In the Philippines, a deceased person’s lawful heirs and assigns may invoke that person’s data privacy rights under Section 17 of Republic Act No. 10173. A requester must establish the relevant legal capacity; being a relative, knowing a password or paying an account’s bills does not by itself settle that question. Start with a specific written request to the organization holding the records, explain the right you want to exercise, and ask how to submit proof of your identity and authority securely. Source: RA 10173, Sections 16–17.
By Cybercode.ph Editorial Team
The rule, limits and first action
- Rule: Section 17 permits lawful heirs and assigns to invoke applicable rights after death, and also addresses incapacity or inability to exercise those rights.
- Qualification: The Data Privacy Act does not itself rank competing relatives or determine every inheritance dispute. Access remains subject to the applicable right and other relevant laws.
- Evidence: Identify the person, the records, your capacity and the documents supporting it. Ask the holder what it reasonably needs to verify the request.
- Timing: Section 17 allows invocation after death; it does not establish a universal turnaround time for every records request. Separate complaint, litigation or estate deadlines may matter.
- Next step: Contact the records office or data protection officer through the organization’s verified channel. Keep a dated copy and proof of delivery.
The legal rule comes from RA 10173. The distinction between privacy rights and questions about heirs is explained in NPC Advisory Opinion No. 2022-004, which concerns deceased and incapacitated patients’ medical information. The practical preparation steps below are editorial recommendations, not a universal NPC document checklist.
Jump to: Who can request · Preparation checklist · Request template · Limits · If access is refused
Who can exercise the rights after death?
The statutory categories are lawful heirs and assigns. The NPC’s data subject rights guidance says a legal heir should be prepared to show legal evidence supporting the claim. A family relationship and legal capacity are related questions, but they are not interchangeable in every situation.
In its medical-records advisory opinion, the NPC explains that identifying the relevant heirs or representatives may require succession or guardianship rules and other applicable requirements. It does not establish a simple rule that the eldest child always decides or that every family member must receive the full record. The opinion is agency guidance based on stated facts, not a judgment resolving your family’s dispute. See Opinion 2022-004, pages 3–4.
If your authority is disputed, describe that honestly to the record holder. Ask what evidence would resolve the uncertainty and obtain advice on the estate or representation issue. Do not sign a statement saying that you are the sole heir unless you have a sound basis for that statement.
What should you prepare before asking for records?
Use this checklist to make the request specific and reduce unnecessary disclosure. It is a preparation aid; the holder’s lawful verification requirements depend on the records and circumstances.
- Identify the deceased person and the record. Give the minimum matching details needed: for example, a patient or customer reference and the relevant period. Avoid sending every identifier in the first email.
- State the right you are invoking. Explain whether you seek access, correction or another applicable right. “Give me everything” is harder to assess than a defined request.
- Explain your capacity. State whether you act as a lawful heir or assign and how that capacity can be established. Do not treat a saved login as proof of authority.
- Ask for a secure verification process. Documents might include proof of identity, death and relationship or authority, depending on the case. Ask which documents are needed and why before transmitting sensitive copies.
- Specify the result you need. Identify the records or correction, the period covered and a safe contact method. State the purpose without claiming that it overrides other people’s rights.
- Keep a request log. Record the submission date, recipient, acknowledgment, reference number, documents provided and response.
These steps apply the verification and secure-disclosure concerns discussed in Opinion 2022-004, page 4. For the general scope of access, read Cybercode’s personal-data access guide.
A request you can adapt
The following is an example request, not an official NPC form or a statement that every requester qualifies. Replace the bracketed fields accurately before sending it through the holder’s verified channel.
Subject: Request to exercise data privacy rights concerning [name of deceased person]
I am requesting [specific records, correction or other action] concerning [minimum identifying reference] for [relevant period]. I invoke Section 17 in relation to the applicable rights under Section 16 of RA 10173, in my capacity as [lawful heir or assign; explain accurately].
Please tell me what evidence you require to verify my identity and capacity, and how to submit it securely. I can provide [documents available, without attaching unnecessary sensitive information to this initial message].
Please acknowledge this request, identify any information still needed and explain the applicable process. If you limit or refuse the request, please provide the reason and the available review or complaint route. Please contact me at [safe contact details].
Keep the actual request and delivery record. If you later need to complain, these help show what you requested and how the organization responded.
Does this give an heir unrestricted access?
No. Section 17 allows qualifying persons to invoke rights; it does not turn every record into unrestricted family property. The underlying right still matters. For example, the right to seek removal of data has statutory conditions, and a request does not automatically defeat a lawful retention obligation. Start with the conditions in Section 16 rather than assuming that death requires immediate deletion of all records.
A request for personal data is also different from a request to take over an online account, transfer money or determine ownership of estate property. This guide does not establish authority for those actions. Use the relevant institution’s formal process and obtain advice where succession, banking, confidentiality or other rules are involved.
Example: A daughter asks a hospital for a defined set of her deceased parent’s records. A useful first request states her claimed capacity and asks how to prove it. It does not insist that the hospital release every record to an unverified email address. If relatives disagree, the hospital’s response may need to account for the applicable succession rules and the specific records sought.
What if the organization ignores or refuses the request?
- Ask for a written explanation. Check whether the problem is missing proof, an unclear request, disputed capacity or a stated legal restriction. Correct a genuine documentation gap without circulating unnecessary personal data.
- Use the organization’s privacy escalation route. Send the request history to its data protection officer or designated privacy contact. Ask which action is still required.
- Consider the NPC complaint route for a privacy-rights issue. Read the current official filing instructions and Cybercode’s complaint procedure, including the prior steps and supporting documents. A records request is not itself a filed complaint. Under the NPC’s 2021 Rules of Procedure as amended, you must first inform the organization in writing of the privacy violation, and a complaint may proceed if it took no timely or appropriate action or did not respond within fifteen (15) calendar days from receipt; the NPC may waive this for good cause or a serious violation. The complaint must be in writing, signed and verified, and can be filed in person, by registered mail, by courier or by email. Source: NPC 2021 Rules of Procedure, as amended, Rule II Secs. 2–3 and Rule III Sec. 1. No filing deadline for this kind of complaint was verified this run, so do not wait.
- Get appropriate legal help for disputed representation or urgent proceedings. Bring the request log, responses and authority documents. A privacy complaint does not automatically resolve who inherits property.
For the broader rights framework, return to data privacy rights in the Philippines or the Data Privacy hub.
Sources and scope
- RA 10173, Sections 16–17 — binding statute.
- NPC: Rights of Data Subjects — public agency guidance.
- NPC Advisory Opinion 2022-004, 15 February 2022 — fact-specific guidance on medical information, authority and disclosure safeguards.
- NPC: Filing a Complaint — official procedural starting point.
- NPC 2021 Rules of Procedure, as amended — binding procedural rules for complaints.
Sources rechecked as of: October 4, 2026
Cybercode.ph is an independent information resource. This guide is general information, not legal advice or a determination of anyone’s heirship or right to a particular record.