Database status: Maintained reference index based on the National Privacy Commission’s current Advisories & Circulars listing. Older issuances may be amended or repealed; status is shown where material.
Direct Answer
Philippine privacy compliance is governed by Republic Act No. 10173, its Implementing Rules and Regulations, NPC circulars, advisories, procedural rules and sector-specific guidance. This database organizes the most important authorities by issuance, date, regulator, status, scope, important requirements and related Cybercode guides.
Data Privacy Laws & NPC Issuances Database
| Law / issuance | Date | Regulator | Status | Scope | Important requirements / effect | Related guides |
|---|---|---|---|---|---|---|
| Republic Act No. 10173 – Data Privacy Act | 2012 | National Privacy Commission | In force | Personal data processing, rights, security and accountability | Establishes data privacy principles, data-subject rights, controller/processor obligations, security duties and penalties. | DPA guide |
| Implementing Rules and Regulations of RA 10173 | 2016 | National Privacy Commission | In force | Operational implementation of the DPA | Provides implementing rules on lawful processing, rights, security, breach management and accountability. | Compliance checklist |
| NPC Circular 16-03 – Personal Data Breach Management | 2016 | NPC | In force subject to later NPC guidance | Security incidents and personal data breaches | Provides breach-management and notification requirements, including assessment, documentation and notification principles. | Breach notification; Response checklist |
| NPC Advisory 2017-01 – Designation of Data Protection Officers | 2017 | NPC | Current guidance | DPO designation and accountability | Guides organizations on DPO designation, roles and responsibilities. | Compliance checklist |
| NPC Advisory 2017-03 – Privacy Impact Assessments | 2017 | NPC | Current guidance | PIA process | Guides PICs/PIPs in identifying privacy risks and evaluating safeguards before or during processing activities. | Compliance checklist |
| NPC Circular 18-02 – Guidelines on Compliance Checks | 2018 | NPC | In force | NPC privacy sweeps, document submissions and on-site compliance checks | Explains how NPC may assess compliance using publicly available information, document reviews and on-site visits. | Website legal requirements |
| NPC Circular 2020-03 – Data Sharing Agreements | 2020 | NPC | In force; clarified by Advisory 2025-01 | Data sharing arrangements | Provides rules for data sharing and documentation; later guidance clarifies specific provisions. | DPA guide; SaaS agreements |
| NPC Circular 2021-01 – 2021 Rules of Procedure | 2021 | NPC | In force as amended | Complaints, investigations and case procedure | Sets procedure for complaints and proceedings before NPC; amended by Circular 2024-01. | File an NPC complaint |
| NPC Circular 2022-01 – Guidelines on Administrative Fines | 2022 | NPC | In force | Administrative penalties | Provides a framework for administrative fines arising from violations of the DPA and related issuances. | DPA penalties |
| NPC Circular 2022-04 – Registration, DPO, ADM/Profiling and NPC Seal | 2022 | NPC | In force | Registration of data processing systems and related obligations | Sets registration rules, DPO-related requirements, notification for automated decision-making/profiling and NPC Seal of Registration requirements. | NPC registration & seal |
| NPC Circular 2023-03 – Guidelines on Identification Cards | 2023 | NPC | In force | Processing of personal data in ID systems | Provides privacy rules and safeguards for identification-card systems and related data processing. | Personal information |
| NPC Circular 2023-04 – Guidelines on Consent | 2023 | NPC | In force | Consent as a lawful basis | Explains requirements for valid consent and how organizations should obtain, record and manage it. | Privacy notice requirements |
| NPC Circular 2023-06 – Security of Personal Data | Effective March 30, 2024 | NPC | In force; expressly repeals NPC Circular 16-01 | Security of personal data in government and private sector | Requires governance, DPO and registration compliance, PIAs, privacy-management programs, training, access controls, retention controls, backup and business continuity measures. | Cybersecurity compliance; Backup & recovery |
