Philippines Privacy & Data Protection Laws

Section 6 gives the Act unusually explicit extraterritorial reach for its vintage: it applies to acts done or practices engaged in outside the Philippines where the entity has a link to the Philippines and processes personal information about Philippine citizens or residents — with 'link' illustrated by having a Philippine office, branch or agency, being a Philippine-incorporated entity, or using equipment located in the Philippines. Section 4 exempts, among other things, information about government officials in their official capacity, journalistic/artistic/literary purposes, research, and certain regulatory and foreign-jurisdiction processing. The National Privacy Commission requires registration of data processing systems by qualifying controllers, appointment of a Data Protection Officer, breach notification within 72 hours, and privacy impact assessments; criminal penalties attach to several violations, which is a meaningfully different risk profile from purely administrative regimes.

Like Canada and Australia, the Philippines uses accountability rather than prohibition. s. 21 makes the personal information controller responsible for personal information under its control or custody, including information transferred to a third party for processing whether domestically or internationally, and requires contractual or other reasonable means to provide a COMPARABLE level of protection while the third party processes it. There is no adequacy list and no filing. The practical route is the one the NPC supplied in Advisory No. 2024-01, which published Model Contractual Clauses that controllers and processors may build into their agreements — voluntary templates rather than a mandated instrument, but the clearest available evidence of comparable protection. Note the Philippines also distinguishes data sharing from outsourcing, each with its own agreement requirements under the Act's implementing rules.

The statutory trigger is narrow and specific: notification is owed where sensitive personal information, or information that could enable identity fraud, is reasonably believed to have been acquired by an unauthorized person AND the acquisition is likely to give rise to a real risk of serious harm. Where it applies, NPC Circular 16-03 gives 72 hours from knowledge or reasonable belief to notify BOTH the National Privacy Commission and the affected data subjects — the Philippines does not split the two onto different clocks or different thresholds the way the GDPR does. Delay is permitted only to determine scope, prevent further disclosure, or restore system integrity, and is not permitted at all where at least 100 data subjects are affected or where disclosing the sensitive personal information will harm the data subject.