Right to Access Personal Data in the Philippines: DSAR Letter Template

Last materially reviewed: September 6, 2026

Direct Answer

Yes. Section 16(c) of Republic Act No. 10173 gives a data subject in the Philippines the right to reasonable access, upon demand, to the personal data an organisation holds about them, together with its sources, recipients, purposes and processing history. You exercise it by sending a written request to the controller’s Data Protection Officer. The right is real, but it is not absolute.

Key Takeaways

• The right of access is in Section 16(c) of RA 10173 and repeated in Section 34(c) of the Implementing Rules and Regulations (IRR), Rule VIII. It covers far more than a copy of your file.
• RA 10173 and the IRR prescribe no response deadline that we could verify. The National Privacy Commission does: NPC Advisory No. 2021-01, Section 5(E) requires compliance without undue delay and within thirty (30) working days of receiving the request and any needed supporting documents, extendable by not more than another fifteen (15) working days for complex or numerous requests.
• Access covers your own personal data. It does not reach other people’s data, and NPC guidance excludes a company’s internally generated business analysis.
• A controller may verify your identity before releasing anything, and may lawfully refuse in defined situations.
• Before you can complain to the NPC, Rule II, Section 2 of NPC Circular 2021-01 requires that you first informed the controller in writing and that fifteen (15) calendar days passed without timely or appropriate action.
• Dated proof of the request and of delivery is what makes a later complaint viable.
• Access gets you a copy. Deletion is a separate right with separate grounds.

Jump to a Section

• Decision snapshot
• Governing law and authorities
• What the right of access actually entitles you to
• Exceptions, limits and lawful refusals
• Philippine scenarios (hypothetical)
• Evidence and documentation
• Step-by-step procedure
• Remedies and realistic outcomes
• Common mistakes
• The DSAR letter template
• Frequently asked questions
• Related Cybercode guides
• Official sources
• Disclaimer

Decision Snapshot

Your situation	Does the right of access apply?	What defeats it	Next step
A bank, telco, insurer or employer holds records about you	Yes — core Section 16(c) case	Failure to identify yourself adequately	Send a written request to the Data Protection Officer
You want to know who your data was disclosed to and why	Yes — Section 16(c) expressly covers recipients and reasons for disclosure	Data gathered for investigation of criminal, administrative or tax liability (Section 19)	Ask specifically for recipients, addresses and disclosure reasons
You want a machine-readable copy to move to a competitor	Use Section 18 portability alongside Section 16(c)	Data not processed electronically or not in a structured, commonly used format	Cite both provisions in one letter
The data concerns a deceased or incapacitated relative	Yes, if you are a lawful heir or assign (Section 17)	No proof of heirship or authority attached	Attach death certificate and proof of relationship
A private individual keeps notes about you for personal reasons	Usually no	Section 3(h) excludes an individual processing data for personal, family or household affairs from the definition of controller	The Data Privacy Act is probably the wrong instrument
You want the data erased, not copied	Different right	—	See Can You Ask a Company to Delete Your Personal Data?

Governing Law and Authorities

The operative provision is Section 16(c) of RA 10173, the Data Privacy Act of 2012, which entitles the data subject to reasonable access, upon demand, to a defined list of items. The same enumeration is carried into Rule VIII, Section 34(c) of the IRR, published by the National Privacy Commission.

Three neighbouring provisions matter. Section 16(b) gives you the right to be informed of the description of the data, the purposes and scope of processing, the classes of recipients, the controller’s identity, the storage period and the existence of your rights. Section 17 makes the rights transmissible to lawful heirs and assigns on death or incapacity. Section 18 gives a separate right to data portability where the data is processed by electronic means in a structured and commonly used format.

The practical operating rules come from NPC Advisory No. 2021-01 on Data Subject Rights, which sets the response period, the identity-verification standard and the recognised grounds for declining a request. An NPC advisory is guidance issued by the regulator rather than a provision of the statute, and that distinction matters if a controller disputes the timeline. It is nevertheless the only source we could verify that fixes a number of days, and it is the NPC’s own published expectation of controllers it regulates.

Escalation is governed by NPC Circular 2021-01, the 2021 Rules of Procedure, as amended by NPC Circular 2024-01. Rule XII, Section 6 of the 2021 Rules repealed the older NPC Circular 16-04, so any guide still citing 16-04 for complaint procedure is out of date.

What the Right of Access Actually Entitles You To

Section 16(c) is a list, not a general slogan. Asking for each item by name is what separates a request that gets a full answer from one that gets a one-line brush-off.

