Processes personal data, in the Philippines

Republic Act No. 10173 (2012), Section 20(f) · Read the law's page

• An app that is a personal information controller and reasonably believes that sensitive personal information or identity-fraud-enabling information of an individual in the Philippines has been acquired by an unauthorized person must promptly notify the National Privacy Commission and the affected individuals, where the controller or the Commission believes the acquisition is likely to give rise to a real risk of serious harm to an affected individual.

Republic Act No. 10173 (2012), Section 21 · Read the law's page

• An app transferring the personal information of an individual in the Philippines, including a faceprint, voiceprint, or other biometric identifier, to a recipient outside the country remains accountable for that data and must use contractual or other reasonable means to secure a level of protection comparable to the Act.

Republic Act No. 10173 (2012), Sections 16-18 · Read the law's page

• An app holding the personal information of an individual in the Philippines must give that individual a way to be informed, object, access, correct, and erase their data, and must provide a copy of their data in a structured, commonly used, machine-readable format on request.

Republic Act No. 10173 (2012), Sections 25-37 · Read the law's page

• An app processing the personal information of an individual in the Philippines must be prepared to answer to the National Privacy Commission for a Chapter VIII criminal violation, and an individual harmed by unlawful processing may seek restitution under the general Civil Code.

Republic Act No. 10173 (2012), Sections 3, 12, 13 · Read the law's page

• An app that processes the personal information of an individual in the Philippines must satisfy one of the Act's lawful-processing criteria, with a stricter, separate standard for sensitive personal information, even though the Act's own sensitive-category list does not name biometric data specifically; a faceprint or voiceprint is still personal information subject to the Act's general processing criteria.

Republic Act No. 10173 (2012), Section 4; Implementing Rules and Regulations, Rule II, Sections 5 and 6 · Read the law's page

• Do not treat information as outside the Act unless it falls within a Section 4 exclusion (government officer or employee information relating to the position or functions, contractor service information, discretionary financial benefits such as licenses and permits, journalistic, artistic, literary or research processing, information necessary for public authority functions, information banks need for Credit Information System Act and anti-money-laundering compliance, and personal information originally collected from residents of foreign jurisdictions under their own laws), and treat an exclusion as covering only the minimum extent of collection, access, use, disclosure or other processing necessary to the purpose, function or activity concerned (Section 4; Rules, Rule II, Section 5).
• Where you rely on the research exclusion, show that the research is intended for a public benefit and that it meets the applicable laws, regulations or ethical standards (Rules, Rule II, Section 5(c)).
• Where you rely on an exclusion, keep upholding data subjects' rights and the general data privacy principles and lawful-processing requirements wherever they are not directly incompatible with the exclusion's purpose, and be ready to prove the exclusion applies, since the burden of proof falls on you (Rules, Rule II, Section 6(a) and (b)).
• Where you rely on the exclusion for personal information originally collected from residents of foreign jurisdictions, be ready to prove the law of the foreign jurisdiction under which it was collected (Rules, Rule II, Section 5(f)).

Republic Act No. 10173 (2012), Section 6; Implementing Rules and Regulations, Rule II, Section 4 · Read the law's page

• Treat the Act as applying to processing done outside the Philippines where it relates to personal information about a Philippine citizen or resident, you have a link with the Philippines (for example a contract entered in the Philippines, central management and control in the country of a juridical entity unincorporated there, or a branch, agency, office or subsidiary there whose parent or affiliate has access to the personal information) and you have other links there (for example carrying on business in the Philippines, or personal information collected or held by an entity in the Philippines) (Section 6).
• Under the Rules, treat the Act and the Rules as applying to processing outside the Philippines if you are found or established in the Philippines, the processing relates to personal data about a Philippine citizen or resident, the processing is done in the Philippines, or you have links to the Philippines such as using equipment located in the country or maintaining an office, branch or agency there (Rules, Rule II, Section 4).

NPC Circular No. 2022-04, Sections 5, 7 and 39 · Read the law's page

• A personal information controller or processor in the Philippines that employs 250 or more persons, processes the sensitive personal information of 1,000 or more individuals, or processes data likely to pose a risk to the rights and freedoms of data subjects must register all its data processing systems and its Data Protection Officer with the National Privacy Commission, within 20 days of a new system's commencement or a new appointment, and must update the registration within 10 days of a minor amendment; a system involving automated decision-making or profiling must always be registered.