Data Privacy Philippines
Understand the Data Privacy Act of 2012 (RA 10173), personal and sensitive information, data-subject rights, breach response, complaint procedures and National Privacy Commission compliance.
What does the Data Privacy Act protect in the Philippines?
The Data Privacy Act of 2012 (RA 10173) protects personal information processed by government and private organizations. It gives data subjects rights and requires personal information controllers and processors to use lawful, transparent and proportionate processing, reasonable security safeguards, and appropriate breach and complaint procedures under National Privacy Commission rules.
Choose the privacy problem you need to solve
People searching for the Philippine Data Privacy Act usually need one of six things: a definition of protected information, an explanation of their rights, immediate help after a leak, the NPC complaint procedure, the breach-notification test, or an organizational compliance checklist. This hub covers all six. Start with the situation closest to yours, then follow the linked guide for evidence, legal context and practical next steps.
My personal data was leaked
- Secure affected email, banking, e-wallet and social accounts; change reused passwords and enable multi-factor authentication.
- Preserve notices, screenshots, messages, URLs, transaction records and dates without altering the originals.
- Ask the organization’s data protection officer what happened, which data was affected and what remediation is available.
- Monitor for identity fraud, phishing, SIM-swap attempts and unauthorized transactions.
- If the response is inadequate or a right was violated, assess an NPC complaint.
I need to file an NPC complaint
- Identify the controller, conduct complained of, right affected and remedy requested.
- Where required, first write to the organization or its data protection officer and preserve the response or proof of non-response.
- Prepare the current NPC complaint or complaint-affidavit requirements, identity documents and supporting annexes.
- File using the method currently accepted by the NPC and retain the complete submission and receipt.
- Respond to NPC orders, conferences and requests within the stated deadlines.
My company had a breach
Not every security incident requires NPC notification. Notification is mandatory when sensitive personal information or other identity-fraud-enabling information is reasonably believed to have been acquired by an unauthorized person and the acquisition is likely to create a real risk of serious harm. A reportable breach triggers notification to the NPC and affected data subjects within 72 hours from knowledge of, or reasonable belief in, the qualifying breach. Contain the incident, preserve evidence and document the threshold decision even when notification is not required.
Open the breach-response guide →I need a compliance baseline
- Assign accountable privacy leadership and define controller and processor roles.
- Inventory data, purposes, lawful bases, recipients, storage locations and retention periods.
- Maintain clear privacy notices and data-subject request procedures.
- Apply minimization, access control, retention and secure-disposal rules.
- Use reasonable organizational, physical and technical safeguards.
- Assess privacy risk when systems or processing materially change.
- Control vendors through due diligence, contracts and monitoring.
- Maintain and test incident-response and breach-notification procedures.
- Train personnel and document compliance decisions.
A four-step privacy decision path
Identify the data and parties
Determine whose data is involved and which controller, processor or recipient handled it.
Check lawful basis and transparency
Ask why the data was collected, what notice was given and whether the use was proportionate.
Protect data and document decisions
Apply safeguards, limit access and retain records that show accountable processing.
Respond, notify and remedy
Honor valid rights requests and assess breach, complaint and notification procedures promptly.
Explore Data Privacy Philippines by topic
Use these clusters to move from the foundational law to rights, remedies, breach response and organizational compliance.
Foundations and definitions
- Personal information: information that identifies a person directly or, when combined with other information, directly and certainly identifies that person.
- Sensitive personal information: specified information involving matters such as health, education, genetic or sexual life, offenses, government identifiers and other categories listed in RA 10173.
- Privileged information: information treated as privileged communication under the Rules of Court or other laws.
| Role | Main function | Responsibility |
|---|---|---|
| Personal information controller (PIC) | Determines why and how personal data is processed. | Remains accountable for compliance and outsourced processing. |
| Personal information processor (PIP) | Processes personal data for a PIC under instructions. | Must follow the Act, its contract and required safeguards. |
Data-subject rights
Subject to statutory conditions and exceptions, a data subject may:
- be informed about processing;
- object to qualifying processing;
- obtain reasonable access to personal data and processing information;
- dispute inaccuracies and obtain correction;
- seek blocking, removal or destruction when the legal grounds are met;
- obtain portability for qualifying electronically processed data;
- lodge a complaint with the NPC; and
- seek indemnification for legally compensable damage.
