71%
of Philippines's 21 requirements are already met by European Union (GDPR). Here is what DPA (Philippines) adds, biggest gaps first.
DPO requiredGovernanceBig gap
GDPR1 DPO required for public bodies, large-scale systematic monitoring, or large-scale special-category or criminal data processing.
DPA (Philippines) adds3 Every personal information controller and processor must designate a DPO or accountable individual, and register one DPO.
s.21(b); IRR s.26(a); Circular 2022-04 s.8 · source ↗
RegistrationGovernanceBig gap
GDPR0 No general registration; controllers communicate DPO contact details to the supervisory authority.
DPA (Philippines) adds2 Register processing systems and DPO if 250+ employees, sensitive data of 1,000+ individuals, or risky processing; renew annually.
Circular 2022-04 ss.5, 14, 18; IRR ss.46-47 · source ↗
Criminal liabilityEnforcementBig gap
GDPR1 Member States set other penalties, including criminal penalties, for infringements not subject to administrative fines.
DPA (Philippines) adds3 Broad offenses with 1 to 6 years' imprisonment; responsible officers of corporations who participated or were grossly negligent are punished.
ss.25-34 · source ↗
ConsentReach and lawful basisGap
GDPR2 Consent must be freely given, specific, informed and unambiguous by clear affirmative action, and the controller must be able to demonstrate it.
DPA (Philippines) adds3 Consent must be freely given, specific and informed, and evidenced by written, electronic or recorded means.
s.3(b) · source ↗
DPIAGovernanceGap
GDPR2 DPIA required before processing likely to result in high risk; prior consultation if residual high risk remains.
DPA (Philippines) adds3 A privacy impact assessment should be conducted for every processing system that involves personal data.
NPC Circular 2023-06 s.5 · source ↗
Tell peopleBreachesGap
GDPR2 Notify affected individuals without undue delay when the breach is likely to result in high risk.
DPA (Philippines) adds3 Notify affected data subjects within the same 72 hours when the breach meets the notification trigger.
s.20(f); IRR s.38(a) · source ↗
Already covered by GDPR: Reach abroad, Lawful basis, Sensitive data, Children, Rights, Request deadline, Marketing, DPO qualifications, Records, Retention, Tell the regulator, Transfers abroad, Localization, Maximum fine, Private action.
A gap means DPA (Philippines) is more demanding than GDPR on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.
