Philippines. Comprehensive data protection. Act
DPA (Philippines)Data Privacy Act of 2012 (Republic Act No. 10173)
In force
§1Summary
- Synopsis
Comprehensive privacy law enforced by the NPC, combining GDPR-like principles with heavy criminal penalties. NPC circulars add breach notification, DPO and registration rules.
- Key themes
- Unique features
Imprisonment for most offences; registration required for organisations with ≥250 staff or processing sensitive data of ≥1,000 people.
- SaaS relevance
Applies to offshore SaaS with a Philippine link (e.g. processing Filipinos' data and doing business there); outsourced processors (BPO) are a key constituency.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- NPC and individuals within 72h; full report within 5 days
- DPO
- Yes
- Cross-border transfers
- Controller remains accountable; contractual safeguards
- Maximum penalty
- PHP 5m and 6 years' imprisonment (combination of acts); NPC administrative fines
§3Dates
- Key dates
- Adopted
- In force
- IRR 2016; NPC Circular 16-03 (breach); Circular 2022-04 registration (effective Jan 2023); amendment bills pending
§4Text and authority
- Text
- Authoritative text privacy.gov.ph
- Authority
- National Privacy Commission (NPC)
§5Where it applies
- Domestic law of
- Philippines
§6Sources and verification
- Sources consulted
- Verification
High confidence.
In-force date (15 days after publication) from general knowledge.