Data Privacy Act of 2012 (DPA) Philippines’ (Republic Act No 10173) cookie consent and compliance

The Data Privacy Act of 2012 (Republic Act No. 10173) governs the collection, processing, storage, and use of personal data in the Philippines. It applies to both public and private sector organizations that control or process personal information, whether the data is processed in the Philippines or abroad, as long as the individual is a Philippine citizen or resident. The law ensures that individuals’ privacy rights are protected and establishes principles of transparency, legitimate purpose, and proportionality in handling personal data.

Under the DPA, personal data refers to any information, whether recorded or not, that can identify an individual, either directly or indirectly. This includes:  Personal information – data that can identify a person, such as name, address, phone number, email, or government-issued ID number.  Sensitive personal information – data that can be used to discriminate against or harm an individual, such as race, ethnic origin, marital status, age, health records, education, genetic or sexual life, social security numbers, or government-issued identifiers.  Privileged information – any data covered by attorney-client privilege or similar protected relationships.

Sensitive personal information includes data that is more private in nature and requires stricter protection. Examples include:  Race, ethnic origin, or religious or political affiliations  Health, education, or genetic data  Sexual life or orientation  Social security numbers and other government-issued identifiers (e.g., passport or driver’s license numbers)  Data issued by government agencies that are unique to an individual (such as SSS, GSIS, or PhilHealth numbers)   The processing of sensitive personal information generally requires explicit consent from the data subject, except in specific cases allowed by law.

The National Privacy Commission (NPC) is the independent government agency tasked with implementing and enforcing the Data Privacy Act. The NPC:  Monitors compliance with the law and its implementing rules  Investigates complaints and data breaches  Issues advisory opinions and compliance orders  Promotes public awareness of data protection rights and obligations

Certain processing activities are exempt from the Data Privacy Act, including:  Data used for personal, family, or household affairs that are not publicly available  Information necessary for journalistic, artistic, or literary purposes in order to uphold freedom of expression  Data processed for research or statistical purposes, provided they are not used to make decisions about individuals  Data processed for information required by law or for legal proceedings  Information necessary for national security, public order, or law enforcement purposes  These exemptions are limited and subject to conditions defined by the NPC.

You can visit the National Privacy Commission (NPC) website for official guidelines, advisories, compliance tools, and updates related to the Data Privacy Act.