Republic Act No. 10173 (Data Privacy Act of 2012)
Also known as: Data Privacy Act of 2012 · DPA · RA 10173
Definition
Republic Act No. 10173, the Data Privacy Act of 2012, is the Philippines’ comprehensive law governing the processing of personal information by both government and private entities. Signed on 15 August 2012, it establishes the rights of data subjects, imposes security and accountability obligations on organizations that handle personal data, and created the National Privacy Commission (NPC) as the independent regulator. It applies to any processing of personal data about Filipino citizens and residents, including by entities abroad that use equipment or conduct operations in the country.
Identities
| Database | Identifier |
|---|---|
| Wikipedia | National Privacy Commission |
| Wikidata | Q28136686 |
| DBpedia | http://dbpedia.org/resource/National_Privacy_Commission |
Also Known As
- Data Privacy Act of 2012
- DPA
- RA 10173
Examples and Analogies
The law functions like the European Union’s GDPR in miniature: both require lawful bases for processing, consent, breach notification, and the appointment of data protection officers. A familiar example is the privacy notice and consent checkbox on a Philippine bank’s account-opening form, or a business-process outsourcing firm binding its agents to confidentiality and access controls when handling foreign customer data.
Usage Scenarios
The Act is applied whenever a company collects customer records, a hospital stores patient charts, a school keeps student information, or an agency maintains registries of citizens. It is central to compliance programs of the outsourcing industry, to employee data handling in HR systems, and to government digitization projects such as national ID-related databases.
Strategies
Organizations comply by registering data protection officers with the NPC, conducting privacy impact assessments, minimizing data collection to what is necessary, executing data-processing agreements with vendors, and adopting privacy-by-design in systems development. The NPC issues advisories, circulars, and a compliance framework to guide implementation.
Security and Safety Measures
The law requires organizational, physical, and technical security measures for personal data, and mandatory notification of the NPC and affected individuals within 72 hours of a security incident involving sensitive personal information. Unauthorized processing, negligent disclosure, and concealment of breaches carry imprisonment and fines, with higher penalties when sensitive personal information is involved.
Historical Context
Before 2012 the Philippines had no comprehensive privacy statute, relying on scattered provisions such as the constitutional right to privacy of communication and the E-Commerce Act of 2000. The bill was passed as the outsourcing industry grew, partly to meet international client expectations. The National Privacy Commission became fully operational in 2016, giving the Act an enforcement arm.
Challenges and Controversies
Enforcement capacity and slow case resolution are persistent criticisms, and the 2016 COMELEC data breach exposed millions of voter records before the regulator was fully staffed. Debates continue over surveillance proposals, the SIM card registration law’s data-handling, and balancing law-enforcement access with privacy rights. Data subjects rarely pursue remedies, making compliance largely regulator-driven.