Regulations › Rest of world › Philippines
DPA (Philippines)
Data Privacy Act of 2012 (Philippines)
WhenEnacted in August 2012 (Republic Act No. 10173)
Who enforces itNational Privacy Commission (NPC)
Who it applies toPersonal information controllers and processors in the Philippines.
Tell the regulatorNotify the NPC within 72 hours of knowledge of a breach involving sensitive or fraud-enabling…
DPO requiredEvery personal information controller and processor must designate a DPO or accountable indivi…
RegistrationRegister processing systems and DPO if 250+ employees, sensitive data of 1,000+ individuals, o…
Transfers abroadNo adequacy regime
Request deadlineRespond without undue delay and within 30 working days, extendable by 15 working days for comp…
Maximum fineCriminal fines up to PHP 5 million
Data protection authority National Privacy Commission (NPC)
- Address
- 25th to 27th Floors, The Upper Class Tower, Quezon Avenue corner Scout Reyes Street, Quezon City✓
- info@privacy.gov.ph ✓
- Complaints
- complaints@privacy.gov.ph ✓
- Phone
- +63 2 5322 1322 ✓
- Website
- privacy.gov.ph
- Register
- Registration portal✓
- Breaches
- Report a breach✓
Checked 18 Oct 2026. ✓ confirmed on the authority's own site. Report a change
Local help in Philippines
Law firms, training centers and other providers in Philippines can apply to be listed here. We check each one before it shows.
List your organizationRegulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws