PhilippinesNPC Advisory No. 2026-01, Guidelines on Data Scraping of Publicly Available Personal Data
Guidance, not a law: the Philippine National Privacy Commission's reading of Data Privacy Act of 2012, Application to Scraped Public Personal Data. It binds nobody by itself; the law it reads does.
Guidance on a personal data rule, addressed to public and private bodies.
- Instrument type
- guidance published by a regulator
- Obligation class
- Disclosure, Consent, DPIA, Governance, Security, Retention, Prohibition, Access restriction
- Audit expectation
- continuous
- Who audits it
- Self
As of .
What the regulator expects
- This is guidance from the National Privacy Commission applying duties the Data Privacy Act already sets. It reaches you if you are a personal information controller (PIC) or personal information processor (PIP) that scrapes publicly available personal data from websites, applications, or other online sources, or a PIC that hosts such data.
- Define a specific and legitimate purpose for the scraping before you start, limit your processing to that declared purpose, and determine a lawful basis for the processing, and for any further disclosure to third parties, under Section 12 or 13 of the Data Privacy Act.
- Do not treat the public availability of personal data as the data subject's consent to its processing for purposes beyond those reasonably contemplated when it was provided, or as relieving you of your obligations under the Act.
- Inform data subjects through an appropriate privacy notice or consent form, before the processing takes place or at the next practical opportunity, that their personal data are processed using data scraping; disclose in your privacy notices when data come from publicly available sources, including the source, the purpose of the collection, and the manner of processing.
- Collect only personal data that is adequate, relevant, suitable, and necessary for the purpose, refrain from excessive or indiscriminate scraping, take the reasonable privacy expectations of data subjects into account, and adopt appropriate technical, organizational, and physical security measures.
- Conduct a Privacy Impact Assessment covering the scraping, including scraping done on your behalf by third parties, and review and update it periodically or whenever the scope, purpose, or nature of the scraping materially changes.
- Do not scrape sensitive personal information unless you can demonstrate a valid lawful basis under Section 13 of the Act, that the collection is strictly necessary and proportional to a legitimate purpose, and that enhanced security measures are in place; expect heightened scrutiny, and be ready to demonstrate that you do not exploit the capacity of data subjects, where the data subjects are vulnerable, such as minors, the elderly, or persons with disabilities.
- Do not scrape in violation of applicable law, the Act and its implementing rules, NPC issuances, or a website's or application's terms of service or terms of use; do not circumvent or bypass the technical measures a site uses to prevent scraping, which the Advisory says may include a robots.txt exclusion protocol or CAPTCHAs; and do not use deceptive design patterns, misrepresentation, or similar techniques to obtain personal data. The Advisory says unauthorized scraping may give rise to criminal, civil, and administrative liability under the Act.
- If you host publicly available personal data, inform data subjects that their data are publicly available and may be scraped, say whether your terms permit third parties to scrape and how data subjects can object or seek termination, and implement reasonable security measures against scraping, which may include a Privacy Impact Assessment, data breach notification procedures, bot detection, rate limits or access restrictions, and blocking IP addresses or disabling accounts tied to unauthorized scraping.
- Keep documented policies and practices for your scraping, including your Privacy Impact Assessments; have policies for the periodic review and updating of your scraping activities; make any agreement with a processor that scrapes for you explicitly prohibit unauthorized scraping and circumvention of security measures; and retain scraped personal data only as long as necessary for the declared purpose, then dispose of it securely.
- If you obtain scraped personal data from another PIC, establish policies and procedures, including contractual or other reasonable means, to verify that it was obtained in compliance with the Act and the Advisory, because further processing of data obtained through unauthorized scraping is likewise unauthorized.
- Do not use scraped personal data in a manner that would cause harm to the data subject, such as identity fraud, doxxing, or unauthorized surveillance, and do not use it beyond the declared purposes unless a lawful basis under Sections 12 and 13 exists, affected data subjects receive sufficient notice, and a new Privacy Impact Assessment is conducted.
If you get it wrong
Criminal exposureYes
Criminal exposure note
The Advisory says unauthorized data scraping may give rise to criminal liability under the Data Privacy Act, its implementing rules and NPC issuances; the Advisory itself defines no offense and sets no penalty.
