CyberCode.ph · Philippines

Philippine Data Privacy Act Compliance Checklist for SMEs

Last updated October 14, 2026 · Practical privacy, cybersecurity and technology-law guidance
Business professional reviewing data privacy compliance in the Philippines

How Do I Check If My Company Is Compliant With the Data Privacy Act in the Philippines?

Check the business against the seven general obligations in Section 4 of NPC Circular No. 2023-06: a registered Data Protection Officer, registered data processing systems, an inventory of those systems, a Privacy Impact Assessment, a Privacy Management Program, periodic staff training, and cooperation with an NPC review. No National Privacy Commission certificate declares a business compliant, so the working test is whether you can produce a dated document for each of the seven today.

A Philippine SME that processes employee, customer, supplier, website, payment, CCTV, or marketing data must comply with the Data Privacy Act of 2012 even if it is not required to register every system with the Commission.

For the wider online-business obligations that sit beside privacy compliance, use Cybercode’s Business Compliance Philippines hub.

From authority to action

  • What the authority says: Republic Act No. 10173 and its Implementing Rules require lawful, transparent, proportionate processing; respect for data-subject rights; accountability for vendors; and reasonable organizational, physical, and technical safeguards. RA 10173 and its IRR are the foundation.
  • What it means for an SME: Compliance is not a privacy policy sitting on a website. The business must be able to show who is responsible, what data it holds, why each activity is lawful, who receives the data, how long it is kept, how it is secured, and how requests or incidents are handled.
  • What changes the answer: The level of control should reflect the sensitivity, volume, purpose, technology, affected people, and likely harm. NPC registration duties also depend on employee count, sensitive-data volume, risk, and whether automated decision-making or profiling is used.
  • What to do next: Complete the checklist below. For each item, name an owner, attach evidence, set a review date, and record any unresolved risk. Use the RA 10173 purpose worksheet and worked example to document the legal basis and retention decision for one activity.

Key takeaways

  • The Data Privacy Act can apply to an SME even when NPC registration is not mandatory.
  • A business should designate a DPO or another accountable privacy officer; registration of the DPO and systems follows the current NPC registration rules.
  • A spreadsheet inventory is useful only if it accurately maps collection, use, access, sharing, retention, disposal, systems, vendors, and lawful bases.
  • Consent is not the only lawful basis. Using consent where another legal basis actually applies can create operational and withdrawal problems.
  • Security must cover people, paper files, offices, devices, accounts, software, vendors, backups, remote work, and disposal—not only antivirus software.
  • The best evidence of compliance is operational: approvals, inventories, notices, contracts, access lists, training records, logs, test results, request tickets, incident reports, and corrective-action records.
  • High-risk processing deserves professional review before launch, not after a complaint or breach.

Quick decision snapshot

Situation General rule What changes the answer First action
Fewer than 250 employees The DPA may still apply. Small size is not a general exemption. Registration may still be mandatory if the business processes sensitive data of at least 1,000 individuals, uses risky processing, or performs automated decision-making or profiling. Inventory every data processing system and test it against NPC Circular No. 2022-04.
Payroll and employee records Processing may rely on contract, legal obligation, or another lawful basis depending on the data and purpose. Sensitive personal information has stricter criteria under Section 13 of RA 10173. Map each field to its purpose, basis, access group, retention period, and disclosure.
Customer marketing list The business needs a lawful basis and transparent notice. Consent must be freely given, specific, informed, and evidenced when consent is used. Other laws and channel-specific rules may also apply. Separate service communications from optional marketing and preserve the opt-in or other basis.
Cloud payroll, CRM, or e-commerce platform Outsourcing does not remove the PIC’s accountability. Cross-border access, sub-processors, security, deletion, and breach assistance affect the contract and risk assessment. Record the vendor as a PIP where applicable and review the processing agreement.
Lost laptop, hacked email, or exposed database Every security incident should be documented and assessed. Not every incident meets the notification threshold, but qualifying breaches trigger a time-sensitive NPC and data-subject analysis. Contain the incident, preserve logs, begin the breach assessment, and escalate to the DPO.

The Seven Obligations to Check Yourself Against

NPC Circular No. 2023-06, Security of Personal Data in the Government and the Private Sector, opens Section 4 with the line “A PIC and its PIP shall fulfill the following responsibilities” and then lists seven. They are the closest thing the Commission publishes to a compliance test, because each one is either a document the business holds or one it does not.

