The Data Privacy Act: A 2025 Primer for Businesses

R.A. 10173 (Data Privacy Act of 2012)

The DPA regulates the processing of personal information in the Philippines. The National Privacy Commission (NPC) enforces it.

Core obligations of personal information controllers

1. Register with the NPC (especially if you process sensitive personal information or have ≥ 1,000 data subjects).
2. Appoint a Data Protection Officer (DPO).
3. Maintain a Privacy Impact Assessment and privacy policies.
4. Notify the NPC and affected data subjects of data breaches that affect personal data.
5. Honor data subject rights: access, correction, erasure, objection, portability, and the right to be informed.

Penalties

Violations can carry fines and imprisonment (Sec. 25–34). Directors and officers may be held criminally liable.

This article is general information and not legal advice.