual’s rights and how to make an access, correction, objection or other request.
- A clear link or layered explanation at the collection point and before a new purpose where applicable.
These items draw on the right to information in RA 10173 section 16 and NPC transparency guidance. Tailor the notice to actual practices; see the privacy-notice guide.
Common company mistakes to check
- Using a generic copied notice that omits tracking, HR, CRM or vendor data flows.
- Calling every processing activity “consent” when the actual basis is contract or legal obligation, or bundling unrelated optional uses into a required form.
- Collecting IDs or sensitive information without a necessary, documented purpose and section 13 condition.
- Giving staff shared administrator access, leaving former users active, or storing exports indefinitely.
- Assuming a cloud vendor alone handles rights requests or breach reporting.
- Ignoring a written access or correction request and failing to document the response.
The data-privacy compliance checklist turns these duties into an operational review.
Personal data breaches
How the 72-hour rule works: (1) identify and contain the incident while preserving records; (2) determine whether sensitive personal information or other identity-fraud enabling data may have been acquired by an unauthorized person and whether the PIC believes there is a real risk of serious harm; (3) record when the PIC or PIP knew of or reasonably believed a personal data breach occurred; (4) if all mandatory notification conditions are met, submit available facts through the NPC DBNMS within 72 hours and notify affected data subjects under NPC rules; (5) update the same case and document remediation. Not every security alert is notifiable; even a non-notifiable incident should be recorded and assessed for annual reporting.
What belongs in the NPC breach notice?
- Controller or representative, DPO or other accountable contact; dates of occurrence and discovery if known.
- Nature, cause and chronology of the incident; affected system and vulnerability.
- Why the mandatory notification conditions are met, including unauthorized acquisition and serious-harm risk.
- Categories of personal and sensitive data, types of affected people, and estimated number of people and records.
- Likely consequences, containment and recovery measures, and action to prevent recurrence.
- How and when affected data subjects were or will be informed, and assistance or harm-reduction advice.
The NPC breach-reporting page describes the current form and procedures. Mark unknown facts as pending and submit information available within the applicable deadline.
For a Philippine personal data breach that meets the notification threshold, the personal information controller must notify the National Privacy Commission and affected data subjects within the applicable 72-hour period from knowledge of or reasonable belief that a personal data breach has occurred, under NPC rules. The notification should identify the nature of the breach, the information involved, likely consequences, measures taken, and the responsible contact person. See the National Privacy Commission breach-management guidance for the applicable reporting requirements.
Not every security incident requires public or regulatory notification. The PIC must assess the type of information involved, the likelihood of unauthorized acquisition, the real risk of serious harm, and the notification rules issued by the National Privacy Commission. Organizations should preserve incident logs, containment actions, affected-system records, risk assessments, notices, and decision grounds.
Is the Data Privacy Act a criminal case?
Short answer: The Data Privacy Act is a law, not a case. Filing a privacy complaint with the National Privacy Commission (NPC) does not automatically create a criminal case. Some defined acts under RA 10173, such as unauthorized processing or disclosure, carry criminal penalties. The NPC evaluates complaints and may forward records to the Department of Justice with a recommendation to prosecute when criminal charges are warranted; guilt and penalties are decided through the criminal process, not by the fact that someone filed an NPC complaint. See the NPC complaint mechanics and RA 10173, Chapter VIII.
Next step: If your personal data was mishandled, check the NPC filing steps and evidence requirements. If you need the possible penalty for a specific act, use the offense-by-offense penalty guide; a privacy violation alone does not establish a crime.
Criminal offenses under the Act
Penalties are offense-specific. Chapter VIII of RA 10173 includes imprisonment and fines for defined criminal acts; an ordinary error or complaint does not by itself prove a crime. Examples:
- Unauthorized processing of ordinary personal information: 1–3 years’ imprisonment and ₱500,000–₱2 million fine; for sensitive personal information: 3–6 years and ₱500,000–₱4 million (section 25).
- Negligently allowing unauthorized access: 1–3 years and ₱500,000–₱2 million for ordinary data; 3–6 years and ₱500,000–₱4 million for sensitive data (section 26).
- Improper disposal: 6 months–2 years and ₱100,000–₱500,000 for ordinary data; 1–3 years and ₱100,000–₱1 million for sensitive data (section 27).
- Unauthorized access or intentional breach: 1–3 years and ₱500,000–₱2 million (section 29). Concealment of a reportable breach involving sensitive data: 1 year and 6 months–5 years and ₱500,000–₱1 million (section 30).
Other statutory offenses include processing for unauthorized purposes and malicious or unauthorized disclosure. Administrative fines, orders, civil damages and criminal prosecution are distinct routes; consult the exact section and current NPC issuances for a particular case.
| Offense group | Core issue |
|---|---|
| Unauthorized processing | Processing without consent or another lawful authorization |
| Access due to negligence | Negligently enabling unauthorized access |
| Improper disposal | Discarding personal or sensitive information in an accessible manner |
| Processing for unauthorized purposes | Using lawfully obtained data for an unauthorized purpose |
| Intentional breach | Knowingly and unlawfully breaking into a system containing personal or sensitive information |
| Concealment | Concealing a security breach involving sensitive personal information where notification is required |
| Malicious or unauthorized disclosure | Disclosing information under the separate elements stated by the Act |
Not every privacy complaint is a criminal case. The information, processing activity, actor, purpose, authority, mental state, harm, and statutory offense must be identified separately.
