Philippines Data Privacy Act of 2012

Why does it matter?

RA 10173 is a criminal statute as much as a regulatory one. Chapter VIII punishes unauthorized processing, negligent access, improper disposal, processing for unauthorized purposes, intentional breach, concealment of a breach, malicious and unauthorized disclosure with imprisonment and fines from Php 100,000 to Php 5,000,000 (Secs. 25 to 33), with the maximum imposed when at least 100 persons are affected (Sec. 35), and it reaches the responsible officers of a corporation (Sec. 34). The NPC can issue cease-and-desist orders and ban processing (Sec. 7(c)) and recommends prosecution to the Department of Justice (Sec. 7(i)).

Key benefits include:

• A single accountable owner

Sec. 21 makes the personal information controller responsible for data under its control, including data outsourced or transferred abroad, and requires it to designate the individual or individuals accountable for compliance and to disclose them on request.

• Clear rules for sensitive data

Processing sensitive personal information and privileged information is prohibited except in the six cases in Sec. 13, starting with consent specific to the purpose, which keeps high-risk data on a documented legal basis.

• A defined breach clock

Sec. 20(f) requires prompt notice to the NPC and affected data subjects, and IRR Sec. 38 fixes it at 72 hours from knowledge or reasonable belief of a breach that is likely to cause real risk of serious harm.

• Data subject rights that can be exercised

Secs. 16 to 18 give the right to be informed, to access, to correct, to suspend or block, to damages and to data portability, with Sec. 17 extending them to heirs and assigns.

• Security proportionate to risk

Sec. 20(c) ties the level of security to the nature of the data, the risks, the size and complexity of the organization, current best practices and cost, and lists the minimum measures a controller must have.

How does it work?

Processing is allowed subject to transparency, legitimate purpose and proportionality (Sec. 11), and personal information must be collected for specified and legitimate purposes, processed fairly and lawfully, accurate, adequate and not excessive, retained only as long as necessary and kept identifiable no longer than needed (Sec. 11(a) to (f)). Sec. 12 lists the six criteria that make processing lawful: consent, contract, legal obligation, vital interests, public order or public authority, and legitimate interests not overridden by the data subject's constitutional rights. Sec. 13 restricts sensitive and privileged information to its own six cases.

Before entry into a processing system, or at the next practical opportunity, the data subject is told what will be processed, for what purposes, by what method, to which recipients, how automated access works, who the controller is, how long data is kept and what rights exist (Sec. 16(b)); access, correction, blocking and indemnity follow (Sec. 16(c) to (f)). Security under Sec. 20 means organizational, physical and technical measures that must include network safeguards, a security policy, a vulnerability process and regular monitoring for breaches; IRR Secs. 26 to 28 detail each class, from data protection policies and records of processing to encryption in storage and transit.

Accountability runs through contracts and people. A controller may subcontract processing but remains responsible for safeguards (Sec. 14; IRR Sec. 44), and must designate who is accountable for compliance (Sec. 21(b)). The IRR adds registration with the NPC for controllers and processors with 250 or more employees, or fewer where processing is risky, not occasional or involves sensitive personal information of at least 1,000 individuals (Sec. 47), notification of automated decision-making (Sec. 48), written reports of all security incidents with an annual summary to the NPC (Sec. 41) and one year from the IRR's effectivity to register (Sec. 67).

Key Elements

• Definitions (Sec. 3)

Commission, consent of the data subject (freely given, specific, informed, and evidenced by written, electronic or recorded means), data subject, direct marketing, filing system, information and communications system, personal information, personal information controller, personal information processor, processing, privileged information and sensitive personal information; the IRR adds personal data breach, security incident and data sharing (IRR Sec. 3).

• Scope and extraterritorial application (Secs. 4 to 6)

All types of personal information and all processors of it, including foreign controllers using equipment or offices in the Philippines; seven exclusions for government officers' and contractors' work information, discretionary benefits, journalistic, artistic, literary or research purposes, public authority functions under laws such as RA 1405 and RA 9510, bank compliance with RA 9160, and foreign-collected data processed in the Philippines (Sec. 4); links that trigger application abroad (Sec. 6).

• The National Privacy Commission (Secs. 7 to 10)

Seventeen functions in Sec. 7, from compliance monitoring, complaints, investigation and indemnity awards to cease-and-desist orders, privacy codes, advisory opinions and cross-border cooperation; attached to the Department of Information and Communications Technology and headed by a Privacy Commissioner with two Deputies on three-year terms (Sec. 9).

