As data becomes more valuable and privacy expectations rise, organizations operating in the Philippines must prioritize personal data protection, not just for compliance, but to earn and maintain trust. The Philippines’ Personal Data Protection Act (PDPA), enacted in 2012 and enforced by the National Privacy Commission (NPC), is the country’s primary data privacy law.
Whether you’re a startup handling local data or a global organization serving Filipino consumers, this guide breaks down everything you need to know about the PDPA. Including key principles, responsibilities, penalties, and practical steps to strengthen your privacy program.
What is the PDPA?
The Philippine Personal Data Protection Act (Republic Act No. 10173) was established to uphold the right to privacy and ensure organizations manage personal data with care, transparency, and accountability. It applies to both public and private entities — including those outside the Philippines that use local equipment or process data about Philippine citizens.
The PDPA is closely aligned with international privacy standards like the GDPR and has helped position the Philippines as a trusted data hub in the ASEAN region. It’s enforced by the NPC, which provides ongoing guidance to help organizations adapt to today’s digital landscape.
Who must comply with the PDPA?
- Any public or private entity processing personal data in the Philippines
- Organizations outside the Philippines that use equipment in the country or process data about Philippine citizens
- Companies that meet thresholds such as employing over 250 people or processing sensitive data of over 1,000 individuals
Key terms to know
- Personal information (PI): Data that can identify a person directly or indirectly
- Sensitive personal information (SPI): Includes data related to health, race, education, government-issued IDs, etc.
- Personal information controller (PIC): The entity that decides how data is processed
- Personal information processor (PIP): The entity that processes data on behalf of the PIC
Core principles of PDPA compliance
Every data processing activity under the PDPA must follow three foundational principles:
- Transparency – Individuals must know how their data is being collected and used
- Legitimate purpose – Data must be collected for clearly defined and legal reasons
- Proportionality – Only the minimum necessary data should be collected and processed
What rights do data subjects have?
The PDPA grants individuals several enforceable rights:
- The right to be informed
- The right to access personal data
- The right to object to certain types of processing
- The right to correct inaccuracies
- The right to block or delete data
- The right to data portability
- The right to seek damages
What are the penalties for non-compliance?
Non-compliance with the PDPA can lead to:
- Administrative fines of up to PHP 5 million per violation
- Criminal penalties including up to 7 years of imprisonment for serious offenses
- Civil liability where organizations may be held financially responsible for data misuse or breaches
Steps forward: How to strengthen your PDPA compliance
To build a strong, privacy-forward organization, here’s where to focus your efforts:
- Appoint a Data Protection Officer (DPO) with independence and access to leadership
- Conduct privacy impact assessments (PIAs) to evaluate risk in your data flows
- Register with the NPC if your organization meets threshold requirements
- Establish a privacy management program with documentation, oversight, and policies
- Train employees to ensure privacy awareness across departments
- Set up systems for data subject requests (DSARs) that are timely and traceable
- Build breach response protocols that align with NPC guidance
Stay ahead of evolving expectations
Privacy is not static. And while the PDPA hasn't seen formal legislative amendments recently, regulatory interpretation and enforcement continue to evolve.
Here’s how to stay ahead:
- Perform routine PIAs
- Reassess your cross-border data transfer safeguards
- Develop internal workflows for DSARs and breach response
- Prepare for rising global expectations around data portability
The ideal outcome? A privacy-forward organization
One that not only earns trust but actively builds it through transparency and respect for individual rights. An organization that treats privacy as a shared value, not just a legal obligation, and embeds it into every part of its culture and operations.
This kind of organization doesn’t just avoid fines or reputational harm. It adapts confidently to regulatory change, unlocks competitive advantage, and sets a new standard for how data should be handled in the digital age.
With the right mindset, tools, and leadership, privacy becomes more than compliance. It becomes a catalyst for innovation, resilience, and long-term business success.
Download the full eBook: Philippines PDPA Compliance Made Simple
Ready to take the next step? Simplify PDPA compliance with OneTrust
From privacy impact assessments to breach management and DSAR automation, OneTrust helps organizations operationalize every aspect of PDPA compliance.
Learn more: Request a demo to see how OneTrust can support your compliance journey in the Philippines.