Decision path for a possible violation
- Identify the exact information and the individual it concerns.
- Determine whether it is personal, sensitive, or privileged information.
- Identify the PIC, PIP, employees, recipients, and other participants.
- Specify the processing: collection, storage, access, use, disclosure, transfer, alteration, or disposal.
- Find the applicable lawful basis and declared purpose.
- Test transparency, legitimate purpose, proportionality, security, and accountability.
- Preserve the privacy notice, consent record, request, response, logs, messages, and proof of harm.
- Choose the appropriate organizational, NPC, civil, criminal, labor, or sector-specific route.
Frequently asked questions
How can a person file a complaint with the National Privacy Commission?
- Write first to the organization: describe the privacy violation or breach and keep proof of delivery and its response. The NPC’s exhaustion rule generally requires giving it an opportunity to act; a lack of timely or appropriate action, or no response within 15 calendar days, is relevant.
- Preserve evidence: collect the notice, requests, replies, screenshots, transaction records and witness affidavits where applicable.
- Prepare the formal filing: use the NPC complaint form and current instructions, complete it and have it notarized, or prepare a verified complaint; attach supporting evidence and proof of prior written notice.
- Submit through an accepted channel: the NPC lists in-person, registered mail, courier or authorized email submission. Check its current filing page for the address, format, fees and any procedural updates.
A complaint is different from an organization’s own breach notification. The NPC complaint mechanics explain who may complain and why an incomplete filing can be dismissed.
Does the Data Privacy Act apply to individuals?
It can, depending on the processing and the statute’s exclusions. Personal or household activity should not be confused with business, professional, public, or systematic processing.
Can a company process data without consent?
Potentially, if another lawful criterion applies and the processing still complies with the general principles and other requirements.
Can someone demand deletion of all records?
Not automatically. Erasure or blocking depends on the legal ground, while lawful retention duties and the establishment or defense of legal claims may matter.
Can a victim claim damages?
Section 16 recognizes a right to indemnification for specified harm. A claim still requires a lawful basis, proof, causation, and the appropriate forum.
Who enforces the law?
The National Privacy Commission administers and implements the Act, investigates complaints, issues orders, and performs other statutory and regulatory functions. Criminal cases follow the applicable prosecutorial and judicial process.
Apply RA 10173 to one data use: a reusable worksheet
Use one copy for each purpose, rather than giving an entire database a single label such as “consent.” This is an editorial planning aid, not an NPC form or a compliance certificate. Record categories and evidence references; avoid copying actual customer records into the worksheet.
- Activity and owner: [What will happen to the data? Who decides why? Who processes it for them?]
- Data and people: [Whose data? Which fields? Ordinary, sensitive or privileged information?]
- Purpose and necessity: [Specific result sought; why each field is needed; whether a less intrusive method works.]
- Legal condition: [Exact Section 12 or 13 condition; facts supporting it; consent record or applicable legal provision, where relevant.]
- Notice and recipients: [Where people are informed; staff, vendors or others receiving access; purpose of each disclosure.]
- Retention and safeguards: [Retention reason and review point; applicable legal hold or statutory duty; access restrictions and disposal method.]
- Decision and follow-up: [Proceed, change the design, or seek clarification; responsible person; unresolved questions and review date.]
Legal basis for the exercise: RA 10173, Sections 11–14, 16 and 20–21 address purpose, lawful processing, outsourcing, information rights, security and accountability. IRR Sections 18–19 explain proportionality and retention. The worksheet’s format and decision labels are our recommendations.
Worked example: delivery details are not a blank permission for marketing
Hypothetical: A shop collects a buyer’s name, mobile number and address to deliver an order. For information needed to fulfil that purchase contract, the shop would assess Section 12(b). Its record should explain which fields the delivery needs and who receives them.
The shop later proposes uploading the same contact list to an advertising service. Create a separate worksheet for that proposed use: the delivery purpose does not by itself establish that advertising is necessary for the purchase contract. Identify an applicable lawful condition, assess compatibility and transparency, and check recipient access before proceeding. If the proposal includes sensitive information, identify a Section 13 condition; “legitimate interests” under Section 12 is not a substitute.
Next action: Choose one real workflow and complete the blanks with its actual owner. Mark an unverified legal basis or retention rule as unresolved; do not invent a universal retention period. Use the compliance checklist for the wider operational review.
Turn the answer into action
First steps for a small Philippine business:
- List every place customer, employee and applicant personal data is collected, stored, shared and deleted, including paper records and cloud vendors.
- Name the person responsible for privacy, assess DPO and system-registration requirements for your circumstances, and record whether you act as PIC, PIP or both for each workflow.
- For each processing purpose, identify the applicable section 12 or 13 condition, minimize the data and set a retention rule.
- Give an accurate notice at collection points, document vendor arrangements, and establish a way to respond to data-subject requests.
- Secure accounts with individual access and MFA where available, patch systems, train staff, test backups and prepare a breach decision and DBNMS access process.
- Review the full compliance checklist and update the record when tools, purposes or vendors change.
Primary legal authorities
The controlling legal texts for this CyberCode guide are Republic Act No. 10173 and the Implementing Rules and Regulations of the Data Privacy Act. Read these primary sources when the precise statutory wording, an exception, or a procedural requirement affects a specific decision.
Related guides: Data Privacy Act penalties, privacy impact assessments, and privacy-notice requirements.
This guide provides general legal information, not legal advice. Criminal, administrative, civil, and regulatory liability depends on the evidence and the precise statutory elements.