Last materially reviewed: September 2, 2026
Direct Answer
Under the Philippine Data Privacy Act, a data subject has the right to obtain reasonable access to personal data being processed about them, including information about how and why that data is processed. A practical access request should identify you, describe the information you want, and ask the organization or its Data Protection Officer to provide the relevant data and processing details.
Primary authority: National Privacy Commission — Data Subject Rights.
Key Takeaways
- The right of access lets you see personal data an organization holds about you.
- You can also ask for information about sources, recipients, purposes, processing methods, and certain automated processes where applicable.
- Make the request in writing and keep proof of delivery.
- The organization may need to verify your identity before releasing personal data.
- If access is improperly denied, you may raise the issue with the NPC.
Jump to a Section
What Can You Ask For?
An access request may cover the personal data being processed, the sources from which it was obtained, the names or categories of recipients, the manner of processing, the reasons for disclosure, information on automated processes where relevant, the date when data was last accessed or modified, and the identity and address of the PIC.
Decision Snapshot
| Question | Use the right of access? |
|---|---|
| What data does this company hold about me? | Yes |
| Who received my personal data? | Potentially yes |
| My data is wrong | Use access first if needed, then rectification |
| I want the data deleted | Use the separate right to erasure or blocking |
How to Make the Request
- Contact the company or its DPO in writing.
- State that you are exercising your right of access under the Data Privacy Act.
- Identify the account, transaction, service, or data set involved.
- Specify what information or processing details you want.
- Provide reasonable proof of identity if requested.
- Keep copies of the request and response.
What If Access Is Denied?
Ask the organization to explain the legal basis for its refusal or limitation. If you believe your data-subject rights were violated and the issue is not resolved, review How to File a Data Privacy Complaint With the NPC.
How Is This Different From the General Rights Guide?
Data Privacy Rights in the Philippines is the hub for all rights. This page is the dedicated procedural guide for exercising access.
Related Guides
If you discover an error, see Right to Correct Personal Data Under the Data Privacy Act. If you want qualifying data removed, see Can You Ask a Company to Delete Your Personal Data?
Frequently Asked Questions
Can I ask a company what personal data it holds about me?
Yes. The right of access allows a data subject to request information about personal data being processed, subject to applicable legal limits and verification requirements.
What should an access request identify?
State who you are, what information or processing activity you are asking about, and provide enough detail for the organization to locate the relevant records without requesting unnecessary personal data.