• Principles and lawful processing (Secs. 11 to 15)

Transparency, legitimate purpose and proportionality with the six data-quality rules (Sec. 11); the six lawful criteria (Sec. 12); the six permitted cases for sensitive and privileged information (Sec. 13); subcontracting with the controller still responsible (Sec. 14); privileged communication (Sec. 15).

• Rights of the data subject (Secs. 16 to 19)

To be informed, furnished the Sec. 16(b) particulars, given reasonable access, to dispute and correct, to suspend, withdraw or block, and to be indemnified (Sec. 16); transmissibility to heirs (Sec. 17); data portability in a structured, commonly used electronic format (Sec. 18); carve-outs for scientific research and investigations (Sec. 19).

• Security and breach notification (Sec. 20; IRR Rules VI and IX)

Reasonable and appropriate organizational, physical and technical measures sized to risk, with four minimum components (Sec. 20(a) to (d)); confidentiality of staff (Sec. 20(e)); prompt notice of breaches involving sensitive personal information or data enabling identity fraud (Sec. 20(f)), set at 72 hours with required contents, delay rules and reports in IRR Secs. 38 to 42.

• Accountability, government data and registration (Secs. 21 to 24; IRR Rule XI)

Controller accountability for transfers and the designated accountable individual (Sec. 21); security clearances, the 1,000-record limit and encryption for off-site access to sensitive personal information held by agencies (Sec. 23); registration by government contractors handling 1,000 or more individuals (Sec. 24); the IRR's 250-employee and 1,000-individual registration thresholds (Sec. 47).

• Penalties (Secs. 25 to 37)

Imprisonment of six months to seven years and fines of Php 100,000 to Php 5,000,000 across eight offenses, with higher ranges for sensitive personal information; combination of acts (Sec. 33), liability of responsible officers and deportation of aliens (Sec. 34), the large-scale rule at 100 persons (Sec. 35), double disqualification for public officers (Sec. 36) and restitution under the Civil Code (Sec. 37).

What does it cover?

RA 10173 applies to the processing of all types of personal information and to any natural and juridical person involved in it, in the government or the private sector, including controllers and processors outside the Philippines that use equipment located in the country or maintain an office, branch or agency there (Sec. 4). It also applies to acts done abroad that relate to personal information about a Philippine citizen or resident where the entity has a link with the country, such as a contract entered there, central management and control there, or a local branch whose parent has access to the data (Sec. 6). Sec. 4(a) to (g) lists what falls outside; IRR Sec. 4 restates the scope.

What are its objectives?

Sec. 2 declares the State's policy, and the Act's chapters turn it into these outcomes:

Protect the fundamental human right of privacy of communication while ensuring the free flow of information to promote innovation and growth (Sec. 2).

Secure personal information in information and communications systems in both the government and the private sector (Sec. 2 and Sec. 20).

Allow processing only on the principles of transparency, legitimate purpose and proportionality and on a lawful criterion (Secs. 11 to 13).

Give data subjects notice, access, correction, blocking, indemnity and portability, and a route to complain to the NPC (Secs. 16 to 18; Sec. 7(b)).

Hold the personal information controller accountable for data it transfers or outsources, at home or abroad (Sec. 21).

Bring the country into line with international data protection standards through an independent Commission (Sec. 7).

Framework in Context

The Act keeps earlier Philippine laws intact where they overlap: the Secrecy of Bank Deposits Act (RA 1405), the Foreign Currency Deposit Act (RA 6426), the Credit Information System Act (RA 9510) and the Anti-Money Laundering Act (RA 9160) remain in force for the processing they govern (Sec. 4(e) and (f)), and journalists keep the source protection of RA 53 (Sec. 5). Sec. 44 amended Sec. 7 of the Human Security Act of 2007. The NPC sits under the Department of Information and Communications Technology (Sec. 9) and may approve voluntary privacy codes (Sec. 7(j)). The 2016 IRR added the records of processing, the 72-hour notice and registration that practitioners work from. The Act is not a transposition of any foreign law.

Common Framework Mappings

Organizations that also answer to other privacy regimes map RA 10173 and its IRR to the laws and privacy management standards below so that one records-of-processing set, one breach procedure and one rights process can serve all of them.

Mapped frameworks include:

APEC PF

GDPR

ISO 27001:2022

ISO 27701

NIST Privacy Framework v1.0

OECD Privacy Guidelines

Singapore PDPA

SOC 2