Privacy Notice Requirements in the Philippines: What the Data Privacy Act Requires

A privacy notice in the Philippines is the document that tells people what personal data an organization collects, why it collects it, and what rights they can exercise over it. The requirement comes from the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations. Under the IRR, personal data must be collected for a specified and legitimate purpose, processed fairly and lawfully, kept accurate, retained no longer than necessary, and protected by adequate safeguards. The right to be informed is the first right listed for data subjects — and a clear privacy notice is how organizations give effect to it.

What a privacy notice must communicate

A privacy notice is the practical expression of two principles in the IRR: transparency and legitimate purpose. The IRR's Rule IV sets out the principles of transparency, legitimate purpose, and proportionality, and Rule IV's provisions on collection, processing, and retention require that collection be for a specified and legitimate purpose and that personal data be processed fairly and lawfully.

In plain terms, a compliant notice answers:

• What personal data is collected — including whether any of it is sensitive personal information, such as health, education, or government-issued numbers.
• Why it is collected — the specific, legitimate purpose.
• How it will be processed and how long it will be kept.
• Who it may be shared with.
• How the person can exercise their rights.

Who must issue one

The Data Privacy Act and its IRR apply to the processing of personal data by any natural or juridical person in the government or private sector. The IRR's scope provision also reaches certain acts done or practices engaged in outside the Philippines — for example, where the processing relates to personal data about a Philippine citizen or resident, or where the entity collects or holds personal data in the Philippines.

Any organization that processes personal data — as a personal information controller or a personal information processor — should therefore have a privacy notice. The IRR defines a personal information controller as the person or body who controls the processing of personal data or instructs another to process it on its behalf. A personal information processor is the person or body to whom a controller may outsource or instruct the processing of personal data.

The rights a privacy notice must support

The IRR's Rule VIII lists the rights of the data subject. A privacy notice should make these rights understandable and explain how to invoke them:

• Right to be informed — the right that a privacy notice most directly serves.
• Right to object — to object to processing.
• Right to access — to know what data is held.
• Right to correct — to have inaccurate data corrected.
• Right to rectification, erasure, or blocking — to have data rectified, erased, or blocked.

The IRR also provides for transmissibility of these rights and a right to data portability, and it recognizes that the rights are subject to limitations.

Notices and consent are not the same thing

Consent under the IRR is any freely given, specific, informed indication of will by which a data subject agrees to the collection and processing of their personal, sensitive personal, or privileged information. Consent must be evidenced by written, electronic, or recorded means.

A privacy notice is not, by itself, consent. A notice informs; consent is a separate act of agreement. Where an organization relies on consent as its basis for processing, the notice should be clear enough that the person understands what they are agreeing to.

When the rules do not apply

The IRR's Rule II lists special cases where the Act and the Rules do not apply, but only to the minimum extent of collection, access, use, disclosure, or other processing necessary to the purpose, function, or activity concerned. These include personal information processed for journalistic, artistic, or literary purposes, for research intended for public benefit, and information necessary to carry out the functions of public authority.

Even then, the IRR is careful: those claiming an exemption still bear the burden of proving it, and any determination of exemption is liberally interpreted in favor of the rights and interests of the data subject.

How the National Privacy Commission enforces compliance

The National Privacy Commission is the independent body mandated to administer and implement the Act and to monitor compliance with international standards for personal data protection. Among its functions, the Commission issues compliance or enforcement orders, imposes administrative fines for violations, and can award indemnity on matters affecting personal data or the rights of data subjects.

The Commission also manages the registration of personal data processing systems in the country. Under its compliance and monitoring functions, this includes the personal data processing system of contractors and their employees entering into contracts with government agencies that involve accessing or requiring sensitive personal information of at least one thousand (1,000) individuals.

Frequently asked questions

Is a privacy notice required by Philippine law? The Data Privacy Act and its IRR require that data subjects be informed about the processing of their personal data and that processing be transparent. A privacy notice is the standard way organizations meet that obligation.

What should a privacy notice contain? At minimum, what personal data is collected, the specific and legitimate purpose, how it is processed and retained, who it may be shared with, and how the person can exercise their rights under the IRR.

Who needs to issue a privacy notice? Any natural or juridical person in the government or private sector that processes personal data, including personal information controllers and personal information processors covered by the IRR's scope provision.

Practical takeaways

• A privacy notice is how an organization gives effect to the data subject's right to be informed under the IRR of the Data Privacy Act.
• It must reflect the principles of transparency, legitimate purpose, and proportionality.
• Explain the data subject's rights — to be informed, to object, to access, to correct, and to rectification, erasure, or blocking — and how to exercise them.
• A privacy notice is not the same as consent; consent must be a separate, freely given, specific, and informed indication of will.
• Exemptions under the IRR are narrow, and the burden of proving an exemption rests on the party claiming it.

Primary sources

The rules discussed above are drawn from the following primary sources, as published in the Official Gazette and the national statute book.

• NPC IRR OF REPUBLIC ACT NO. 10173, August 24, 2016

• IRR OF REPUBLIC ACT NO. 10173 - IMPLEMENTING RULES AND REGULATIONS OF REPUBLIC ACT NO. 10173, KNOWN AS THE “DATA PRIVACY ACT OF 2012”

• NPC CIRCULAR NO. 2014-014, April 25, 2014

This article is general information and not legal advice. For your specific situation, consult a lawyer or ask ASG Legal AI.