PHRepublic Act No. 10173 Philippines: Complete Compliance Guide
Overview
The Philippines Republic Act No. 10173, also known as the Data Privacy Act of 2012, along with its Implementing Rules and Regulations (IRR), seeks to protect individual personal information in both government and private sector systems. The law aims to protect the security of personal data while promoting transparency and trust in digital systems, safeguarding privacy without compromising the free flow of information for innovation and growth. The Act establishes the National Privacy Commission (NPC) as the primary regulatory authority for overseeing its implementation and compliance.
Philippines Consumer Rights Under the Republic Act No. 10173 Philippines
The Republic Act No. 10173 Philippines grants four individual privacy rights to Philippines residents. Businesses must respond to authenticated requests within 30 days. A 30-day extension is available with written notice to the consumer.
Correct inaccurate or incomplete information we have collected about you
30-day response windowRequest a copy of personal information we have collected about you
30-day response windowRequest access to the information we have collected about you
30-day response windowLet us know that you don't want us to process your personal information
30-day response windowHow Clym Helps You Comply with the Republic Act No. 10173 Philippines
Configurable consent banner with a clear opt-out for targeted ads and data sales, and a full consent audit log.
Clym's Data Subject Request portal handles every Republic Act No. 10173 Philippines request type, with built-in 30-day deadline tracking and escalation alerts.
Clym scans your site and generates your Republic Act No. 10173 Philippines-compliant privacy notice, updated automatically when new trackers or data categories are detected.
Regulation Summary
- August 15, 2012: Enactment of Republic Act No. 10173.
- September 2016: Implementing Rules and Regulations (IRR) issued.
- March 2017: Full enforcement by the National Privacy Commission (NPC).
- All entities processing personal data within the Philippines.
- Foreign entities processing data of individuals in the Philippines.
- Both private and public sector organizations handling personal information.
- Personal data collected for personal or household activities.
- Information processed for journalistic, artistic, or literary purposes.
- Data collected for national security, law enforcement, or public order purposes.
- Obtain lawful and informed consent before collecting personal data.
- Ensure transparency in data collection and processing.
- Implement security measures to prevent unauthorized access and data breaches.
- Notify the National Privacy Commission (NPC) and affected individuals of data breaches.
- Appoint a Data Protection Officer (DPO) for entities processing significant amounts of personal data.
- Implement cookie consent mechanisms.
- Provide a clear and accessible privacy policy.
- Ensure secure online forms for collecting personal data.
- Enable users to exercise data rights through an online platform.
- Cross-Border Data Transfers: Data transfers outside the Philippines must comply with adequacy standards or legal safeguards.
- Privacy Impact Assessments: Required for high-risk processing activities, such as biometric data or profiling.
- Mandatory Data Protection Officers (DPOs): Required for companies processing large-scale personal data or sensitive information.
- Access: Request information about personal data collected.
- Correction: Rectify inaccurate or outdated personal information.
- Erasure: Request deletion of personal data under specific conditions.
- Portability: Transfer data to another service provider in a structured format.
- Objection: Refuse processing of personal data for certain purposes.
- Restriction: Limit how personal data is processed under certain circumstances.
Businesses subject to RA 10173 must provide a clear mechanism for individuals to exercise these rights. Clym's Data Subject Request tool enables you to receive, track, and respond to data subject requests compliantly.
- Regulatory Authority: National Privacy Commission (NPC).
- Penalties: Violations can result in fines of up to PHP 5 million (~USD 90,000) and imprisonment for up to six years.