1. The contents of the personal information processed

This is the copy of your data itself — the account record, the application file, the transaction history, the notes held about you.

2. The sources from which the data was obtained

Where did they get it? From you, from a broker, from a credit bureau, from a referral, from a public record? This is often the most useful item and the one most often skipped.

3. The names and addresses of recipients

Not just categories — the provision speaks of names and addresses of recipients of the data.

4. The manner by which the data was processed

How the processing was actually carried out.

5. The reasons for disclosure to recipients

Why each recipient received your data.

6. Information on automated processes

Where the personal data is or is likely to be made the sole basis for a decision significantly affecting you, you are entitled to information about that automated process. This is the provision to invoke when an application is refused by a scoring model.

7. The date the data was last accessed and modified

Useful for reconstructing who touched a record and when.

8. The designation, name or identity and address of the controller

Who is legally answerable. This is what you need before you can name a respondent in an NPC complaint.

Related entitlements worth adding to the same letter

NPC guidance on the right to access also frames the entitlement as beginning with confirmation of whether your data is being processed at all, along with the categories of data, the purposes and the retention period. Where the data is held electronically in a structured, commonly used format, Section 18 lets you ask for it in that electronic or structured format rather than as a printout.

Exceptions, Limits and Lawful Refusals

A refusal is not automatically a violation. These are the limits a Philippine controller can legitimately rely on.

Statutory non-applicability under Section 19

Section 19 of RA 10173, mirrored in Rule VIII, Section 37 of the IRR, switches off the access, correction and blocking rights where the processed data is used only for the needs of scientific and statistical research, no activities are carried out and no decisions are taken regarding the data subject, and confidentiality is maintained. Section 19 also disapplies those rights to personal information gathered for the purpose of investigations in relation to any criminal, administrative or tax liability.

Processing outside the Act’s scope under Section 4

Section 4 lists categories the Act does not apply to, including information about a government officer or employee relating to the position or functions held; information about an individual performing services under contract for a government institution; information relating to discretionary government benefits such as licences and permits; personal information processed for journalistic, artistic, literary or research purposes; information necessary for a public authority to carry out constitutionally or statutorily mandated functions; information necessary for banks and financial institutions to comply with anti-money-laundering obligations; and personal information originally collected from residents of foreign jurisdictions under their own laws. If your request lands inside one of these, access under the Act may simply not be available.

The respondent may not be a “personal information controller” at all

Section 3(h) defines the personal information controller and expressly excludes a person or organisation performing functions as instructed by another, and an individual who collects, holds, processes or uses personal information in connection with the individual’s personal, family or household affairs. Note where this exclusion sits: it is in the definition in Section 3(h), not in the Section 4 scope list. A request aimed at a private neighbour’s personal notebook usually has no controller to address.

The request must be about you

NPC Advisory No. 2021-01 frames access as covering the requesting data subject’s own personal data. It does not extend to information relating to other people, and the advisory also puts inferred or business-generated material outside the entitlement. A request for “every internal email mentioning me” will usually be trimmed on this basis.

Identity verification

Section 5(B) of the same advisory requires controllers to use reasonable measures to verify the identity of the requesting data subject, and permits them to ask for supporting documents to the extent necessary. A representative must show evidence of authority. Refusing to identify yourself is the fastest way to lose a valid request.

Repetitive, excessive or harmful requests

The advisory recognises that a controller may decline requests that merely repeat an identical earlier request, requests that would require disproportionate effort, and exceptional cases where disclosure could cause serious harm.

What a lawful refusal still owes you

Even a valid refusal should be explained. Ask the controller to state, in writing, which provision it relies on and which parts of the request it is answering. A written refusal with a stated legal basis is useful evidence either way; an unexplained silence is worse for the controller than a reasoned no.

Philippine Scenarios (Hypothetical)

The following are hypothetical illustrations, not decided cases.

Scenario 1: the declined credit card

A Quezon City applicant is refused a card with no reason given. She writes to the bank’s DPO citing Section 16(c), asking for the contents of her file, the sources of the data, and information on any automated process used as the sole basis for the decision. The bank supplies the file and identifies a third-party scoring input she did not know existed. That source is the real target of any follow-up.

Scenario 2: the marketing calls

A Cebu resident starts receiving calls from insurers he never contacted. He sends access requests to two companies asking for sources and for the names and addresses of recipients. One reply names the retailer that sold the list. He now knows which controller to pursue.

Scenario 3: the former employee

A departed employee asks for her personnel records. The employer supplies her own file but withholds portions of an internal investigation report naming colleagues, citing the limits on access to other people’s data. Partial disclosure with a stated basis is a plausible lawful outcome, not necessarily a violation.

