Philippines Data Privacy Act
In force Philippines · In force Sep 8, 2012 · no upcoming deadlines
Deadlines
| Date | What happens | When |
|---|---|---|
| Sep 9, 201610 years ago | Implementing Rules take effecttentative | 10 years ago |
| Sep 8, 201214 years ago | Data Privacy Act takes effecttentative | 14 years ago |
Summaries for reference, not legal advice. Check the official text.
What it does
The Philippines' general data privacy law. It sets consent and lawful processing rules, protects sensitive personal information, gives data subjects access, correction, erasure and portability rights, and creates the National Privacy Commission. Its 2016 Implementing Rules require breach notice to the NPC and affected people within 72 hours, plus registration of data processing systems.
- Who it applies to
- Personal information controllers and processors in the Philippines, and those outside it that process data of Philippine citizens or residents or use equipment in the Philippines.
- Penalties
- Criminal penalties, for example 1 to 3 years in prison and PHP 500,000 to 2 million for unauthorized processing, or 3 to 6 years and up to PHP 4 million for sensitive information. The NPC can also issue compliance and stop orders.
- Enforced by
- National Privacy Commission (NPC)
- Official name
- Data Privacy Act of 2012 (Republic Act No. 10173)
- Citation
- Republic Act No. 10173
- Topics
- privacy, breach-notification
Research notes
The NPC page shows the approval date (15 Aug 2012) but not the publication or start dates. Penalty figures come from the Act text as given on LawPhil.
Related
Questions about Philippines Data Privacy Act
- What are the Philippines Data Privacy Act compliance deadlines?
- Sep 8, 2012: Data Privacy Act takes effect (tentative). Sep 9, 2016: Implementing Rules take effect (tentative).
- When does Philippines Data Privacy Act take effect?
- Philippines Data Privacy Act took effect on Sep 8, 2012.
- Who does Philippines Data Privacy Act apply to?
- Personal information controllers and processors in the Philippines, and those outside it that process data of Philippine citizens or residents or use equipment in the Philippines.
- What are the penalties under Philippines Data Privacy Act?
- Criminal penalties, for example 1 to 3 years in prison and PHP 500,000 to 2 million for unauthorized processing, or 3 to 6 years and up to PHP 4 million for sensitive information. The NPC can also issue compliance and stop orders.