Obligation (Circular No. 2023-06, Sec. 4) What proves it Where it is set out
Designate and register a Data Protection Officer with the NPC Appointment paper naming a full-time or organic employee, plus the NPC registration record Sec. 4(A); NPC Advisory No. 2017-01; NPC Circular No. 2022-04
Register its data processing systems with the NPC Certificate of registration, or the sworn declaration in Annex 1 where registration is not required Sec. 4(B); NPC Circular No. 2022-04, Secs. 5 to 7
Create an inventory of all data processing systems and activities A records-of-processing register naming each activity, its data subjects, purpose, data flows and disclosures Sec. 4(C)
Conduct a Privacy Impact Assessment A dated PIA for each processing system, updated for new features, major changes, new regulations or new contracts Secs. 4(D) and 5; NPC Advisory No. 2017-03
Set a Privacy Management Program Documented leadership commitment, a control framework answering the risks the PIA found, and an oversight routine Secs. 4(E) and 6
Periodically train employees, agents, personnel or representatives Attendance records and assessment results, with dates Sec. 4(F)
Comply with NPC orders when policies are reviewed and assessed A named contact who can produce the folder, and a record of any past NPC correspondence Sec. 4(G)

Section 5 adds a point worth knowing before anyone panics about filings: the PIA “need not be submitted to the NPC, but it shall be made available by the PIC upon the NPC’s request”. The assessment is kept, not lodged.

Beneath the seven sit the specific policies the same Circular names: a Retention Policy that “must be reviewed periodically and amended as necessary” (Sec. 9), a Password Policy (Sec. 11), an Access Control Policy (Sec. 13), an updated Acceptable Use Policy (Sec. 15), secure authentication “such as multifactor authentication or secure encrypted links” (Sec. 16), access logging from which it can be ascertained which file was accessed (Sec. 19), and a Business Continuity Plan (Sec. 21). Section 32 requires a PIC or PIP to “continuously adapt security measures”, so a policy written once and never revisited does not pass. Section 37 gave a transitory period of twelve months from the Circular’s effectivity to comply; the Circular is dated 1 December 2023 and takes effect fifteen days after publication, so that period has closed.

The Commission’s own five pillars

The NPC Privacy Toolkit frames the same ground as five pillars, in the Commission’s own wording:

  1. “Commit to Comply: Appoint a Data Protection Officer”
  2. “Know Your Risks: Conduct A Privacy Risk or Impact Assessment”
  3. “Be Accountable: Develop a Privacy Management Program and Privacy Manual”
  4. “Demonstrate your Compliance: Implement Privacy and Data Protection Measures”
  5. “Be Prepared For Breach: Regularly Exercise Your Breach Reporting Procedure”

The pillars and the seven obligations are not two separate programs. The pillars are the plain-language version; Circular No. 2023-06 is the enforceable one.

What no document proves

Two things a Philippine business often mistakes for a clean bill of health. First, a certificate of registration is evidence of registration and nothing more: NPC Circular No. 2022-04 states that the certificate does not verify the truth or completeness of everything submitted. Second, there is no NPC audit that ends in a compliance certificate on request. The Commission may accept “independent verification or certification by a reputable third party” under Section 34 of Circular No. 2023-06, but the same section preserves the NPC’s own regulatory functions, so a third-party certificate narrows the argument rather than ending it.

The practical reading is blunt. If you cannot open one folder today and show a dated document for each of the seven obligations, the missing documents are the answer to the question.

The SME compliance checklist

Use one accountable owner and one evidence artifact for every action. “Evidence” means a record that can be produced during an internal review, NPC compliance check, vendor audit, complaint, or incident investigation.

