Legal Resource · RA 10173

Data Privacy Act

Republic Act No. 10173 makes every organisation that handles personal data accountable for how that data is obtained, secured, and eventually disposed of.

Data Privacy Act of 2012

Governs the collection, processing, storage, and disclosure of personal information by both government and the private sector, and creates the National Privacy Commission.

Core principles

Transparency — the data subject must be informed of the nature, purpose, and extent of processing.
Legitimate purpose — processing must be compatible with a declared and lawful purpose.
Proportionality — processing must be adequate, relevant, and not excessive.

Rights of the data subject

Right to be informed, to object, and to access one's personal data.
Right to rectification of inaccurate or erroneous data.
Right to erasure or blocking of unlawfully obtained data.
Right to damages and the right to data portability.

Obligations of personal information controllers

Appoint a Data Protection Officer and register the data processing system with the NPC where required.
Implement organisational, physical, and technical security measures.
Notify the NPC and affected data subjects within 72 hours of a qualifying personal data breach.
Execute data sharing and outsourcing agreements with processors and third parties.

Penalties and consequences

What is at stake.

Unauthorised processing: imprisonment of one to six years and fines of PHP 500,000 to PHP 4,000,000.
Accessing personal information due to negligence: similar imprisonment and fines.
Concealment of a security breach: imprisonment of one and a half to five years and fines up to PHP 1,000,000.
Responsible officers of a juridical entity may be held personally liable.

How I can help

Counsel on Data Privacy Act matters.

I conduct privacy impact assessments, draft privacy notices and data sharing agreements, prepare NPC registrations and breach notifications, and represent organisations in NPC investigations.

Request a consultation

This page is general information about Philippine law and does not constitute legal advice or create an attorney-client relationship.

Related laws

RA 9262