Legal Resource · RA 10173
Data Privacy Act
Republic Act No. 10173 makes every organisation that handles personal data accountable for how that data is obtained, secured, and eventually disposed of.
Data Privacy Act of 2012
Governs the collection, processing, storage, and disclosure of personal information by both government and the private sector, and creates the National Privacy Commission.
What the law is for
- Republic Act No. 10173 protects the personal information of individuals held by both government and private organizations. It is administered by the National Privacy Commission (NPC), which issues rules, investigates complaints, and enforces compliance.
Key terms
- Personal information is any information that identifies a person, such as a name, address, email, or phone number.
- Sensitive personal information is a more protected category. It includes health records, government-issued ID numbers, and details about a person's religion, political affiliation, ethnicity, marital status, or legal proceedings.
- Data subject is the person the information is about, such as your customer, client, or employee.
- Personal information controller is the business or organization that decides why and how personal data is collected and used. That is most businesses.
Three principles behind every requirement
- Transparency: people should know what you collect, why, and how you use it.
- Legitimate purpose: collect and use data only for a stated, lawful purpose.
- Proportionality: collect only what you actually need, and keep it only as long as necessary.
Consent is not the only basis
- Many businesses assume they always need written consent. Consent is one lawful basis, but the law also allows processing when it is necessary to perform a contract, comply with a legal obligation, protect someone's life or health, or serve a legitimate interest that does not override the person's rights. Sensitive personal information has stricter conditions, and consent is often required.
Your customers' and employees' rights
- Individuals can ask what data you hold, request corrections, object to certain uses, and ask that their data be blocked or removed in appropriate cases. They can also seek damages and file complaints with the NPC. You need a simple way to receive and answer these requests.
What your business must do
- Appoint a Data Protection Officer (DPO). This person is accountable for compliance. In a small business it may be the owner or a trusted staff member.
- Publish a privacy notice that plainly states what you collect, why, who receives it, and how long you keep it.
- Secure the data. Use sensible organizational, physical, and technical measures: locked cabinets, passwords, limited access, and staff training.
- Prepare for a breach. Have a written plan so you can act quickly.
- Check whether you must register your data processing systems with the NPC (see below).
Reporting a data breach
- If sensitive personal information, or data that could be used for identity fraud, is likely to have fallen into unauthorized hands and creates a real risk of serious harm, you must notify the NPC and the affected individuals within 72 hours of learning about it. Reporting is done through the NPC's online system. Practically, this means someone in your business must know who decides, who reports, and how.
Do you have to register with the NPC?
- Registration of your data processing systems and DPO is mandatory if you employ at least 250 people, process sensitive personal information of at least 1,000 individuals, or carry out processing likely to pose a risk to people's rights and freedoms. Smaller businesses outside those categories may still need to submit a sworn declaration confirming they are not covered. Because these rules have been updated, confirm your status before relying on any exemption.
What happens if you don't comply
- Violations can lead to NPC compliance orders and administrative fines, criminal penalties including imprisonment and fines that can reach several million pesos, and civil liability for damages to affected individuals.
A quick self-check
- Do you know what personal data you collect and where it is stored?
- Is a DPO named, and do your staff know who it is?
- Do you have a privacy notice that customers and employees can easily find?
- Are your files, devices, and accounts protected with limited access and strong passwords?
- Do you have a written plan for responding to a breach within 72 hours?
- Have you confirmed whether NPC registration applies to you?
Penalties and consequences
What is at stake.
- Unauthorised processing: imprisonment of one to six years and fines of PHP 500,000 to PHP 4,000,000.
- Accessing personal information due to negligence: similar imprisonment and fines.
- Concealment of a security breach: imprisonment of one and a half to five years and fines up to PHP 1,000,000.
- Responsible officers of a juridical entity may be held personally liable.
How I can help
Counsel on Data Privacy Act matters.
I conduct privacy impact assessments, draft privacy notices and data sharing agreements, prepare NPC registrations and breach notifications, and represent organisations in NPC investigations.
Request a consultationThis page is general information about Philippine law and does not constitute legal advice or create an attorney-client relationship.