Personal Information Controller vs Processor: PIC vs PIP Philippines

Q: Can a company be both PIC and PIP?

Yes. Classification depends on the specific processing activity.

Q: Do both PICs and PIPs need security controls?

Yes. Both should implement reasonable and appropriate measures relevant to the personal data they process and their role.

Last materially reviewed: September 2, 2026

Direct Answer: Under the Philippine Data Privacy Act, a Personal Information Controller (PIC) is the person or organization that decides what personal data is collected and the purpose or extent of its processing. A Personal Information Processor (PIP) processes personal data on behalf of, or under the instructions of, a PIC. In simple terms: the PIC decides; the PIP processes. (NPC IRR definitions) Outsourcing to a PIP does not remove the PIC’s accountability for personal data under its control or custody.

Primary authority: NPC — Implementing Rules and Regulations of RA 10173.

Key Takeaways

A PIC determines the purpose or extent of personal-data processing.
A PIP processes personal data for a PIC under instructions.
A service provider is not automatically a PIP; its actual role depends on who determines the purposes and means of processing.
A company can be a PIC for one processing activity and a PIP for another.
Outsourcing does not eliminate the PIC’s accountability.
PICs and PIPs both have privacy and security obligations under the Data Privacy Act and NPC issuances.
Processing arrangements should be documented clearly in contracts and privacy-governance records.

Jump to a Section

What is a PIC?
What is a PIP?
PIC vs PIP comparison
Practical examples
What happens when processing is outsourced?
Responsibilities of PICs and PIPs
NPC registration and compliance
FAQs

Decision Snapshot

Question	Practical Answer
Who decides why personal data is processed?	The PIC.
Who processes data under another organization’s instructions?	The PIP.
Can a cloud provider be a PIP?	Yes, depending on the arrangement.
Can one company be both PIC and PIP?	Yes, for different processing activities.
Does outsourcing remove the PIC’s accountability?	No.
Do PIPs have privacy obligations?	Yes.

What Is a Personal Information Controller?

Republic Act No. 10173 defines a Personal Information Controller as a person or organization that controls the collection, holding, processing or use of personal information, including one that instructs another person or organization to process personal information on its behalf.

The Data Privacy Act and its Implementing Rules make the concept of control central. There is control when the person or organization decides what information is collected, or the purpose or extent of its processing.

In practical terms, the PIC usually answers questions such as:

Why are we collecting this data?
What categories of data do we need?
How will the data be used?
How long will we retain it?
Who may receive it?
Which service providers will process it for us?

If an organization determines these core decisions, it is likely acting as a PIC for that processing activity.

What Is a Personal Information Processor?

A Personal Information Processor is a natural or juridical person, or other body, to whom a PIC may outsource or instruct the processing of personal data relating to a data subject.

A PIP generally does not determine the independent purpose of the processing. Instead, it processes data according to the PIC’s instructions and the applicable agreement.

Typical PIP activities may include cloud hosting, payroll processing, email delivery, customer-support processing, data storage and backup, outsourced analytics, IT support involving access to personal data, and software services that process customer or employee data for the client.

PIC vs PIP: Quick Comparison

Issue	Personal Information Controller	Personal Information Processor
Main role	Determines purpose or extent of processing	Processes data for the PIC
Decides why data is processed?	Yes	Usually no
Can instruct another party?	Yes	Acts under instructions
May outsource processing?	Yes	May perform outsourced processing
Accountability for outsourced data	Remains accountable under applicable law	Must comply with applicable processing and security obligations
Example	Retailer deciding how customer data is used	Cloud or email provider processing that data for the retailer

Practical Examples

Example 1: Online Store and Cloud Provider

An online retailer decides to collect customer names, addresses, email addresses and order histories to process purchases and manage customer accounts. The retailer chooses a cloud platform to store that information.

Likely PIC: the online retailer, because it decides why the customer data is collected and how it will be used.

Likely PIP: the cloud provider, to the extent it stores and processes the data under the retailer’s instructions.

Example 2: Employer and Payroll Provider

An employer determines what employee information is needed for payroll and benefits administration, then sends that information to an outsourced payroll company.

Likely PIC: the employer.

Likely PIP: the payroll provider, if it processes employee data only under the employer’s instructions.

Example 3: SaaS Company

A SaaS provider may be a PIP when it processes customer data solely to provide the contracted service. But the same SaaS company may be a PIC for its own employee records, billing contacts, marketing lists or other processing where it determines the purpose.

This is why organizations should classify roles per processing activity, not simply label a company permanently as either a PIC or PIP.

Can a Company Be Both a PIC and a PIP?

Yes. The same organization can act as a PIC for one activity and a PIP for another. For example, a BPO company may process customer records for a client as a PIP while acting as a PIC for its own employee records, recruitment data and vendor contacts.

What Happens When Processing Is Outsourced?

Outsourcing personal-data processing does not mean the PIC can simply transfer all responsibility to the vendor. Under the Data Privacy Act framework, the PIC remains responsible for personal data under its control or custody, including information outsourced or transferred to a PIP for processing.

Organizations should perform appropriate due diligence before engaging a processor and should document the processing relationship through a suitable agreement.

