Last materially reviewed: September 2, 2026
Direct Answer: The Data Privacy Act of 2012, officially Republic Act No. 10173, is the principal Philippine law protecting personal information processed by government agencies, businesses, organizations, and other covered persons. The law establishes rules for collecting, using, storing, sharing, securing, and otherwise processing personal data. It also gives individuals enforceable privacy rights, establishes responsibilities for organizations handling personal information, creates the National Privacy Commission (NPC), and provides criminal and administrative consequences for certain violations.
Primary authority: Republic Act No. 10173 — Data Privacy Act of 2012 (National Privacy Commission).
Key Takeaways
- Republic Act No. 10173 is the Data Privacy Act of 2012.
- The law applies to many government and private-sector organizations processing personal information.
- The National Privacy Commission administers and implements the Philippine data privacy framework.
- Personal information and sensitive personal information receive legal protection, but different rules may apply depending on the data and processing involved.
- Consent is important, but it is not the only possible lawful basis for processing personal information.
- Individuals have rights over personal data relating to them.
- Organizations handling personal data must observe privacy principles and implement appropriate organizational, physical, and technical safeguards.
- Unauthorized processing, improper disclosure, negligent access, concealment of certain security breaches, and other prohibited conduct may result in consequences under the Act.
- The NPC may also impose administrative sanctions and fines under applicable regulations.
Jump to a Section
- What is the Data Privacy Act?
- Who does it apply to?
- What information does it protect?
- PIC vs PIP
- Does processing always require consent?
- What rights do data subjects have?
- What must businesses do?
- What counts as a violation?
- What are the penalties?
- What should you do if your rights are violated?
Decision Snapshot
| Question | Practical Answer |
|---|---|
| Is RA 10173 the Philippine Data Privacy Act? | Yes. |
| Does it apply only to large corporations? | No. Coverage depends on the processing and circumstances, not simply company size. |
| Does it apply to government agencies? | Yes, subject to the Act’s scope and exceptions. |
| Does every use of personal information require consent? | No. Other lawful bases can apply. |
| Do individuals have rights over their personal information? | Yes. |
| Can organizations outsource processing? | Yes, but outsourcing does not eliminate accountability. |
| Can violations result in fines? | Yes. Criminal penalties and administrative fines may apply depending on the violation. |
| Who regulates Philippine data privacy? | The National Privacy Commission. |
What Is the Data Privacy Act of 2012?
The Data Privacy Act of 2012 is Republic Act No. 10173. It was approved on August 15, 2012 and established a national framework for protecting individual personal information while recognizing the importance of information flows to innovation and economic development.
RA 10173 also created the National Privacy Commission, the Philippine regulator responsible for administering and implementing the country’s data privacy framework.
The law should be read together with its Implementing Rules and Regulations, NPC circulars, advisories, decisions, and applicable court decisions.
Why Was RA 10173 Created?
Modern organizations routinely collect information such as names, addresses, phone numbers, identification details, financial information, employee records, account information, online activity, and health information. RA 10173 establishes rules intended to balance the protection of individual privacy with the legitimate flow and use of information.
For individuals, this means greater control and legal protection concerning personal information. For organizations, it means personal-data processing cannot simply be treated as an unrestricted business asset.
Who Does the Data Privacy Act Apply To?
The Act generally applies to the processing of personal information by natural and juridical persons covered by its scope, including organizations in both the public and private sectors.
Depending on the circumstances, this may include businesses, employers, schools, hospitals, online platforms, e-commerce companies, banks, professional organizations, government agencies, contractors, software providers, outsourcing businesses, and other entities processing personal information.
The Act also contains specific scope provisions and exclusions. Coverage therefore needs to be determined from the actual processing activity rather than simply asking whether an organization is located in the Philippines.
What Information Does the Data Privacy Act Protect?
Personal Information
Personal information generally means information from which an individual’s identity is apparent or can reasonably and directly be determined, or which, when combined with other information, would directly and certainly identify that person.
Examples may include a person’s name together with identifying details, home address, personal email address, telephone number, customer information, employee records, account details, and identifiers connected with a particular individual.
Sensitive Personal Information
RA 10173 separately identifies sensitive personal information. This category includes specified information concerning matters such as a person’s race or ethnic origin, marital status, age, religious or political affiliations, health, education, genetic or sexual life, certain criminal proceedings, and particular information issued by government agencies that is peculiar to an individual.
Sensitive personal information is subject to stricter processing requirements.
Personal Information vs Sensitive Personal Information
| Issue | Personal Information | Sensitive Personal Information |
|---|---|---|
| Identifies an individual | Yes | Yes |
| Protected by RA 10173 | Yes | Yes |
| Has defined lawful processing conditions | Yes | Yes |
| Generally receives heightened legal treatment | Not necessarily | Yes |
| Examples | Contact and customer information | Health, certain government, education and similar protected information |
Personal Information Controller vs Personal Information Processor
A Personal Information Controller (PIC) is generally the person or organization that determines what personal information is collected or determines the purpose or extent of its processing. In simple terms, the controller decides why and how the personal data will be processed.
