Cross-Border Data Transfer Mechanisms in the Philippines: How the Data Privacy Act Applies

The Philippines does not require a separate government permit before personal data may be sent abroad. Instead, the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations (NPC IRR) regulate cross-border transfers through accountability. A personal information controller remains responsible for personal data even after it is transferred to another jurisdiction, and must ensure that the receiving party applies adequate protections. The law also reaches processing done outside the Philippines when the entity, the data subject, or the processing itself has a link to the country.

What counts as a cross-border data transfer

A cross-border data transfer happens when personal data is disclosed or moved to a third party located in another country. Under the NPC IRR, data sharing is the disclosure or transfer to a third party of personal data under the custody of a personal information controller or personal information processor. If the transfer is made by a personal information processor, it must be upon the instructions of the personal information controller.

The IRR distinguishes data sharing from outsourcing, which is the disclosure or transfer of personal data by a personal information controller to a personal information processor. Both arrangements can cross borders, but they carry different roles and obligations.

When the Data Privacy Act reaches processing abroad

Section 4 of the NPC IRR states that the Act and the Rules apply to processing by any natural or juridical person in the government or private sector, and apply to acts done or practices engaged in outside the Philippines if any of these links is present:

• The person involved in the processing is found or established in the Philippines;
• The act, practice, or processing relates to personal data about a Philippine citizen or Philippine resident;
• The processing is being done in the Philippines; or
• The act, practice, or processing is done by an entity with links to the Philippines.

The IRR lists examples of such links, including use of equipment located in the country, maintaining an office, branch, or agency in the Philippines for processing, entering into a contract in the Philippines, having central management and control in the country, carrying on business in the Philippines, or collecting or holding personal data in the Philippines.

Who remains accountable after the transfer

Section 50 of the NPC IRR is titled Accountability for Transfer of Personal Information. The principle is that a personal information controller stays answerable for personal data in its custody, including when that data is transferred to another party or to another jurisdiction. The controller cannot contract away its responsibility to data subjects.

This means that before transferring personal data abroad, the controller should be able to show that the receiving party is bound to protect the data and to uphold the rights of data subjects. The NPC IRR also requires that any authorized further processing have adequate safeguards, and that personal data not be retained longer than necessary.

The role of the National Privacy Commission

The National Privacy Commission (NPC) administers and implements the Data Privacy Act and monitors the country's compliance with international standards for personal data protection. Under Section 9 of the NPC IRR, its compliance and monitoring functions include:

• Negotiating and contracting with other data privacy authorities for cross-border application and implementation of respective privacy laws;
• Performing acts necessary to facilitate cross-border enforcement of data privacy protection; and
• Ensuring compliance by personal information controllers with the Act.

The NPC may also issue compliance or enforcement orders, impose administrative fines, and issue cease and desist orders where necessary to protect data subjects.

How to approach a cross-border transfer

There is no single prescribed form for a cross-border transfer under the source rules. What the law demands is accountability and adequate safeguards. In practice, a personal information controller should:

1. Identify the personal data to be transferred and the purpose for the transfer.
2. Confirm the lawful basis for processing, such as the consent of the data subject or another lawful ground.
3. Determine whether the receiving party is a personal information processor or a separate controller, since the obligations differ.
4. Put in place safeguards and arrangements that keep the receiving party bound to protect the data.
5. Retain the data only as long as necessary for the stated purpose.

Frequently asked questions

Does the Philippines require NPC approval for cross-border data transfers? The NPC IRR does not require a separate approval for every cross-border transfer. The controller must instead comply with the Data Privacy Act, uphold the rights of data subjects, and remain accountable for the data after transfer.

When does the Data Privacy Act apply to processing outside the Philippines? Under Section 4 of the NPC IRR, it applies when the entity is found or established in the Philippines, when the processing relates to personal data about a Philippine citizen or resident, when the processing is done in the Philippines, or when an entity with links to the Philippines is involved.

What is the difference between data sharing and outsourcing? Data sharing is the disclosure or transfer of personal data to a third party. Outsourcing is the disclosure or transfer of personal data by a personal information controller to a personal information processor.

Practical takeaways

• The Philippines regulates cross-border transfers mainly through accountability, not prior government approval.
• A personal information controller remains responsible for personal data even after it is transferred abroad.
• The Data Privacy Act can apply to processing outside the Philippines where a link to the country exists under Section 4 of the NPC IRR.
• Distinguish data sharing from outsourcing, because the roles of the parties and their obligations differ.
• The NPC coordinates with foreign data privacy authorities for cross-border enforcement.

Primary sources

The rules discussed above are drawn from the following primary sources, as published in the Official Gazette and the national statute book.

• NPC IRR OF REPUBLIC ACT NO. 10173, August 24, 2016

• IRR OF REPUBLIC ACT NO. 10173 - IMPLEMENTING RULES AND REGULATIONS OF REPUBLIC ACT NO. 10173, KNOWN AS THE “DATA PRIVACY ACT OF 2012”

• NPC CIRCULAR NO. 2014-014, April 25, 2014

This article is general information and not legal advice. For your specific situation, consult a lawyer or ask ASG Legal AI.