Philippines

Republic Act No. 10173, the Data Privacy Act of 2012, covers in section 4 any person or company that uses or stores personal data. That includes those outside the Philippines who use equipment located in the country, or who keep an office, branch or agency there. Section 6 extends the Act to things done outside the Philippines. It applies where the information concerns Philippine citizens or residents, where a contract is entered into in the Philippines, or where the company carries on business in the Philippines. The regulator takes the same line in its own rules. NPC Circular No. 2023-06 says it applies to anyone using personal data 'within and outside of the Philippines'. The 250-employee figure in the Implementing Rules is not an exemption from the law. It is only a threshold in the registration rules. It does not apply where the work is likely to pose a risk to rights and freedoms, or involves sensitive personal information of at least 1,000 people. NPC Circular No. 2022-04 lists what a foreign private company must file to register. That is an authenticated or apostilled secretary's certificate appointing the data protection officer, a general information sheet or equivalent, a registration certificate and a business permit, all with English translations.

General position: open (data can leave freely). Nothing in Republic Act No. 10173 or its Implementing Rules restricts sending data abroad. There are only three transfer-specific duties. You stay accountable for data you hand to anyone else. A supplier may send data to another country only on your written instructions. You must disclose planned transfers outside the Philippines when you register a system. INDUSTRY OVERRIDES CHECKED ON 18 AUGUST 2026: - Banking and other supervised financial institutions (data can leave only if conditions are met). The Manual of Regulations for Banks, Section 112, lets a bank outsource its domestic operations abroad only on two conditions. The central bank may order the bank to end the activity, change it, or bring it back in-house. It can do that if customer confidentiality, customer redress or its own ability to supervise cannot be assured. A local subsidiary of a foreign bank may use its parent group abroad without prior approval. It still carries the main liability to customers for the foreign provider's errors and fraud. - Payments and e-money (data can leave only if conditions are met). The same Manual applies. The technology risk rules expressly extend to institutions that handle data abroad. - Government and public sector (data can leave only if conditions are met, and a hard stop for bulk work). Republic Act No. 10173 section 23 requires the head of the agency to approve any off-site or online access to sensitive personal information by agency staff. It caps that access at 1,000 records. Section 24 brings government contractors under the same rules and requires them to register. NPC Circular No. 2023-06 adds detailed security duties on top. - Insurance (no override found). We reviewed the Insurance Commission's published circular letters for 2021 to 2026 on 18 August 2026. We found nothing on cloud, outsourcing, storage location or data privacy. No rule found, confidence medium. - Securities and markets, health, telecoms, education, mapping and geospatial, defence (no override found, checked 18 August 2026, confidence low to medium). We could not reach several regulator websites, so this is a gap rather than a clean negative. See 'unconfirmed'. - Gambling (unverified). The gaming regulator's public pages carry only land-based casino manuals. We could not obtain the remote-gaming standards that are widely believed to require gaming servers to sit in the Philippines. Treat as unknown.

The model is unrestricted, but you stay accountable. Republic Act No. 10173 section 21 says each company that decides how data is used is responsible for that data, including data it hands to a third party. It must use contracts or other reasonable means to give the data comparable protection. Implementing Rules section 44(b)(1) requires a supplier to act 'only upon the documented instructions of the personal information controller, including transfers of personal data to another country or an international organization, unless such transfer is authorized by law'. Implementing Rules section 47(a)(5) requires 'proposed transfers of personal data outside the Philippines' to be declared in the registration filing. NPC Advisory No. 2024-01 published model contract clauses on 30 May 2024. It is explicit that they are voluntary: 'This guidance is intended for voluntary adoption and does not impose any additional rights or duties' and 'The NPC does not require contractual parties to adopt the use of MCCs.' The Advisory also says the Commission will not accept requests to review agreements for conformity. The Philippines also takes part in cross-border privacy certification work, including the Global Cross-Border Privacy Rules arrangements and the ASEAN model contract clauses. None of that is a precondition to sending data abroad.