Breaches and complaints
Take action after a leak, evaluate notification and prepare an evidence-based complaint.
Liability and compliance
There is no single penalty for every Data Privacy Act violation. RA 10173 assigns different imprisonment and fine ranges to unauthorized processing, negligent access, improper disposal, unauthorized purposes, intentional breach, concealment and unauthorized or malicious disclosure. Penalties can increase when sensitive personal information, large-scale processing, a series of acts or public officers are involved. NPC administrative remedies and possible civil liability are separate questions, so the exact offense and facts must be identified before quoting a penalty.
Latest Data Privacy Philippines guides
Every Cybercode article filed under this pillar appears here automatically, newest first.
-
SAFE Kids Act: House Advances HB 11566 on Social Media and Online Gaming
The House moved HB 11566 into conference proceedings on October 12, 2026. Here is what the proposed SAFE Kids Act would require—and what is not law yet.
-
Children’s Personal Data Philippines: Child-Oriented Transparency Guide
How NPC Advisory No. 2024-03 protects children’s personal data: child privacy impact assessments, high-privacy defaults, age assurance and notices.
-
What Is OSINT? Uses, Tools, Accuracy and Legal Limits in the Philippines
What OSINT is, what it can do, the tools that matter, how accurate it is, where Philippine law draws the line, and a problem-to-solution method for using it at work.
-
Accidentally Accessed Someone Else’s Personal Data? What to Do in the Philippines
Stop unintended data access, report safely and preserve the right facts. Includes a minimal incident-report template and the distinction from NPC notification.
-
Online Lending Harassment in the Philippines: Your Rights, Scam Warnings and Where to Report
A practical guide to the DICT–NPC–SEC online lending advisory: borrower rights, unfair debt collection, scam warning signs, evidence to save and where to report harassment in the Philippines.
-
Who Can Exercise Data Privacy Rights After Someone Dies in the Philippines?
Who can request a deceased person’s records? Understand RA 10173 Section 17, proof of authority, access limits and a practical request template.
-
Data Subject Rights in the Philippines: What to Do First, What to Ask and Where to Report
Know your Philippine data privacy rights with a practical matrix: what happened, what to do first, what to ask, and when and where to report to the NPC.
-
Smart Glasses in the Philippines: Uses, AI Features, Where to Buy and Privacy
A beginner’s guide to smart glasses: features, AI uses, Philippine availability, buying options, recording privacy and what comes next.
-
Vendor or SaaS Data Breach in the Philippines: Who Is Responsible?
Who must investigate and notify after a Philippine company’s SaaS or vendor breach, including PIC-PIP roles, contracts, evidence and 72-hour reporting.
-
DICT Investigates Possible DTAP Data Exposure: What Is Known About 410 Files
DICT is investigating a possible DTAP data exposure linked to roughly 410 files and 48 companies. What is confirmed, what remains unknown, and what affected organizations should check.
-
Examples of Sensitive Personal Information Under Philippine Law
Practical RA 10173 examples of sensitive personal information for employers, retailers and SaaS teams, with classification and handling controls.
-
Data Breach Philippines: How to Report One, Step by Step
What Are the Practical Steps for Reporting a Data Breach in the Philippines? Ten steps, in this order: contain the incident without destroying evidence; convene the breach response team; fix in writing the moment you knew; run the three-part test in NPC Circular No. 16-03, Sec. 11; notify the Commission through the DBNMS within 72…
Official Philippine data privacy sources
Confirm current requirements with the statute, National Privacy Commission issuances and official filing systems.
Data Privacy Philippines FAQ
What counts as personal information under Philippine law?
Personal information is information from which a person’s identity is apparent or can reasonably and directly be determined, alone or when combined with other information. The law gives heightened treatment to sensitive personal information and privileged information.
What should you do after discovering that your personal data was leaked?
Preserve notices, screenshots and messages; secure affected accounts; ask the organization and its data protection officer what happened; monitor for misuse; and consider escalating to the National Privacy Commission when the response is inadequate or your rights may have been violated.
When must an organization notify the National Privacy Commission about a breach?
Notification depends on the nature of the affected data, the likelihood of harm and the applicable NPC rules. Organizations should assess the incident promptly, document the decision and obtain professional advice when the notification threshold or deadline is uncertain.