Philippines

Republic Act No. 10173 (the Data Privacy Act of 2012) section 4 covers processing by any natural or juridical person, including those outside the Philippines who use equipment located in the country or maintain an office, branch or agency there. Section 6 extends the Act to acts done outside the Philippines where the information concerns Philippine citizens or residents, where a contract is entered into in the Philippines, or where the entity carries on business in the Philippines. The regulator has taken the same line in its own rules: NPC Circular No. 2023-06 states in its scope clause that it applies to all natural or juridical persons engaged in the processing of personal data 'within and outside of the Philippines'. The 250-employee figure that appears in the Implementing Rules is not an exemption from the law; it is only a threshold in the registration rules, and it is disapplied where the processing is likely to pose a risk to rights and freedoms or involves sensitive personal information of at least 1,000 people. NPC Circular No. 2022-04 sets out a specific document list for foreign private entities registering: authenticated or apostilled secretary's certificate appointing the data protection officer, general information sheet or equivalent, registration certificate and business permit, with English translations.

General regime: open (data can be stored anywhere). Nothing in Republic Act No. 10173 or its Implementing Rules restricts transfer abroad. The only transfer-specific obligations are that the controller stays accountable for data it hands to anyone else, that a processor may transfer to another country only on the controller's documented instructions, and that proposed transfers outside the Philippines must be disclosed when registering a processing system. SECTOR OVERRIDES CHECKED ON 18 AUGUST 2026: - Banking and other supervised financial institutions (data can leave with paperwork). The Manual of Regulations for Banks, Section 112, permits offshore outsourcing of a bank's domestic operations only on two conditions, and the central bank may order the bank to terminate, modify or bring the activity back in-house if customer confidentiality, customer redress or the supervisor's ability to supervise cannot be assured. A local subsidiary of a foreign bank may use its parent group offshore without prior approval, but stays principally liable to customers for the offshore provider's errors and fraud. - Payments and e-money (data can leave with paperwork). Same Manual applies; the technology risk framework expressly extends to institutions with offshore data processing. - Government and public sector (data can leave with paperwork, in practice a wall for bulk work). Republic Act No. 10173 section 23 requires the head of the agency to approve any off-site or online access to sensitive personal information by agency staff, and caps it at 1,000 records. Section 24 pulls government contractors into the same regime and requires them to register. NPC Circular No. 2023-06 adds detailed security duties on top. - Insurance (no override found). We reviewed the Insurance Commission's published circular letters for 2021 to 2026 on 18 August 2026 and found no issuance on cloud, outsourcing, storage location or data privacy. No rule found; confidence medium. - Securities and markets, health, telecoms, education, mapping and geospatial, defence (no override found, checked 18 August 2026, confidence low to medium). We could not reach several regulator websites from this session, so this is a gap rather than a clean negative. See 'unconfirmed'. - Gambling (unverified). The gaming regulator's public regulatory pages carry only land-based casino manuals; we could not obtain the remote-gaming standards that are widely believed to require gaming servers to sit in the Philippines. Treat as unknown.

The model is best described as unrestricted with accountability. Republic Act No. 10173 section 21 states that each personal information controller is responsible for personal information under its control or custody, including information transferred to a third party, and must use contractual or other reasonable means to give it a comparable level of protection. Implementing Rules section 44(b)(1) requires a processor to act 'only upon the documented instructions of the personal information controller, including transfers of personal data to another country or an international organization, unless such transfer is authorized by law'. Implementing Rules section 47(a)(5) requires 'proposed transfers of personal data outside the Philippines' to be declared in the registration filing. NPC Advisory No. 2024-01 published model contractual clauses on 30 May 2024 and is explicit that they are voluntary: 'This guidance is intended for voluntary adoption and does not impose any additional rights or obligations' and 'The NPC does not require contractual parties to adopt the use of MCCs.' The Advisory also states that the Commission will not accept requests to review agreements for conformity. The Philippines also participates in cross-border privacy certification work, including the Global Cross-Border Privacy Rules arrangements and the ASEAN model contractual clauses, but none of that is a precondition to transfer.