1. Governance and accountability

Action Requirement type Suggested owner Evidence to keep Status
Issue a written DPO or privacy-accountability designation with authority, reporting line, and resources. Legal requirement — RA 10173, Sec. 21(b) and IRR, Sec. 26(a) Owner, board, president, or general manager Signed appointment, role description, organization chart, dedicated privacy email ☐
Determine whether DPO and DPS registration is mandatory, voluntary, or subject to a sworn declaration. Regulatory requirement — NPC Circular No. 2022-04, Secs. 5–8 DPO with corporate secretary or counsel Registration assessment, NPCRS record, certificate, or sworn declaration ☐
Approve a Privacy Management Program proportionate to the business. Regulatory requirement — NPC Circular No. 2023-06, Sec. 4(E) Management and DPO Approved program, annual plan, review minutes, corrective-action register ☐
Adopt and periodically review privacy, information-security, acceptable-use, access-control, retention, incident-response, remote-work, and disposal rules. Regulatory requirement; scope is risk-based — IRR, Secs. 25–29 and NPC Circular No. 2023-06 DPO, IT/security, HR, operations Version-controlled policies, approval dates, acknowledgments ☐
Train people who handle personal data and repeat training when systems, threats, or roles change. Regulatory requirement — IRR, Sec. 26(d) and NPC Circular No. 2023-06, Sec. 4(F) DPO and HR Attendance, training material, assessment results, reminders ☐

The IRR requires an accountable privacy officer, documented policies, records of processing, staff supervision and training. NPC Circular No. 2023-06 also requires a privacy management program and periodic training. See the IRR, Sections 25–29 and NPC Circular No. 2023-06.

2. Inventory every processing activity

Create one row for each practical system or activity: recruitment, employee files, payroll, attendance, benefits, customer orders, CRM, website forms, analytics, CCTV, visitor logs, supplier records, accounting, delivery, support tickets, direct marketing, cloud storage, backups, and archived paper files.

Inventory field What to record Evidence
Data subjects and data Employees, applicants, customers, children, suppliers, visitors; ordinary, sensitive, or privileged data Sample form, database field list, paper-record index
Purpose and lawful basis The specific business purpose and the applicable Section 12 or Section 13 criterion Lawful-basis assessment and approval
Collection and notice Where the data comes from and what notice is shown Form, notice version, screen capture, consent record where applicable
Access and recipients Internal roles, vendors, government recipients, banks, insurers, and other third parties Access matrix, disclosure log, contract
Location and transfer Office, device, cloud region, backup, overseas recipient System diagram, vendor documentation
Retention and disposal Trigger, duration, legal reason, and secure disposal method Retention schedule and disposal record
Security and incidents Current controls, risks, responsible team, and incident history PIA, configuration evidence, test results, incident log

The inventory should describe the complete data life cycle. The IRR expressly requires records that cover purposes, data subjects, categories of data, recipients, data flow, retention, safeguards, and accountable contacts. IRR Section 26 provides the baseline; NPC Circular No. 2023-06 adds current PIA and security requirements.

3. Verify lawful basis, necessity, and proportionality

For every row in the inventory:

  1. State the precise purpose before processing begins.
  2. Identify the correct lawful basis for ordinary personal information under Section 12 of RA 10173.
  3. If sensitive or privileged information is involved, identify the applicable condition under Section 13.
  4. Collect only data that is adequate, relevant, suitable, necessary, and not excessive for the purpose.
  5. Stop incompatible secondary use unless a lawful basis and proper notice support it.
  6. Document the analysis and its approver.

Consent is not a universal cure. If the business relies on consent, it must be freely given, specific, informed, evidenced in written, electronic, or recorded form, and capable of being withdrawn. A privacy notice informs the person; a consent mechanism records agreement. They are related but not interchangeable. RA 10173 Sections 11–13 and NPC Circular No. 2023-04 govern this analysis.

4. Give the right notice at the right time

Each relevant notice should tell the data subject, in plain language:

  • what personal data is collected;
  • the purpose, nature, scope, method, and duration of processing;
  • the lawful basis and, where consent is used, the specific processing covered;
  • the PIC’s identity and contact details;
  • recipients or categories of recipients;
  • retention period or criteria;
  • material automated processing;
  • data-subject rights and how to exercise them; and
  • DPO or privacy contact details.

Provide the notice before processing or at the next practical opportunity. Use layered or just-in-time notices for forms and apps when a single long notice would hide the information that matters at the point of collection. Avoid pre-checked consent boxes, bundled unrelated purposes, vague “any business purpose” language, and interfaces that make refusal or withdrawal materially harder.

These transparency and notice duties arise from RA 10173, Section 16, IRR Section 34, and, when consent is used, NPC Circular No. 2023-04, Sections 3–6.

5. Complete a PIA and control plan

NPC Circular No. 2023-06 states that a PIA should be undertaken for every processing system involving personal data. It should identify the data, repositories, media, full life cycle, purposes, lawful bases, privacy-principle issues, risks to people, and risks to confidentiality, integrity, and availability. The PIA is not ordinarily filed with the NPC, but it must be available if requested during an investigation or compliance check. Read NPC Circular No. 2023-06.

