Regulations › Rest of world › Philippines
DPA (Philippines)
Data Privacy Act of 2012 (Philippines)
WhenEnacted in August 2012 (Republic Act No. 10173)
Who enforces itNational Privacy Commission (NPC)
Who it applies toPersonal information controllers and processors in the Philippines.
Tell the regulatorNotify the NPC within 72 hours of knowledge of a breach involving sensitive or fraud-enabling…
DPO requiredEvery personal information controller and processor must designate a DPO or accountable indivi…
RegistrationRegister processing systems and DPO if 250+ employees, sensitive data of 1,000+ individuals, o…
Transfers abroadNo adequacy regime
Request deadlineRespond without undue delay and within 30 working days, extendable by 15 working days for comp…
Maximum fineCriminal fines up to PHP 5 million
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Reach and lawful basis
Reach abroad
2
Applies to processing outside the Philippines of citizens' or residents' data where the entity has a Philippine link (contract, branch, business, data collected there).s.6 · secondary source · source ↗
Lawphil reproduction of the official RA text. Link requirement keeps this below level 3.
Lawful basis
1
Multiple bases: consent, contract, legal obligation, vital interests, public order, public authority and legitimate interests.s.12(a)-(f); IRR s.21 · secondary source · source ↗
Lawphil reproduction of the official RA text.
Consent
3
Consent must be freely given, specific and informed, and evidenced by written, electronic or recorded means.s.3(b) · secondary source · source ↗
Lawphil reproduction of the official RA text. 'Evidenced by written, electronic or recorded means' clause not returned verbatim by the fetch tool; widely reported.
Sensitive data
2
Processing sensitive and privileged information is prohibited except for listed cases such as specific consent, legal authorization or medical emergencies.s.13; IRR s.22 · secondary source · source ↗
Lawphil reproduction of the official RA text.
Children
0
No child-specific rule or age threshold in the Act; age is listed as sensitive personal information.s.3(l)(1) · secondary source · source ↗
Lawphil reproduction of the official RA text. NPC issued an advisory on digital platforms and children's privacy in Sep 2026 (content not reviewed).
People's rights
Rights
2
Right to be informed, access, rectification, erasure or blocking, objection (incl. direct marketing), portability and damages.ss.16, 18; IRR s.34 · source ↗
Counted: access, correction, deletion, portability, objection. Right to be informed covers automated decisions but there is no right to contest them.
Request deadline
1
Respond without undue delay and within 30 working days, extendable by 15 working days for complex requests.NPC Advisory 2021-01 s.5(E) · source ↗
Regulator advisory hosted on dataguidance.com. 30 working days exceeds 30 calendar days. Draft NPC circular on data subject rights published Sep 2026.
Marketing
1
Data subjects have a right to object to direct marketing; processing must stop on objection.IRR s.34(b) · source ↗
Governance
DPO required
3
Every personal information controller and processor must designate a DPO or accountable individual, and register one DPO.s.21(b); IRR s.26(a); Circular 2022-04 s.8 · source ↗
DPO qualifications
1
No certification required; NPC's Data Privacy Competency Program is voluntary training, not a professional certification.NPC Circular 2023-02; DPCP FAQ · source ↗
Expertise expectations in NPC Advisory 2017-01 not re-opened.
Registration
2
Register processing systems and DPO if 250+ employees, sensitive data of 1,000+ individuals, or risky processing; renew annually.Circular 2022-04 ss.5, 14, 18; IRR ss.46-47 · source ↗
Non-registration fine PHP 50,000-200,000 (Circular 2022-01).
DPIA
3
A privacy impact assessment should be conducted for every processing system that involves personal data.NPC Circular 2023-06 s.5 · secondary source · source ↗
Circular text not read; Thales brief quotes 'should'. Draft NPC circular on PIAs reported 2026.
Records
2
Maintain records describing processing systems, purposes, data categories, flows, retention, security measures and accountable persons.IRR s.26(c) · source ↗
Retention
1
Retain only as long as necessary for the declared purpose, legal claims or legitimate business purposes, then dispose securely.s.11(e); IRR s.19(d) · source ↗
Breaches
Tell the regulator
2
Notify the NPC within 72 hours of knowledge of a breach involving sensitive or fraud-enabling data with real risk of serious harm.s.20(f); IRR s.38(a) · source ↗
Tell people
3
Notify affected data subjects within the same 72 hours when the breach meets the notification trigger.s.20(f); IRR s.38(a) · source ↗
Risk-conditioned but with a fixed deadline.
Transfers
Transfers abroad
1
No adequacy regime; controller stays accountable for data sent abroad and must ensure comparable protection by contract or other means.s.21(a); IRR s.44 · secondary source · source ↗
Lawphil reproduction of the official RA text.
Enforcement
Maximum fine
1
Criminal fines up to PHP 5 million; administrative fines up to 3% of annual gross income, capped at PHP 5 million (about USD 86k) per act.ss.25-33; Circular 2022-01 s.2 · source ↗
Criminal liability
3
Broad offenses with 1 to 6 years' imprisonment; responsible officers of corporations who participated or were grossly negligent are punished.ss.25-34 · secondary source · source ↗
Lawphil reproduction of the official RA text.
Private action
2
Data subjects may be indemnified for damages from inaccurate or unlawful processing.s.16(f); IRR s.34(f) · source ↗
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws