Data Privacy Act of 2012

## Data Privacy Act of 2012 (R.A. No. 10173)

### Scope Applies to the processing of all types of personal information and to any natural and juridical person involved in personal information processing, including those outside the Philippines if they process data of Philippine data subjects (Sec. 4).

### Key definitions (Sec. 3) - **Personal information** — any information from which the identity of an individual is apparent or can be reasonably and directly ascertained. - **Sensitive personal information** — about race, ethnicity, health, religion, sexual orientation, etc. - **Personal information controller (PIC)** — the person who controls the processing; **Personal information processor (PIP)** — who processes on behalf of a controller.

### Obligations - **Sec. 16.** PICs must implement reasonable and appropriate organizational, physical, and technical security measures. - **Sec. 21.** Registration with the National Privacy Commission. - **Sec. 23.** Appointment of a Data Protection Officer. - **Sec. 25–34.** Penalties: imprisonment and fines; unauthorized access/processing, improper disposal, breaches.

### Data subject rights (Sec. 16, DPA Rules) Right to be informed, right to object, right to access, right to rectify, right to erasure or blocking, right to damages, right to data portability, and the right to complain to the NPC.

### Enforcement The National Privacy Commission (NPC) investigates complaints and can impose administrative fines and recommend criminal prosecution.