Data Subject Rights in the Philippines: Access, Correction, and Erasure

The Data Privacy Act of 2012 (Republic Act No. 10173) grants every individual in the Philippines specific rights over their personal information. These are called data subject rights. If a company, government office, or any organization holds your personal data, you have the legal right to know what they have, ask for corrections, and even demand its deletion. This article explains each right in plain language and how to exercise them under the law.

What Are Data Subject Rights?

A "data subject" is any individual whose personal, sensitive personal, or privileged information is processed. "Processing" covers almost everything done with your data, including collection, recording, storage, updating, use, and even erasure or destruction.

The Implementing Rules and Regulations (IRR) of the Data Privacy Act, specifically Rule VIII, outlines the rights of the data subject. These rights apply whether the data is held by a private company or a government agency.

The Right to Be Informed

Before an organization collects your personal data, it must inform you of several things. This is called the right to be informed. The data subject must know:

• What personal data will be collected
• How it will be used
• Who will have access to it
• Whether it will be shared with third parties

This is why privacy notices and consent forms exist. If an organization collects your data without telling you how it will be used, it violates this right.

The Right to Object

You have the right to object to the processing of your personal data. This includes objecting to processing for direct marketing, profiling, or automated decision-making. If you object, the organization must stop processing your data unless it can show a legitimate or compelling reason to continue.

The Right to Access

The right to access allows you to request a copy of your personal data held by an organization. Upon request, the personal information controller must provide:

• Confirmation that your data exists and is being processed
• A description of the personal data held
• The purposes for which it is being processed
• The recipients or classes of recipients to whom it has been disclosed

This right helps you verify whether an organization is holding accurate and lawful information about you.

The Right to Correct

If the personal data held about you is inaccurate or incomplete, you have the right to correct it. You may request the organization to rectify errors in your records. The organization must act on your request promptly and ensure that the corrected data is accurate and up to date.

The Right to Erasure or Blocking

The right to erasure or blocking allows you to demand the deletion or blocking of your personal data under certain circumstances. This applies when:

• The data is no longer necessary for the purpose it was collected
• You withdrew your consent and there is no other legal basis for processing
• The processing is unlawful
• The data is outdated or no longer accurate

When you exercise this right, the organization must stop processing your data and remove it from their systems or block access to it.

The Right to Data Portability

Under the IRR, data subjects also have the right to data portability. This means you can request a copy of your personal data in a structured, commonly used, and machine-readable format. This allows you to transfer your data from one organization to another, such as when switching service providers.

How to Exercise Your Rights

To exercise any of these rights, you should submit a formal request to the organization holding your data. The request should clearly state which right you are exercising and provide enough information for the organization to verify your identity. The organization must respond within a reasonable period and comply with valid requests.

If the organization refuses or fails to act, you may file a complaint with the National Privacy Commission (NPC). The NPC has the power to receive complaints, investigate violations, and impose sanctions.

Frequently Asked Questions

Can I request my data from any company? Yes, if the company processes your personal data and the Data Privacy Act applies. You can request access, correction, or erasure of your personal information.

How long does a company have to respond to my request? The IRR does not specify an exact number of days. The organization must act within a reasonable period, depending on the nature and complexity of the request.

What if a company refuses to delete my data? If the company has a legitimate legal basis to keep your data, it may refuse. If you believe the refusal is unjustified, you can file a complaint with the National Privacy Commission.

Practical Takeaways

• Know your rights. Every individual in the Philippines has the right to be informed, object, access, correct, and demand erasure or blocking of personal data.
• Request in writing. Submit a formal request to the organization holding your data, and keep a copy for your records.
• Verify your identity. Organizations may require proof of identity before releasing personal data to prevent unauthorized access.
• Escalate to the NPC. If your request is ignored or denied without valid reason, file a complaint with the National Privacy Commission.
• Act promptly. If you believe your data is inaccurate or being misused, exercise your rights as soon as possible.

This article is general information and not legal advice. For your specific situation, consult a lawyer or ask ASG Legal AI.