Data Privacy Act
Data Privacy Act of 2012 (Republic Act No. 10173)
The Data Privacy Act of 2012 is the Philippines' general data protection law, approved on 15 August 2012, with its Implementing Rules and Regulations in force since 2016. The National Privacy Commission administers it through circulars on breach notification, registration and security, and it carries criminal as well as administrative penalties.
Who it applies to
Any natural or juridical person processing personal information in the Philippines, and processing outside the Philippines that relates to Philippine citizens or residents or uses equipment located in the country. Controllers with 250 or more employees, or processing sensitive personal information of 1,000 or more individuals, must register with the NPC.
Identity requirements
- Process sensitive personal information, including government-issued identifiers, only on the specific grounds the law allows, such as consent
- Appoint a data protection officer and conduct privacy impact assessments
- Implement organizational, physical and technical security measures, including access controls
- Notify the NPC and affected data subjects within 72 hours of knowledge of a qualifying personal data breach
- Register data processing systems with the NPC where thresholds are met
How it impacts identity systems
| Identity area | Impact |
|---|---|
| Identity verification (KYC/proofing) | PhilSys numbers and other government IDs are sensitive personal information, so eKYC needs a lawful basis and strong safeguards. |
| Breach notification | A 72-hour notification window applies to the NPC and affected individuals. |
| Audit, logging & accountability | DPO appointment, privacy impact assessments and NPC registration are core accountability duties. |
Penalties
The Act sets criminal penalties of imprisonment and fines for offences such as unauthorized processing, access due to negligence and concealment of breaches; the heaviest, for a combination or series of unlawful acts, is three to six years' imprisonment and a fine of 1 million to 5 million pesos. The NPC can also impose administrative fines under its circulars.
Status and dates last verified against primary sources on 2026-10-31.
Data Privacy Act: frequently asked questions
- How fast must a breach be reported in the Philippines?
- Within 72 hours of knowledge of, or reasonable belief in, a qualifying breach, to both the National Privacy Commission and affected data subjects.
- Does the Data Privacy Act carry criminal penalties?
- Yes. Unlike most privacy laws, RA 10173 defines criminal offences with prison terms and fines, in addition to the NPC's administrative powers.