A Personal Information Processor (PIP) processes personal data on behalf of or under the instructions of a PIC. Examples may include a payroll provider, cloud platform, customer-support provider, data-processing contractor, or another outsourced technology service.
PIC = decides the purpose or extent of processing.
PIP = processes personal data on the PIC’s instructions.
Outsourcing processing does not automatically remove the controller’s accountability for the personal data under its control or custody.
What Does Processing Personal Information Mean?
Processing is much broader than simply collecting information. It can include collection, recording, organization, storage, updating, modification, retrieval, consultation, use, consolidation, blocking, erasure, and destruction.
This means privacy obligations can apply throughout the data lifecycle, not only when information is originally collected.
Does the Data Privacy Act Always Require Consent?
No. Consent is not the only lawful basis for processing personal information under Philippine privacy law.
Depending on the circumstances, processing of personal information can potentially be justified on other statutory grounds, including situations connected with contractual necessity, compliance with legal obligations, protection of vitally important interests, public authority, and legitimate interests.
The correct question is therefore not merely, “Did the person consent?” The better question is: “What lawful basis authorizes this particular processing activity?”
Sensitive personal information has its own more restrictive processing rules.
What Privacy Principles Must Organizations Follow?
Three foundational concepts frequently used in Philippine privacy compliance are:
Transparency
People should understand the nature, purpose, and extent of relevant processing.
Legitimate Purpose
Personal data should be processed for a purpose that is not contrary to law, morals, or public policy and that is properly declared or specified.
Proportionality
Organizations should process personal data that is appropriate and reasonably necessary for the declared purpose rather than collecting excessive information simply because it might be useful later.
What Rights Do Data Subjects Have?
A person whose personal information is being processed is generally referred to as a data subject. Data-subject rights include the right to be informed, right to object, right to access, right to rectification, right to erasure or blocking, right to data portability, right to damages, and the right to file a complaint, subject to applicable conditions and limitations.
What Must Businesses Do Under the Data Privacy Act?
There is no single document that automatically makes an organization “Data Privacy Act compliant.” Compliance is a system.
Depending on the organization’s activities, meaningful privacy compliance may involve:
- understanding what personal data is collected, where it comes from, where it is stored, who can access it, where it is transferred, and when it should be deleted;
- determining the lawful basis for important processing activities;
- providing appropriate transparency to individuals;
- implementing appropriate organizational, physical, and technical safeguards;
- restricting access according to legitimate requirements;
- managing third-party vendors and processors;
- maintaining a process for identifying, assessing, documenting, responding to, and where applicable reporting security incidents and personal-data breaches;
- handling legitimate data-subject requests; and
- maintaining accountability and documentation.
Does a Business Need a Data Protection Officer?
Covered organizations should examine applicable Data Protection Officer requirements and current National Privacy Commission rules. The DPO performs an important compliance and oversight function involving an organization’s privacy responsibilities.
The appointment of a DPO should not be treated as the entire compliance program. A DPO without adequate policies, management support, security controls, processes, and documentation cannot by himself or herself make an organization compliant.
What Counts as a Data Privacy Violation?
Not every privacy concern is automatically a violation of RA 10173. Potential violations depend upon the specific legal provision and facts involved.
Issues can arise from conduct such as unauthorized processing, improper access, negligent access, improper disposal, unauthorized disclosure, processing inconsistent with applicable requirements, failure to protect personal data appropriately, violations of data-subject rights, and certain failures involving security incidents or breach obligations.
A useful analysis asks: What information was involved? Who processed it? What processing occurred? What was the purpose? What lawful basis existed? What safeguards were in place? Was information improperly disclosed or accessed? Was a data-subject right affected? Did another law also apply?
Can Someone Share Personal Information Without Permission?
Sometimes information can lawfully be processed or disclosed without relying on consent. But that does not mean anyone may freely publish, distribute, expose, or misuse another person’s personal information.
The legality depends on factors including the information involved, how it was obtained, purpose, lawful basis, circumstances of disclosure, applicable rights, and other laws.
In May 2026, the National Privacy Commission warned the public against unauthorized access, use, disclosure, sharing, or further dissemination of personal data and against circulating material apparently obtained through unauthorized access.
What Are the Penalties for Violating the Data Privacy Act?
RA 10173 contains criminal provisions covering specific prohibited acts. Depending on the offense, these may involve both imprisonment and monetary fines. Different offenses carry different penalty ranges, so there is no single universal “Data Privacy Act fine.”
In addition to the criminal provisions of RA 10173, the National Privacy Commission has issued NPC Circular No. 2022-01, which establishes guidelines for administrative fines applicable to specified infractions.
Can Companies Receive Administrative Fines?
Yes. The National Privacy Commission’s administrative-fine framework applies to covered Personal Information Controllers and Personal Information Processors. The amount and basis for a fine depend on the relevant violation and applicable NPC rules.
What Should You Do If You Believe Your Privacy Rights Were Violated?