For a small business, the PIA can be concise, but it must be real. Record the risk, existing control, remaining risk, treatment, owner, deadline, and approval. Update it when the business adds a new app, vendor, AI feature, tracking technology, high-risk dataset, sharing arrangement, or major process change.

6. Implement organizational, physical, and technical security

Use risk, not company size alone, to decide the control strength.

Organizational controls

  • role-based access approval and prompt offboarding;
  • confidentiality obligations;
  • employee and contractor training;
  • vendor due diligence and processing agreements;
  • change management and periodic access review;
  • incident reporting and escalation;
  • backup, recovery, and business-continuity ownership.

Physical controls

  • locked storage for paper files and removable media;
  • visitor control and clear-desk practices where appropriate;
  • access logs for physical filing systems;
  • secure transport, archiving, and destruction;
  • privacy-conscious workstation and CCTV placement.

Technical controls

  • unique accounts, strong passwords, and multifactor authentication for sensitive or high-volume remote access;
  • supported and licensed software with timely security updates;
  • encrypted transport and, where appropriate, encrypted storage;
  • endpoint protection and secure device configuration;
  • tested backups and recovery procedures;
  • vulnerability and threat monitoring;
  • centralized logging proportionate to the risk;
  • remote disconnection or deletion for company mobile devices when feasible;
  • secure deletion or destruction at the end of retention.

These controls reflect the DPA’s risk-based security duty and the more specific requirements in NPC Circular No. 2023-06. They should be adapted to the business’s data, systems, industry, and risk—not copied mechanically.

7. Control vendors, sharing, and cloud services

List every provider that can store, view, transmit, analyze, support, back up, or delete personal data. Determine whether it acts as a PIP, an independent PIC, or both in different activities.

For processors, the contract should identify the subject, duration, purpose, data types, data subjects, location, documented instructions, confidentiality, security, sub-processors, request assistance, breach cooperation, audit support, and return or deletion at exit. A vendor’s marketing page or generic terms do not replace the required assessment and contract.

The PIC remains accountable for outsourced or transferred personal data under RA 10173, Sections 14 and 21. Processor arrangements must also satisfy IRR Sections 43–45 and 50.

For cross-border processing, document the destination, access arrangement, applicable safeguards, and how comparable protection will be maintained. If the data or transfer is high-risk, obtain professional review before launch.

8. Make data-subject rights executable

Publish a usable request channel and create an internal procedure for access, correction, objection, erasure or blocking, portability where applicable, and complaints. The workflow should include identity verification, intake date, scope, system search, legal exception review, response approval, delivery, third-party notification where relevant, and closure evidence.

Do not promise automatic deletion. Some records must be retained for contracts, taxes, employment, legal claims, or other legal obligations. Explain the lawful reason when a request cannot be granted in full and preserve the decision record. See Cybercode’s Data Privacy Rights in the Philippines for the rights framework.

The controlling rights and qualifications are in RA 10173, Sections 16–19 and IRR Sections 34–37.

9. Set retention and secure disposal rules

For each record class, state:

  • the retention trigger;
  • the duration or decision criterion;
  • the legal, contractual, or business reason;
  • any hold for a dispute, audit, or investigation;
  • the storage location;
  • the disposal method; and
  • the person who approves and records disposal.

“Keep forever” is not a retention schedule. RA 10173 requires data to be retained only as long as necessary for the declared purpose, legal claims, legitimate business purposes, or a period required by law. Circular No. 2023-06 requires documented retention and disposal processes.

See RA 10173, Section 11(e)–(f), IRR Section 26(e)(5), and NPC Circular No. 2023-06, Sections 9 and 28–31.

10. Prepare for incidents and breaches

Maintain one response process that covers reporting, triage, containment, evidence preservation, risk assessment, legal analysis, notification, recovery, communications, and corrective action. Document all security incidents and personal data breaches, including those that do not meet the notification threshold.

The 72-hour notification rule is not triggered by every lost device or suspicious email. Under the IRR, notification is required when the specified data-acquisition and serious-harm conditions are met. Begin the assessment promptly because delay in discovering the scope does not justify delay in starting the response. Use Cybercode’s Data Breach Response Checklist for the operational sequence and Data Breach Notification guide for the threshold analysis.

