Meet DPA 2012 obligations with controls you already run

The Data Privacy Act of 2012, Republic Act No. 10173, is the Philippines' main data protection law. It protects personal information processed by government and private organisations, sets principles of transparency, legitimate purpose and proportionality, gives individuals rights over their data, and requires security measures. The National Privacy Commission enforces it, supported by Implementing Rules and Regulations issued in 2016 and further NPC circulars.

Any natural or juridical person that processes personal information, as a personal information controller or processor, must comply if the processing happens in the Philippines. The Act also applies to some organisations outside the Philippines, for example where they process personal information about Philippine citizens or residents and have links to the country. Certain information, such as some journalistic and government functions, is excluded.

The Act sets criminal penalties of imprisonment and fines for offences such as unauthorised processing, access due to negligence, improper disposal, concealment of security breaches and unauthorised disclosure. Fines reach up to PHP 5 million per offence, and the maximum penalty applies to large-scale violations. The NPC can also issue compliance and cease and desist orders, including bans on processing.

Within 72 hours. Under the IRR and NPC rules, the personal information controller must notify the National Privacy Commission and affected data subjects within 72 hours of becoming aware of a breach involving sensitive personal information or information that could enable identity fraud, where it is likely to cause a real risk of serious harm. Notification may be delayed only in limited circumstances.

Some do. Registration of data processing systems and a Data Protection Officer is required for controllers and processors that meet the NPC's criteria, which relate to headcount, the volume of sensitive personal information processed and the risk of the processing. The thresholds are set by NPC circulars that have been revised over time, so check the current circular before deciding.

They share many ideas. Both rest on lawful processing, purpose limitation and proportionality, give individuals rights including access, correction, erasure and data portability, require security measures and set breach notification duties. GDPR is broader and has its own fine structure, but a programme built for GDPR covers much of DPA 2012, leaving gaps such as NPC registration and Philippine-specific breach procedures.

Yes, partly. ISO 27001 controls support the organisational, physical and technical security measures required by Rule VI of the IRR, along with incident management and supplier security. It does not cover privacy-specific duties such as lawful bases, data subject rights, NPC registration or breach notification to the Commission, so those need separate controls and documentation.

DPA 2012 is mapped in OneClickComply's control library and is available on request. Once enabled, your existing controls and evidence for frameworks such as ISO 27001 and GDPR are linked to the IRR's requirements, and our audit team can advise on NPC expectations. OneClickComply does not certify compliance, which remains your organisation's responsibility under the Act.