The National Privacy Commission has been operating since 2016 and is currently led by Privacy Commissioner and Chairman Atty. Johann Carlos S. Barcena, with Deputy Privacy Commissioners Atty. Jose Amelito S. Belarmino and Atty. Juan Paolo F. Fajardo. Observable evidence of activity in the last two years: a cease and desist order in case CID CDO 25-001 against World App, dated 23 September 2025, and a public announcement on 8 October 2025 of a cease and desist order against Tools For Humanity; breach-notification enforcement orders against DMCI Project Developers (April 2024), PLDT (May 2024), HSBC (August 2024) and a hospital operator (August 2024); a concluded investigation into a reported GCash data exposure in October 2025 that found no breach; new binding circulars in 2024 and 2025 on closed-circuit television and body-worn cameras; and new advisories in 2026 on data scraping and on breach notification. NPC Circular No. 2022-01 sets administrative fines of 0.5 to 3 percent of the previous year's annual gross income for grave infractions and 0.25 to 2 percent for major ones, capped at five million pesos for a single act, roughly ninety thousand United States dollars. We could not evidence a specific named company being fined a specific peso amount under that circular from the Commission's own published pages, so the monetary-fine track record is the one weak point in the picture. Criminal prosecution is not the Commission's to bring: it recommends prosecution to the Department of Justice. The Bangko Sentral ng Pilipinas separately supervises banks and enforces its own outsourcing, technology-risk and incident-reporting rules with directives and sanctions on institutions, directors and officers.

CEILING. The Data Privacy Act's storage limitation principle requires personal data to be kept only for as long as necessary for the declared purpose, and NPC Circular No. 2023-06 requires organisations to establish and document retention periods and to dispose of data by methods that make further processing impossible, such as degaussing, secure wiping or shredding. NPC Advisory No. 2026-01 repeats the point for scraped data: it 'shall be retained only for as long as necessary' for the declared purpose. The same circular treats security logs as needing longer retention than ordinary system logs but does not fix a number. FLOOR. Manual of Regulations for Banks Section 172: 'Records shall be retained for a period of at least five (5) years, unless they are otherwise required by law or other regulations, or as directed by the Bangko Sentral to be retained for a longer period', and records touching an unresolved supervisory examination issue must be preserved until that issue is finally resolved. Manual of Regulations for Banks Section 924: customer identification records must be kept as long as the account exists; transaction records for five years from the transaction; records of closed accounts and terminated relationships for at least five years after closure; and where a money laundering case has been filed, records must be kept beyond five years until the Anti-Money Laundering Council secretariat confirms the case is finally resolved. Electronic copies of covered and suspicious transaction reports must be kept at least five years from submission. HOW CONFLICTS RESOLVE. The privacy law's storage limit yields to another law that requires keeping the record. Processing to comply with a legal obligation is a lawful basis, so a statutory minimum period beats the privacy ceiling for the records it covers, but only for those records and only for that period. Tax and corporate minimum periods are real and material in the Philippines, but we could not verify them from an official government source in this session; see 'unconfirmed'.

CLOCK ONE, privacy, 72 hours. NPC Circular No. 16-03 and the Implementing Rules require the Commission and affected data subjects to be notified within seventy-two hours upon knowledge of, or reasonable belief of, a notifiable breach. Notification is mandatory when three things are true together: the data is sensitive personal information or information that could enable identity fraud; there is reason to believe an unauthorised person acquired it; and the acquisition is likely to give rise to a real risk of serious harm. Not being able to restore the system yet is expressly not a ground for delay. In May 2026 the Commission issued Advisory No. 2026-02 clarifying that breach notifications go through its Data Breach Notification Management System. CLOCK TWO, banking, 2 hours then 24 hours. Manual of Regulations for Banks Section 148 requires the compliance officer or designated officer to notify the appropriate supervising department of the central bank within two hours from discovery of a reportable major cyber-related incident or a disruption of financial services, disclosing at minimum the nature of the incident and the system or business function involved, followed by a fuller written report within twenty-four hours. A service disruption lasting more than two hours can itself be reportable. CLOCK THREE, annual. All covered organisations file an annual security incident report summarising every incident and breach, classified by impact on availability, integrity and confidentiality. The Commission set 31 March 2026 as the deadline for the 2025 report. The overlap is the operational trap: a card-data incident at a bank triggers the two-hour central bank clock, the seventy-two-hour privacy clock and the annual report, and the two-hour clock starts at discovery, which is usually earlier than the point at which you 'reasonably believe' the privacy test is met.