Evidence and Documentation

Rule II, Section 2 of NPC Circular 2021-01 conditions a complaint on proof that you informed the controller and that time ran. Build that record from the first letter.

• Proof of identity. Keep a copy of exactly what you sent — the government ID you attached, with unnecessary numbers redacted, and the account or reference number you used.
• Proof that you made the request. A dated, signed letter. Email is acceptable and self-dating; keep the sent item and any read receipt.
• Proof of delivery. Courier waybill and tracking printout, registered mail receipt, or the delivery confirmation for email. This is the single most important document, because the 15-day period in Rule II, Section 2 runs from the controller’s receipt of your written information.
• The controller’s reply. Preserve it in full, including headers and attachments. If the reply is by phone, send a same-day email summarising what you were told and asking for written confirmation.
• A dated log. One line per event: date, what happened, who said what, which document proves it.

For a fuller treatment of what the NPC expects to see, read Evidence for a Data Privacy Complaint in the Philippines.

Step-by-Step Procedure

1. Identify the correct controller. Name the legal entity, not the brand or the app. Check the privacy notice, the terms of service and the SEC or DTI registration name.
2. Find the Data Protection Officer. Most Philippine privacy notices publish a DPO contact. If none is published, address the letter to “The Data Protection Officer” at the registered office and copy any published privacy or customer-service address.
3. Write the request. Use the template below. Cite Section 16(c) and ask for the enumerated items by name. Add Section 18 if you want an electronic, structured copy.
4. Attach identification. One government ID plus your account or reference number. Redact numbers not needed to identify you.
5. Send it so that delivery is provable. Email to the published DPO address, and where the matter is serious, also by courier or registered mail to the registered office.
6. Diarise the deadline. Under NPC Advisory No. 2021-01, Section 5(E), expect compliance within 30 working days of receipt of the request and any supporting documents, with a possible extension of up to 15 further working days for complex or numerous requests. Ask the controller to notify you in writing if it invokes the extension.
7. Send one written follow-up. If nothing arrives, write once more, referencing the original date and delivery proof, and state that you will escalate. This also strengthens the exhaustion record.
8. Escalate to the NPC. Once you have informed the controller in writing and 15 calendar days have passed from its receipt without timely or appropriate action, Rule II, Section 2 of NPC Circular 2021-01 is satisfied. The NPC may waive the requirement for good cause or where a serious violation is alleged. The Commission’s Filing formal complaints page provides the complaint-affidavit form, which must be printed, completed and notarised, then filed in person, by courier or by scanned email. Fees are set by NPC Circular 2023-01. Note also that under Rule IV, Section 1 as amended by NPC Circular 2024-01, a complaint may be dismissed outright where the complainant did not give the respondent an opportunity to address the complaint without justification.

Our walkthrough of the complaint itself is at How to File a Data Privacy Complaint With the NPC.

Remedies and Realistic Outcomes

Be candid with yourself about what an access request produces. In most cases the outcome is disclosure — sometimes partial, sometimes late, occasionally grudging. That disclosure is usually not the end goal; it is the raw material for correction, erasure, a complaint or a claim.

If the controller ignores you, the NPC route is available. NPC proceedings are administrative and can be slow; the Commission investigates, may mediate, and may issue orders against controllers. It maintains a framework for administrative fines under NPC Circular 2022-01. What the NPC does not do is hand you a cheque as a matter of course.

Section 16(f) of RA 10173 gives the data subject a right to be indemnified for damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorised use of personal information. In practice, recovering money on that basis means a civil action in court with proof of actual damage, not merely proof that a letter went unanswered. RA 10173 also creates criminal offences, which are prosecuted by the State rather than pursued privately by the data subject.

Expect months rather than weeks, expect partial answers, and treat a lawful, reasoned refusal as a possible correct outcome rather than an insult. If your access request has revealed a leak or exposure, see What to Do If Your Personal Data Is Leaked in the Philippines and Can You Sue a Company for a Personal Data Leak?

Common Mistakes

• Asking for “all my data” and nothing more. Vague requests get vague answers. Enumerate the Section 16(c) items.
• Sending it by chat or in-app message only. You will struggle to prove receipt, and receipt is what starts the 15-day clock in Rule II, Section 2.
• Citing GDPR. Foreign templates citing EU articles invite a controller to dismiss the request as inapplicable. Cite RA 10173.
• Refusing to identify yourself. Identity verification is expressly contemplated by NPC Advisory No. 2021-01, Section 5(B).
• Demanding other people’s data. Requests for third parties’ information will be trimmed, and an overbroad request can slow the whole response.
• Complaining to the NPC first. Skipping the written notice to the controller risks dismissal under the exhaustion rule and under Rule IV, Section 1 as amended.
• Mixing access and deletion in one confused demand. They are separate rights with separate grounds. Ask for the copy first; decide about erasure afterwards.