Start by preserving the relevant evidence. Useful records may include original emails, messages, screenshots, notices, privacy policies or privacy notices, forms you submitted, correspondence with the organization, dates and times, account information, transaction records, URLs, copies of requests to correct or delete information, and responses from the organization.
Do not alter, delete, crop, overwrite, or unnecessarily modify original evidence.
Depending on the circumstances, you may first communicate with the organization or its Data Protection Officer. A data subject affected by a privacy violation or personal-data breach may also potentially file a complaint with the National Privacy Commission under its applicable rules of procedure.
Who Enforces the Data Privacy Act?
The principal Philippine regulator is the National Privacy Commission. The NPC administers and implements the Data Privacy Act and performs regulatory, compliance, policy, investigative, and quasi-judicial functions within its mandate.
Other agencies or courts can become relevant when the same conduct potentially violates other laws. A hacking incident, for example, might involve both privacy-law issues and cybercrime issues.
Data Privacy Act vs Cybercrime Prevention Act
RA 10173 should not be confused with the Cybercrime Prevention Act of 2012, Republic Act No. 10175. The laws may overlap in a real-world incident, but they address different legal questions.
The Data Privacy Act primarily concerns personal-data processing and privacy protection. The Cybercrime Prevention Act establishes offenses and rules relating to specified cybercrime conduct.
Practical Example: Online Store
Suppose a Philippine online retailer collects customer names, delivery addresses, telephone numbers, email addresses, and transaction information. It uses third-party services for payment processing, email, customer support, and cloud storage.
Privacy compliance cannot be reduced to placing a consent checkbox on the checkout page. The retailer should understand what personal data it processes, why each category is processed, the applicable lawful basis, which vendors receive or process the information, how customers are informed, how information is secured, how long it is retained, how data-subject requests are handled, and what happens if a security incident occurs.
Common Data Privacy Act Mistakes
“We Have a Privacy Policy, So We Are Compliant”
A privacy notice is important, but it does not replace security controls, appropriate processing practices, data governance, incident response, vendor management, and other applicable obligations.
“Consent Makes Everything Legal”
Consent is neither the only lawful basis nor permission to process data without limitation.
“Our Vendor Stores the Data, So It Is Their Responsibility”
Outsourcing processing does not automatically eliminate the PIC’s accountability.
“Public Information Is Free to Use for Anything”
Public availability should not automatically be treated as unlimited permission for every form of collection, profiling, republishing, combination, or other processing.
“Only Data Breaches Violate Privacy Law”
Privacy compliance extends beyond cybersecurity breaches. Collection, use, disclosure, retention, access, transparency, data-subject rights, and other processing activities can raise separate privacy issues.
Frequently Asked Questions
Is the Data Privacy Act still in effect in the Philippines?
Yes. Republic Act No. 10173 remains the principal Philippine data privacy statute and operates together with its Implementing Rules and Regulations and subsequent NPC issuances.
What is RA 10173?
RA 10173 is the Data Privacy Act of 2012.
Who implements RA 10173?
The National Privacy Commission administers and implements the Philippine data privacy framework within its statutory mandate.
Does the Data Privacy Act apply to employees?
Personal information processed in an employment context can fall within Philippine privacy law. The specific lawful basis, purpose, employer obligations, and employee rights depend on the processing involved.
Does a business always need consent before collecting personal information?
No. Consent is one possible basis for processing personal information, but other statutory grounds can apply.
Is a person’s name personal information?
A name can constitute or form part of personal information where it identifies or helps identify a particular individual. Context matters.
Is a phone number personal information?
A phone number associated with or capable of identifying a particular individual may constitute personal information.
Are medical records sensitive personal information?
Health information falls within the statutory categories of sensitive personal information.
Can I complain to the National Privacy Commission?
A data subject who is the subject of a privacy violation or personal-data breach may potentially file a complaint subject to the NPC’s applicable procedures.
Can violating the Data Privacy Act lead to imprisonment?
Yes. RA 10173 establishes imprisonment and monetary penalties for specified criminal offenses. The applicable penalty depends on the particular violation.
Official Sources
- Republic Act No. 10173 and Data Privacy Act resources — National Privacy Commission
- Implementing Rules and Regulations of Republic Act No. 10173 — National Privacy Commission
- Data Subject Rights — National Privacy Commission
- NPC Notice to the Public on unauthorized access, use, disclosure, sharing, or dissemination of personal data
Related CyberCode Guides
- What Is the Data Privacy Act? RA 10173 Explained in Plain English
- Data Privacy Rights in the Philippines: What Are Your Rights?
- What Is Personal Information Under the Data Privacy Act?
- What Is Sensitive Personal Information Under RA 10173?
- Personal Information Controller vs Personal Information Processor
- What Counts as a Data Privacy Violation in the Philippines?
- Penalties for Violating the Data Privacy Act in the Philippines
- Can Someone Post Your Personal Information Online Without Permission?
- Invasion of Privacy Laws in the Philippines: What Is Illegal?
CyberCode.ph provides general educational information about technology, cybersecurity, privacy, and related legal issues. It is not a substitute for legal, cybersecurity, or professional advice for a specific situation.