The legal notification test and documentation duties are in RA 10173, Section 20(f), IRR Sections 38–42, and NPC Circular No. 16-03.

11. Check NPC registration and reporting duties

Under NPC Circular No. 2022-04, mandatory registration generally applies to a PIC or PIP that:

  • employs at least 250 people;
  • processes sensitive personal information of at least 1,000 individuals;
  • processes data likely to pose a risk to the rights and freedoms of data subjects; or
  • operates a system involving automated decision-making or profiling, which must be registered in all instances covered by the Circular.

A PIC or PIP outside the mandatory conditions may register voluntarily. If it neither falls under mandatory registration nor registers voluntarily, Circular No. 2022-04 requires a sworn declaration using the prescribed annex. Covered new systems or an inaugural DPO must generally be registered within 20 days from commencement or appointment; specified minor updates and DPO changes are subject to a 10-day update rule. Check NPC Circular No. 2022-04 and the current NPC portal instructions before filing.

Registration is evidence of registration, not certification that the business is fully compliant. The NPC circular expressly states that its certificate does not verify the truth or completeness of all submitted content.

Evidence pack: what should be in the compliance folder?

  • DPO or accountable-officer appointment and dedicated contact channel
  • registration assessment, certificate, or sworn declaration, as applicable
  • data inventory and records of processing activities
  • current PIAs and risk-treatment register
  • lawful-basis assessments
  • privacy statements, notices, forms, and consent records where used
  • privacy, security, access, acceptable-use, retention, disposal, remote-work, and incident policies
  • access approvals and review records
  • training attendance and assessments
  • vendor due diligence and processing or sharing agreements
  • security configuration, patching, backup, recovery, and test evidence
  • rights-request log and response records
  • incident and breach register, notification analysis, and corrective actions
  • management review minutes and remediation tracker

A practical 30-day implementation sequence

Period Priority Output
Days 1–5 Assign accountability and stop obvious high-risk gaps DPO/privacy designation, dedicated contact, emergency escalation, exposed-access fixes
Days 6–10 Map data and systems Processing inventory, vendor list, data-flow map, registration screening
Days 11–15 Verify purpose, lawful basis, notice, and retention Basis matrix, revised notices, consent fixes, draft retention schedule
Days 16–20 Assess risk and security PIA, access review, backup test, MFA rollout priorities, vulnerability actions
Days 21–25 Operationalize rights and incidents Request workflow, incident playbook, breach decision record, response contacts
Days 26–30 Close evidence and governance gaps Policies approved, contracts queued, training completed, management review and remediation dates

This is a practical rollout plan, not a statutory 30-day grace period.

What Are the Best Alternatives to Hiring a Data Privacy Consultant for a Small Business in the Philippines?

Start with the rule most small businesses meet late: a consultant cannot be your Data Protection Officer. NPC Advisory No. 2017-01 says, under Position of the DPO or COP, that “The DPO or COP should be a full-time or organic employee of the PIC or PIP”, and its footnote 3 states that “Consultants and project, seasonal, probationary, or casual employees should not be designated as DPOs.” So the choice is never a consultant instead of an internal owner. The internal owner is required either way, and the real decision is what, if anything, to buy on top.

What the Advisory does allow is outsourcing the work, not the office. A PIC or PIP “may outsource or subcontract the functions of its DPO or COP”, but the DPO or COP must oversee the performance of those functions so far as possible and “shall also remain the contact person of the PIC or PIP vis-à-vis the NPC”. Responsibility for complying with the Act stays with the business.