The DSAR Letter Template

This is a template to adapt, not a finished legal document. Replace every bracketed field, delete the numbered items you do not need, and check the controller’s published DPO contact details before sending. The annotations after the letter explain why each part is there.

Annotations

• Why the subject line names the section. It converts a customer-service email into a formal exercise of a statutory right and makes internal routing to the DPO more likely.
• Why the eight numbered items. They track the enumeration in Section 16(c) and Rule VIII, Section 34(c). A controller answering a general request can send a screenshot; a controller answering this list has to address sources, recipients and disclosure reasons.
• Why you bound the period. Narrow date ranges reduce the “disproportionate effort” objection recognised in NPC guidance.
• Why the ID is attached and redacted. Verification is expressly permitted, and volunteering it removes the most common stalling reason. Redact what is not needed.
• Why the timeline paragraph is included. It shows you know the NPC’s published expectation and asks for written notice of any extension, which later evidences whether the controller acted timely.
• Why you demand a reasoned refusal. A written refusal citing a provision is testable. Silence is not, and silence is what triggers the 15-day exhaustion period under Rule II, Section 2 of NPC Circular 2021-01.
• Why you ask for acknowledgement. The acknowledgement is your proof of receipt.

Frequently Asked Questions

How long does a Philippine company have to answer my access request?

RA 10173 and its Implementing Rules do not prescribe a number of days that we were able to verify. NPC Advisory No. 2021-01, Section 5(E) sets the regulator’s expectation: without undue delay and within thirty (30) working days of receipt of the request and any necessary supporting documents, extendable by up to fifteen (15) further working days for complex or numerous requests. Treat that as the operative benchmark while recognising its source is an NPC advisory rather than the statute.

Can a company charge me for a copy of my own data?

We found no provision in RA 10173 or the IRR fixing a fee or prohibiting one for responding to an access request. If a controller proposes a charge, ask it to state the basis in writing and keep that reply.

Do I have to contact the company before complaining to the NPC?

Yes, as a general rule. Rule II, Section 2 of NPC Circular 2021-01 requires that you informed the controller in writing and that fifteen (15) calendar days passed from its receipt without timely or appropriate action or response. The NPC may waive this for good cause or where a serious violation is alleged.

Can I ask on behalf of my child or a deceased parent?

Section 17 of RA 10173 makes the rights transmissible to lawful heirs and assigns after death or incapacity, and NPC guidance contemplates requests by an authorised representative on proof of authority. Attach the documents proving your standing.

What if the answer shows the data is wrong, or that I want it gone?

Those are different rights. Correction sits in Section 16(d); erasure or blocking sits in Section 16(e) with its own grounds. Use the access response as the evidence base for whichever you pursue next.

Related Cybercode Guides

• Data Privacy Rights in the Philippines — the hub covering all of the Section 16 rights.
• The Data Privacy Act of the Philippines Explained — background on RA 10173 and the NPC.
• Can You Ask a Company to Delete Your Personal Data? — the erasure and blocking counterpart, with its own demand letter template.
• Right to Correct Personal Data Under the Data Privacy Act — what to do when the access response reveals errors.
• How to File a Data Privacy Complaint With the NPC.
• Evidence for a Data Privacy Complaint in the Philippines.
• What to Do If Your Personal Data Is Leaked in the Philippines.
• Can You Sue a Company for a Personal Data Leak?

Official Sources

• Republic Act No. 10173, Data Privacy Act of 2012 — full text (LawPhil)
• Implementing Rules and Regulations of RA 10173 — National Privacy Commission
• National Privacy Commission — Right to Access
• National Privacy Commission — Data Subject Rights
• NPC Advisories and Circulars, including NPC Advisory No. 2021-01 and NPC Circular 2021-01
• National Privacy Commission — Filing formal complaints

Disclaimer

Important: This article provides general educational information about Philippine law, regulation, cybersecurity, technology, or business compliance. It is not legal advice and does not create an attorney-client relationship. Laws, agency procedures, technical standards, platform rules, and the facts of each situation may change the result. Verify current requirements through the cited official sources and seek qualified professional advice when your rights, deadlines, money, safety, or legal exposure may be affected.