1. CHILDREN ARE UNDER EIGHTEEN. NPC Advisory No. 2024-03 defines a child as 'a person below eighteen (18) years of age' and extends the definition to adults unable to protect themselves because of a disability. Product teams that copied a thirteen or sixteen year old threshold from another market are non-compliant by several years. The same advisory bans design patterns that nudge children toward privacy-reducing choices. 2. PRISON, NOT JUST FINES. Republic Act No. 10173 carries criminal penalties: one to three years for unauthorised processing of personal information, three to six years for sensitive personal information, three to six years for negligent access to sensitive personal information, one and a half to five years for concealing a security breach, and three to six years with fines up to five million pesos, roughly ninety thousand United States dollars, for a combination of offences. These attach to responsible individuals. The Commission does not prosecute; it refers cases to the Department of Justice, which means the timeline is a criminal one and outside the regulator's control. 3. REGISTRATION IS COMPULSORY AND IT IS A FILING, NOT A TICK-BOX. Under NPC Circular No. 2022-04 you must register if you have 250 or more employees, or process sensitive personal information of at least 1,000 people, or your processing is likely to pose a risk to rights and freedoms. Any system doing automated decision-making or profiling must be registered in all cases, with no size threshold at all. Registration is due within twenty days of implementing the system or appointing the data protection officer. Foreign entities must supply authenticated or apostilled documents with English translations, which takes weeks. 4. BANK DEPOSIT SECRECY IS CRIMINAL AND SEPARATE. The banking rules treat disclosure of deposit information under Republic Act No. 1405 and the foreign currency deposit law, Republic Act No. 6426, as a criminal matter distinct from privacy compliance. A standard data processing agreement with a cloud provider does not create the depositor's written permission those laws require, and the banking rules record that a person who discloses in breach of them is deemed to have violated those statutes. 5. GOVERNMENT DATA CANNOT LEAVE THE BUILDING IN BULK. Republic Act No. 10173 section 23 requires the head of the agency to approve any off-site or online access by agency staff to sensitive personal information and caps it at one thousand records. Section 24 applies the same regime to government contractors, who must also register. A contractor planning an offshore shared-services model for a government client runs into this before it runs into any transfer rule. 6. THE REGULATOR'S SECURITY RULES FOLLOW YOU ABROAD. NPC Circular No. 2023-06 applies by its own terms to processing 'within and outside of the Philippines', so an offshore processor is not outside the detailed security regime just because the servers are.

LANDING OR JUST LANDED, all verified on the regulator's own site: - NPC Advisory No. 2026-01, Guidelines on Data Scraping of Publicly Available Personal Data, dated 13 April 2026. Guidance rather than a binding circular, but it sets the Commission's expectations: declare a specific purpose, identify a lawful basis, tell people before you scrape, run a privacy impact assessment, and do not scrape sensitive personal information unless you can demonstrate a lawful basis and safeguards. This is the item most likely to bite artificial-intelligence training pipelines. - NPC Advisory No. 2026-02, dated 11 May 2026, moving breach notification onto the Commission's Data Breach Notification Management System. - A public consultation open in August 2026 on updated privacy impact assessment guidelines, which would replace guidance dating from 2017. - NPC Advisory No. 2024-04, issued 19 December 2024, applying the privacy law to artificial intelligence systems, and NPC Circular No. 2025-01 on body-worn cameras, both already in effect. PROPOSED ONLY, NOT BINDING. Amendments to Republic Act No. 10173 have been pushed since at least 2021, when a substitute bill was approved in committee in the House of Representatives. The package would give the Commission summons, subpoena and contempt powers, add biometric and genetic data to the sensitive categories, set a digital age of consent, and let courts choose between imprisonment and a fine. We could not confirm from an official source what stage, if any, this has reached in the current Congress. Do not plan around it. DORMANT SWITCHES, the ones that matter more than the bills: - The Commission can issue binding circulars without primary legislation. It has done so repeatedly, most recently on closed-circuit television in 2024 and body-worn cameras in 2025. A localisation or transfer-restriction circular would need no act of Congress, only publication. - NPC Circular No. 2023-06 already asserts reach over processing outside the Philippines, so a future security or storage requirement could be applied extraterritorially on the same basis. - The central bank can order a supervised institution to terminate an offshore arrangement or bring the activity back in-house whenever it judges that customer confidentiality or its own supervisory access cannot be assured. That is a per-institution, no-notice power that no published list will warn you about. - Government cloud policy is set by department circular, not statute, and can be rewritten administratively.