Five routes that cost nothing, or very little

Route What it gives you Its limits
Designate an internal DPO, or a COP for a component unit The appointment the law requires, at no external cost. Subject to NPC approval, a group of related companies may designate the DPO of one member, with the other members still naming a COP The person must act independently and must not hold a role that determines the purposes and means of processing. Where employment is by contract, Advisory No. 2017-01 says the term “should at least be two (2) years”
Work through the NPC Privacy Toolkit The Commission’s own free workbook: a PIA guide with a step-by-step template, a privacy management program guide with a checklist, privacy manual, notice and consent guides, a ten-point accountability framework, a compliance checklist and a records-of-processing form It is the Third Edition, May 2018. Its registration chapter is built on NPC Circular No. 17-01 and its security material predates Circular No. 2023-06, so check registration against Circular No. 2022-04 and security against Circular No. 2023-06
NPC Data Privacy Competency Program The Data Privacy Foundational Course on the Commission’s own site, with video modules including Tagalog and Bisaya, which covers the periodic training obligation in Sec. 4(F) for staff who need the basics Foundational by design. It will not settle a contested lawful basis, a cross-border transfer or an employee-monitoring question
Request an NPC advisory opinion A written determination from the Commission on your own question, issued under NPC Circular No. 18-01 at the request of any party It is “based only on the facts and circumstances provided by the requesting party”, neither adjudicates issues nor imposes sanctions or awards damages, is not a standing rule binding the NPC in other cases, and may be referred to the Complaints and Investigations Division. The NPC fees advisory of 15 March 2024 lists Advisory Opinion and Legal Research among its paid services, assessed case by case; it publishes no amount
Buy a scoped review rather than a program Paid help pointed at one unresolved legal or technical question instead of at the whole checklist Only sensible once the inventory and the PIA exist. Without them a reviewer bills for discovery the business could have done itself

The sequence that saves the most money is plain. Appoint the internal owner, build the inventory and the PIA from the Toolkit’s templates, train staff through the Commission’s own course, then look at what is genuinely unresolved. The list in the next section is the honest test of what is worth paying for.

When professional review is important

Obtain qualified legal, privacy, or cybersecurity review when the business:

  • handles health, biometric, financial, government-issued, children’s, or other high-risk data;
  • uses automated decisions, profiling, AI, facial recognition, large-scale tracking, or behavioral advertising;
  • shares data among companies or across borders;
  • conducts employee monitoring or extensive CCTV surveillance;
  • processes data for several clients as a PIP;
  • is preparing or responding to an NPC compliance check, complaint, or order;
  • has suffered a possible reportable breach;
  • needs to rely on legitimate interest in a contested or intrusive situation; or
  • cannot map a processing activity to a clear lawful basis.

Professional review should focus on the unresolved legal or technical issue. It does not replace management ownership, accurate records, staff training, or working controls.

Common mistakes

  • Treating fewer than 250 employees as an exemption from the DPA
  • Copying a foreign privacy policy that does not match actual Philippine processing
  • Asking for consent for everything without checking Sections 12 and 13
  • Publishing a privacy notice while keeping no internal inventory or evidence
  • Giving every employee administrator access “for convenience”
  • Assuming a cloud vendor is solely responsible for security and data-subject requests
  • Keeping former employee, applicant, customer, CCTV, or backup data indefinitely
  • Treating registration as a certificate of full compliance
  • Starting breach analysis only after the facts are complete
  • Writing policies that no employee follows and no manager tests

Frequently asked questions

How do I check if my company is compliant with the Data Privacy Act in the Philippines?

Work through the seven general obligations in Section 4 of NPC Circular No. 2023-06 and ask, for each, whether you can produce a dated document today: a registered Data Protection Officer, registered data processing systems, an inventory of those systems, a Privacy Impact Assessment, a Privacy Management Program, training records, and a named contact who can answer an NPC review. No National Privacy Commission certificate declares a business compliant, and a certificate of registration evidences registration only. Whatever you cannot produce is the gap.

What are the best alternatives to hiring a data privacy consultant for a small business in the Philippines?

A consultant cannot stand in for the appointment itself. NPC Advisory No. 2017-01 says the DPO or COP “should be a full-time or organic employee”, and its footnote 3 says consultants “should not be designated as DPOs”. The workable alternatives are to designate an internal DPO or a COP, build the inventory and the PIA from the free NPC Privacy Toolkit templates, use the NPC Data Privacy Competency Program for staff training, request an NPC advisory opinion on a specific question, and then buy only a scoped review of what remains unresolved. Functions may be outsourced, but the DPO remains the NPC’s contact point and the business keeps responsibility.

Does the Data Privacy Act apply to a sole proprietorship or microbusiness?

It can. The law focuses on personal-data processing, not only corporate form or revenue. A sole proprietor who collects employee, customer, patient, client, visitor, or online-user data may be a PIC and must comply with the duties applicable to that processing.

Does every SME need to register with the NPC?

Not every SME is subject to mandatory registration, but every SME should perform and document the threshold analysis. Employee count is only one test. Sensitive-data volume, risky processing, automated decision-making, and profiling can make registration mandatory; a business outside the mandatory criteria must also check the sworn-declaration rule in NPC Circular No. 2022-04.

Does every SME need a DPO?

