← Global Privacy Laws Research Library
Republic Act No. 10173: Data Privacy Act of 2012
Data Privacy Act of 2012: Philippines
Prepared by Shubhank Suman · Last reviewed
CURRENT
- Legal character
- National statute
- Region
- Asia-Pacific
What it covers
The Act regulates personal information processing by:
- government
- private-sector organisations
- personal information controllers
- personal information processors.
It established the National Privacy Commission.
AI, privacy and cybersecurity relevance
- AI: Very High
- Privacy: Very High
- Cyber: Very High
AI
VERY HIGH
The Philippine privacy framework is particularly relevant to AI because NPC rules and guidance recognise:
- automated processing
- profiling
- automated decisionmaking
- data-subject objections
- notification concerning automated decisionmaking.
Cybersecurity
VERY HIGH
Section 20 is the principal security provision.
Applicability
Government and private-sector organisations within the statutory scope.
Current validity
CURRENT AND OPERATIVE.
The NPC continues to publish the Act and implementing framework as the principal Philippine privacy regime. (National Privacy Commission)
Read first
Sections 11–13 → Sections 16–17 → Section 20 → NPC IRR → automated decisionmaking guidance → breach/security guidance → penalties.
Provisions / sections covered
Sections 11–12: General principles/processing conditions
Processing must comply with:
- transparency
- legitimate purpose
- proportionality
- lawful basis.
Section 13: Sensitive personal information
Contains additional requirements for sensitive information.
Sections 16–17: Data-subject rights
Include:
- access
- correction
- object
- erasure/blocking
- compensation
- data portability under the broader regulatory framework.
Section 20: Security
This is one of the Act's most important provisions.
Controllers must implement reasonable and appropriate:
- organisational
- physical
- technical
measures to protect information from unlawful destruction, alteration, disclosure or other unlawful processing. The Act expressly requires measures to account for the nature of the data, risks, organisational size/complexity, current security practices and implementation costs. (National Privacy Commission)
Sections 25 onward: Penalties
The Act includes criminal penalties for:
- unauthorised processing
- negligent access
- improper disposal
- unauthorised disclosure
- malicious disclosure.
Subject-matter tags
- Lawful basis
- Consent
- Sensitive data
- Data subject rights
- Erasure and deletion
- Data portability
- Profiling
- Automated decision-making
- Cross-border transfers
- Data protection officer
- Controller and processor
- Enforcement and penalties
- Transparency
- Accountability
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.