The National Privacy Commission has been operating since 2016. It is currently led by Privacy Commissioner and Chairman Atty. Johann Carlos S. Barcena, with Deputy Privacy Commissioners Atty. Jose Amelito S. Belarmino and Atty. Juan Paolo F. Fajardo. Here is what it did in the last two years. It issued a cease and desist order in case CID CDO 25-001 against World App, dated 23 September 2025. On 8 October 2025 it announced a cease and desist order against Tools For Humanity. It issued breach-notification enforcement orders against DMCI Project Developers in April 2024, PLDT in May 2024, HSBC in August 2024 and a hospital operator in August 2024. It concluded an investigation into a reported GCash data exposure in October 2025 and found no breach. It issued new binding circulars in 2024 and 2025 on closed-circuit television and body-worn cameras. It issued new advisories in 2026 on data scraping and on breach notification. NPC Circular No. 2022-01 sets administrative fines of 0.5 to 3 percent of the previous year's annual gross income for grave infractions, and 0.25 to 2 percent for major ones. The cap is five million pesos for a single act, roughly ninety thousand United States dollars. We could not find a specific named company fined a specific peso amount under that circular on the Commission's own published pages. That is the one weak point. The Commission cannot bring criminal charges itself. It recommends prosecution to the Department of Justice. The Bangko Sentral ng Pilipinas separately supervises banks. It enforces its own outsourcing, technology-risk and incident-reporting rules, with directives and penalties on institutions, directors and officers.

MAXIMUM. The Data Privacy Act says personal data may be kept only as long as it is needed for the declared purpose. NPC Circular No. 2023-06 requires you to set and write down keeping periods. You must dispose of data by methods that make any further use impossible, such as degaussing, secure wiping or shredding. NPC Advisory No. 2026-01 repeats the point for scraped data. It 'shall be retained only for as long as necessary' for the declared purpose. The same circular says security logs need to be kept longer than ordinary system logs, but it fixes no number. MINIMUM. Manual of Regulations for Banks Section 172: 'Records shall be retained for a period of at least five (5) years, unless they are otherwise required by law or other regulations, or as directed by the Bangko Sentral to be retained for a longer period'. Records touching an unresolved supervisory examination issue must be kept until that issue is finally resolved. Manual of Regulations for Banks Section 924 sets more. Customer identification records must be kept as long as the account exists. Transaction records must be kept five years from the transaction. Records of closed accounts and ended relationships must be kept at least five years after closure. Where a money laundering case has been filed, records must be kept beyond five years, until the Anti-Money Laundering Council secretariat confirms the case is finally resolved. Electronic copies of covered and suspicious transaction reports must be kept at least five years from submission. HOW CONFLICTS RESOLVE. The privacy law's keeping limit gives way to another law that requires you to keep the record. Using data to comply with a legal duty is a lawful basis. So a legal minimum period beats the privacy maximum. That applies only to those records, and only for that period. Tax and company minimum periods are real and important in the Philippines. We could not confirm them from an official government source. See 'unconfirmed'.

CLOCK ONE, privacy, 72 hours. NPC Circular No. 16-03 and the Implementing Rules require you to notify the Commission and the affected people within seventy-two hours. The clock starts when you know of, or reasonably believe in, a notifiable breach. Notification is compulsory when three things are true together. The data is sensitive personal information, or information that could enable identity fraud. There is reason to believe an unauthorised person acquired it. And that is likely to give rise to a real risk of serious harm. Not being able to restore the system yet is expressly not a reason to delay. In May 2026 the Commission issued Advisory No. 2026-02. It clarified that breach notifications go through its Data Breach Notification Management System. CLOCK TWO, banking, 2 hours then 24 hours. Manual of Regulations for Banks Section 148 sets this. The compliance officer, or a designated officer, must notify the right supervising department of the central bank within two hours. The clock starts on discovering a reportable major cyber-related incident, or a disruption of financial services. The notice must state at least the nature of the incident and the system or business function involved. A fuller written report follows within twenty-four hours. A service disruption lasting more than two hours can itself be reportable. CLOCK THREE, annual. All covered organisations file an annual security incident report. It summarises every incident and breach, classified by impact on availability, integrity and confidentiality. The Commission set 31 March 2026 as the deadline for the 2025 report. The overlap is the trap. A card-data incident at a bank triggers the two-hour central bank clock, the seventy-two-hour privacy clock and the annual report. The two-hour clock starts at discovery. That is usually earlier than the point where you 'reasonably believe' the privacy test is met.