The DPA, its IRR, and NPC security rules require an accountable individual for privacy compliance. Whether the DPO must be registered is governed by the current registration framework. The appointee should have real authority, access to management, adequate resources, and a conflict-managed role—not merely a name on a form.

Is a website privacy policy enough?

No. A public notice is only one transparency control. The business still needs a lawful-basis analysis, records of processing, appropriate security, retention and disposal rules, vendor controls, request procedures, incident readiness, training, and evidence that the program operates.

No. Consent is one lawful basis, not the only basis. Contract performance, legal obligation, vital interests, public-authority functions, and legitimate interest may apply to ordinary personal information, subject to their conditions. Sensitive personal information is governed by the stricter criteria in Section 13 of RA 10173.

Is a PIA necessary for ordinary small-business software?

NPC Circular No. 2023-06 states that a PIA should be undertaken for every processing system involving personal data, including off-the-shelf systems. The depth may be proportionate, but the assessment should still identify data, purposes, lawful bases, risks, controls, and remaining risk.

What is the fastest way to begin if the business has no privacy program?

Assign an accountable owner, create an inventory of systems and processing activities, stop obvious access or exposure risks, and test each activity for purpose, lawful basis, notice, retention, vendor access, and security. Those steps reveal the real work and generate the evidence needed for the rest of the program.

Checks made on 14 October 2026

Every statement of law on this page was read against the issuing body’s own copy on the date shown. None of it is taken from a secondary summary.

Source What was confirmed Checked
NPC Circular No. 2023-06, Security of Personal Data in the Government and the Private Sector, 1 December 2023 Section 1 scope; the seven responsibilities in Section 4(A) to (G); Sections 5, 6, 9, 11, 13, 15, 16, 18, 19, 21, 32, 34, 36, 37 and 40. Section 39 expressly repeals NPC Circular No. 16-01 14 Oct 2026
NPC Advisory No. 2017-01, Designation of Data Protection Officers Mandatory designation; when a COP may be designated instead; the full-time or organic employee rule and footnote 3 on consultants; the two-year contract term; outsourcing of functions; independence and conflict of interest; a shared DPO for a group of related companies 14 Oct 2026
NPC Circular No. 2022-04 Section 5 mandatory registration thresholds; Section 5A on automated decision-making and profiling; Section 6 voluntary registration and the Annex 1 sworn declaration; the twenty-day and ten-day periods in Section 7 14 Oct 2026
NPC Privacy Toolkit, Third Edition, May 2018 The five pillars quoted word for word; the contents described in this guide, including the PIA template, the privacy management program guide and checklist, the ten-point accountability framework and the records-of-processing form; its registration chapter is built on NPC Circular No. 17-01 14 Oct 2026
NPC advisories index, privacy.gov.ph NPC Advisory No. 2026-03 is the highest-numbered 2026 advisory, with no later advisory listed as at this date 14 Oct 2026
NPC advisory opinions page, citing NPC Circular No. 18-01 What an advisory opinion is, that it rests only on the facts the requester supplies, that it neither adjudicates nor imposes sanctions or awards damages, that it is not a standing rule binding the NPC, and that it may be referred to the Complaints and Investigations Division 14 Oct 2026
NPC fees advisory, 15 March 2024 Advisory Opinion and Legal Research is listed among the services paid through the LANDBANK Link.Biz portal, assessed case by case. The advisory states no amount, and does not mention a fee for registering a data processing system or a DPO 14 Oct 2026
NPC Data Privacy Competency Program page The Data Privacy Foundational Course and its video modules, including modules in Tagalog and Bisaya 14 Oct 2026

Carried from this page’s earlier sourcing and not re-fetched on this pass: NPC Circular No. 2023-04 on consent, NPC Advisory No. 2017-03 on privacy impact assessments, and NPC Circular No. 16-03 on personal data breach management.

Official sources

Important: This article provides general educational information about Philippine data privacy, cybersecurity, and business compliance. It is not legal advice and does not create an attorney-client relationship. Laws, NPC procedures, technical standards, contracts, sector rules, and the facts of each situation may change the result. Verify current requirements through the cited official sources and seek qualified professional advice when rights, deadlines, money, safety, or legal exposure may be affected.

Sources rechecked as of: October 14, 2026

CyberCode updates

Get practical updates on Philippine technology law, data privacy, cybersecurity, and AI.

Email activity tracking

Unsubscribe any time. See our privacy policy below.