What Should a PIC-PIP Agreement Cover?

Section 44 of the NPC Implementing Rules requires a contract or other binding legal act. Check the actual terms, not just a document titled “Data Processing Agreement.”

Scope: subject matter, duration, nature and purpose, personal-data types, data-subject categories, PIC rights and obligations, and geographic processing location.
Instructions: documented processing instructions, including international transfers unless authorized by law; a duty to flag instructions the PIP considers unlawful.
People and security: confidentiality obligations and appropriate security measures.
Other processors: prior PIC instruction before engaging another processor, with the same data-protection obligations carried through.
Assistance: support for data-subject requests and the PIC’s compliance duties.
Exit and oversight: deletion or return at the PIC’s choice, including copies unless lawful storage applies; compliance information and audit or inspection cooperation.

Assign operational contacts for incidents, requests and service termination. A signed agreement does not remove the PIP’s own statutory duties or the PIC’s accountability: see Sections 45 and 50.

Copyable processing-role worksheet

Complete one entry per activity, not one permanent label per vendor. This is a practical working record, not an NPC form or a substitute for examining the actual arrangement.

Activity and business purpose:
Data types / people affected:
Who decides what is collected and why:
Who carries out the documented instructions:
Proposed PIC / PIP for this activity:
Contract clause and actual practice supporting that view:
Any separate use by the vendor:
Processing and storage locations:
Other processors involved / PIC instruction:
Duration / return or deletion arrangement:
Contact for requests, incidents and contract exit:
Unresolved issue / responsible person / follow-up date:

Example (hypothetical): separate a provider’s processing of a client’s payroll from its use of its own billing contacts. Record the purpose and decision-maker for each; do not assume one label answers both.

What to do next

Ask the service owner and vendor to complete the worksheet using the contract and actual data flow.
Compare each outsourced activity with the Section 44 checklist. Record missing terms, unknown locations and unexplained separate uses.
Send the gaps to your DPO or privacy lead and the contract owner for clarification and correction. Escalate disputed roles or proposed independent reuse for legal assessment before treating the classification as settled.

Role classification is only one part of compliance. Check the lawful basis, transparency and safeguards for the activity as well.

Responsibilities of Personal Information Controllers

A PIC’s responsibilities can include ensuring that personal-data processing has an appropriate legal basis, providing transparency, respecting data subject rights, implementing safeguards, governing retention, supervising processors, and responding appropriately to security incidents and data breaches.

A PIC should also understand what personal information it processes and whether any of that data qualifies as sensitive personal information.

Responsibilities of Personal Information Processors

A PIP is not merely a passive vendor with no privacy obligations. The Data Privacy Act and NPC guidance impose relevant security, confidentiality and compliance responsibilities on processors as well.

What If a Processor Uses the Data for Its Own Purpose?

If a service provider begins independently deciding why personal data will be used, the legal analysis may change. If a vendor receives customer data solely to provide a contracted service but later decides to reuse that data for its own unrelated marketing, profiling or product-development purpose, it may no longer be acting only as a processor for that activity.

Do PICs and PIPs Need to Register With the NPC?

The National Privacy Commission operates the NPC Registration System (NPCRS) for registration of Data Protection Officers and Data Processing Systems under applicable NPC rules.

The NPC’s current 2026 registration guidance expressly recognizes both PICs and PIPs as users of the registration system. Whether a particular organization or processing system must register depends on the applicable registration rules and thresholds.

Common Classification Mistakes

We use their software, so they are automatically the controller

Not necessarily. A software company may simply process data under the customer’s instructions.

We outsourced the data, so it is no longer our responsibility

Incorrect. Outsourcing does not automatically remove the PIC’s accountability.

A vendor can only ever be a processor

Incorrect. The same vendor may act as a PIP for client data and as a PIC for its own independent processing activities.

The contract label decides the legal role

Not by itself. The real issue is who actually determines the purpose or extent of processing.

Frequently Asked Questions

What is the simplest difference between a PIC and PIP?

The PIC decides; the PIP processes.

Is an employer a PIC?

Usually, an employer acts as a PIC for employee information when it determines why and how that employee data is processed.

Is a cloud provider a PIP?

It can be when it processes or stores personal data on behalf of a client and under that client’s instructions.

Can a processor make its own decisions?

A processor can make operational decisions necessary to provide the service, but if it independently determines a separate purpose for using the data, its legal role for that processing may change.

Does the PIC remain responsible after outsourcing?

Yes.

Can a company be both PIC and PIP?

Yes. Classification depends on the specific processing activity.

Do both PICs and PIPs need security controls?

Yes. Both should implement reasonable and appropriate measures relevant to the personal data they process and their role.

Official Sources

Related Cybercode Guides

Disclaimer

Important: This article provides general educational information about Philippine law, regulation, cybersecurity, technology, or business compliance. It is not legal advice and does not create an attorney-client relationship. Laws, agency procedures, technical standards, platform rules, and the facts of each situation may change the result. Verify current requirements through the cited official sources and seek qualified professional advice when your rights, deadlines, money, safety, or legal exposure may be affected.

Personal Information Controller vs Personal Information Processor