1. CHILDREN ARE UNDER EIGHTEEN. NPC Advisory No. 2024-03 defines a child as 'a person below eighteen (18) years of age'. It extends the definition to adults who cannot protect themselves because of a disability. If your product copied a thirteen or sixteen year old threshold from another market, you are breaking the rules by several years. The same advisory bans designs that nudge children toward choices that reduce their privacy. 2. PRISON, NOT JUST FINES. Republic Act No. 10173 carries criminal penalties. Unauthorised use of personal information carries one to three years. For sensitive personal information it is three to six years. Careless access to sensitive personal information carries three to six years. Concealing a security breach carries one and a half to five years. A combination of offences carries three to six years, with fines up to five million pesos, roughly ninety thousand United States dollars. These attach to responsible individuals. The Commission does not prosecute. It refers cases to the Department of Justice. So the timeline is a criminal one, outside the regulator's control. 3. REGISTRATION IS COMPULSORY, AND IT IS A REAL FILING. Under NPC Circular No. 2022-04 you must register if you have 250 or more employees. You must also register if you handle sensitive personal information of at least 1,000 people, or if your work is likely to pose a risk to rights and freedoms. Any system doing automated decision-making or profiling must be registered, with no size threshold at all. Registration is due within twenty days of putting the system in place, or of appointing the data protection officer. Foreign companies must supply authenticated or apostilled documents with English translations. That takes weeks. 4. BANK DEPOSIT SECRECY IS CRIMINAL AND SEPARATE. The banking rules treat disclosure of deposit information as a criminal matter, under Republic Act No. 1405 and the foreign currency deposit law, Republic Act No. 6426. That sits apart from privacy compliance. A standard data protection contract with a cloud provider does not create the depositor's written permission those laws require. The banking rules record that a person who discloses in breach of them is treated as having violated those statutes. 5. GOVERNMENT DATA CANNOT LEAVE THE BUILDING IN BULK. Republic Act No. 10173 section 23 requires the head of the agency to approve any off-site or online access by agency staff to sensitive personal information. It caps that at one thousand records. Section 24 applies the same rules to government contractors, who must also register. A contractor planning a shared-services model abroad for a government client hits this before it hits any transfer rule. 6. THE REGULATOR'S SECURITY RULES FOLLOW YOU ABROAD. NPC Circular No. 2023-06 applies by its own terms to work done 'within and outside of the Philippines'. Moving the servers abroad does not take you outside the detailed security rules.

LANDING OR JUST LANDED, all verified on the regulator's own site: - NPC Advisory No. 2026-01, Guidelines on Data Scraping of Publicly Available Personal Data, dated 13 April 2026. It is guidance, not a binding circular. But it sets out what the Commission expects. Declare a specific purpose. Identify a lawful basis. Tell people before you scrape. Run a privacy impact assessment. Do not scrape sensitive personal information unless you can show a lawful basis and safeguards. This is the item most likely to hit artificial-intelligence training pipelines. - NPC Advisory No. 2026-02, dated 11 May 2026, moving breach notification onto the Commission's Data Breach Notification Management System. - A public consultation open in August 2026 on updated privacy impact assessment guidelines. They would replace guidance dating from 2017. - NPC Advisory No. 2024-04, issued 19 December 2024, applying the privacy law to artificial intelligence systems. Also NPC Circular No. 2025-01 on body-worn cameras. Both are already in effect. PROPOSED ONLY, NOT BINDING. Changes to Republic Act No. 10173 have been pushed since at least 2021. That year a substitute bill was approved in committee in the House of Representatives. The package would give the Commission summons, subpoena and contempt powers. It would add biometric and genetic data to the sensitive categories. It would set a digital age of consent. And it would let courts choose between imprisonment and a fine. We could not confirm from an official source what stage, if any, this has reached in the current Congress. Do not plan around it. POWERS THAT MATTER MORE THAN THE BILLS: - The Commission can issue binding circulars without new legislation. It has done so repeatedly, most recently on closed-circuit television in 2024 and body-worn cameras in 2025. A rule keeping data in the country, or restricting transfers, would need no act of Congress. It would only need publication. - NPC Circular No. 2023-06 already claims reach over work done outside the Philippines. So a future security or storage requirement could be applied to companies with no office there, on the same basis. - The central bank can order a supervised institution to end an arrangement abroad, or bring the activity back in-house. It can do that whenever it judges that customer confidentiality or its own supervisory access cannot be assured. That is a power used one institution at a time, with no notice. No published list will warn you. - Government cloud policy is set by department circular, not by statute. It can be rewritten without Congress.