| NPC Circular 2023-07 – Guidelines on Legitimate Interest | 2023 | NPC | In force | Legitimate interest as a lawful basis | Provides a framework for assessing legitimate interest, necessity and balancing against data-subject rights. | DPA guide |
| NPC Advisory 2024-01 – Model Contractual Clauses | 2024 | NPC | Current guidance | Cross-border transfers of personal data | Provides model clauses to support contractual safeguards for certain cross-border personal-data transfers. | SaaS & cloud privacy |
| NPC Circular 2024-01 – Amendments to 2021 Rules of Procedure | 2024 | NPC | In force | NPC case procedure | Amends procedural rules governing NPC complaints and case handling. | NPC complaint guide |
| NPC Circular 2024-02 – CCTV Systems | Effective August 27, 2024 | NPC | In force; repeals Advisory 2020-04 | CCTV systems processing personal data | Creates an updated privacy framework for CCTV use, including transparency, access, security, retention and accountability requirements. | Privacy notices |
| NPC Advisory 2024-04 – AI Systems Processing Personal Data | 2024 | NPC | Current guidance | Artificial intelligence systems processing personal data | Applies the DPA, IRR and NPC issuances to AI systems that process personal data and emphasizes governance and rights considerations. | AI law Philippines; AI policy template |
| NPC Advisory 2025-01 – Clarification on Data Sharing Agreements | 2025 | NPC | Current guidance | Clarification of Circular 2020-03 | Clarifies selected requirements governing data sharing agreements and related arrangements. | SaaS agreements |
| NPC Advisory 2025-02 – Privacy Engineering in Systems Life Cycle Processes | 2025 | NPC | Current guidance | Privacy-by-design and system development life cycle | Guides organizations in integrating privacy engineering into system design, development, deployment and lifecycle management. | Digital transformation; SaaS & cloud privacy |
| NPC Circular 2025-01 – Body-Worn Cameras | 2025 | NPC | In force | Personal data collected through body-worn cameras | Sets privacy requirements for collection, use, access, storage and security of body-worn-camera personal data. | DPA guide |
| NPC Advisory 2026-01 – Data Scraping of Publicly Available Personal Data | 2026 | NPC | Current guidance | Scraping publicly available personal data | Provides guidance on applying privacy principles and lawful-processing requirements to collection of publicly available personal data through scraping. | DPA guide; AI law |
| NPC Advisory 2026-02 – Personal Data Breach Notification through DBNMS | 2026 | NPC | Current guidance | Submission of breach notifications through the Data Breach Notification Management System | Clarifies breach-notification submission through DBNMS and should be checked together with applicable breach-management rules. | Breach notification guide; Company breach response |
Important Status Notes
- NPC Circular 16-01 on security of personal data in government agencies was expressly repealed by NPC Circular 2023-06.
- NPC Advisory 2020-04 on CCTV was repealed by NPC Circular 2024-02.
- NPC Circular 2021-01 remains relevant as amended by NPC Circular 2024-01.
- NPC Circular 2020-03 on data sharing should be read together with NPC Advisory 2025-01.
How to Use This Database
- Identify the processing activity, incident or data-subject issue.
- Start with RA 10173 and its IRR, then read the relevant later circular or advisory.
- Check the current NPC issuance page for amendments, repeal or newer guidance.
- Use the related Cybercode guide for practical implementation and evidence steps.
Official Source
National Privacy Commission – Advisories & Circulars
Related Database
This page tracks one regulator. For the wider set of Philippine technology statutes, and for which official government database publishes each one, see the Philippine Technology Laws Database.
Disclaimer
Important: This article provides general educational information about Philippine law, regulation, cybersecurity, technology, or business compliance. It is not legal advice and does not create an attorney-client relationship. Laws, agency procedures, technical standards, platform rules, and the facts of each situation may change the result. Verify current requirements through the cited official sources and seek qualified professional advice when your rights, deadlines, money, safety, or legal exposure may be affected.