Who enforces it
Enforcement body
National Privacy Commission, the Philippines' data privacy regulator, which the Advisory says is mandated to develop, promulgate, review, or amend rules and regulations for the effective implementation of the Data Privacy Act of 2012.
Settledness
- As of
- Guidance link
- https://privacy.gov.ph/wp-content/uploads/2026/04/SGD_A_1.pdf
- Guidance body
- National Privacy Commission
- Open questions
- Does merely not following a robots.txt exclusion, without defeating any technical block, count as circumventing or bypassing a technical measure that the Advisory deems unauthorized scraping?
What it makes you log
Logging duty
Section 6(A) requires documented scraping policies and practices and the documentation of Privacy Impact Assessments, which cannot be shown without a record; the Advisory names no log, its contents or access.
- Kind
- Implicit
- As of
- Provision
- Section 6(A), documented policies and practices governing data scraping, including documentation of PIAs
- Trigger
- personal_data_processing
- crawl_access
What this law does
NPC Advisory No. 2026-01, Guidelines on Data Scraping of Publicly Available Personal Data, is dated and was approved by the Privacy Commissioner and two Deputy Privacy Commissioners of the National Privacy Commission. Section 8, on interpretation, is its last provision and is followed directly by the approval signatures, with no effectivity clause.
The Commission issues its advisories to serve as guidelines, and this one is guidance that applies obligations the Data Privacy Act of 2012 already sets: it directs personal information controllers (PICs) that scrape to strictly fulfill their obligations under that Act. It applies to PICs and personal information processors (PIPs) that engage in data scraping, and to PICs that host publicly available personal data which may be subject to data scraping.
Scraping means the automated or manual process of extracting publicly available personal data, including text, images, audio and video recordings, and user profiles, from websites, applications, or other online sources. A PIC must clearly define the specific and legitimate purpose for scraping publicly available personal data and limit its processing to that specified and declared purpose.
A PIC must determine the most appropriate lawful basis for processing personal data obtained through data scraping, including any further disclosure to third parties, under Section 12 or 13 of the Act. The public availability of personal data does not constitute consent by the data subject to its processing for purposes beyond those reasonably contemplated at the time it was provided, nor does it relieve a PIC of its obligations under the Act.
A PIC must inform data subjects, through an appropriate privacy notice or consent form (where processing is consent-based), before the processing takes place, or at the next practical opportunity, that their personal data are processed using data scraping practices and technologies. Scraped personal data must be adequate, relevant, suitable, and necessary in relation to its purpose, and a PIC must refrain from excessive or indiscriminate data scraping.
In designing or deploying scraping technologies a PIC must take the reasonable privacy expectations of data subjects into consideration and adopt appropriate technical, organizational, and physical security measures.
A PIC must conduct a Privacy Impact Assessment (PIA) covering its scraping, including scraping performed on its behalf by third parties, and the PIA is to be reviewed and updated periodically, or whenever there is a material change in the scope, purpose, or nature of the data scraping activity.
Data scraping involving sensitive personal information is prohibited, unless the PIC can demonstrate a valid lawful basis under Section 13 of the Act, that the collection is strictly necessary and proportional to a legitimate purpose, and that enhanced technical, organizational, and physical security measures are in place.
Data scraping involving personal data of vulnerable data subjects, including minors, the elderly, and persons with disabilities, is subject to heightened scrutiny, and the PIC must demonstrate that the processing does not exploit the capacity of data subjects. Data scraping is deemed unauthorized when it is conducted in violation of applicable laws, the Act and its implementing rules, NPC issuances, or the terms of service or terms of use of websites or applications.
Unauthorized data scraping includes the circumvention or bypassing of technical measures implemented by websites or applications to prevent data scraping, and the Advisory's footnote to that sentence says these measures may include a robots.txt exclusion protocol or integration of CAPTCHAs, among others.
Using deceptive design patterns, misrepresentation, or similar techniques to obtain personal data through data scraping is likewise deemed unauthorized, and unauthorized data scraping may give rise to criminal, civil, and administrative liability under the Act, its implementing rules and NPC issuances.
A PIC whose website, application, or other online platform hosts publicly available personal data is to take into consideration that data subjects shall be informed that their personal data are publicly available and may be subject to data scraping, including the categories of data that can be accessed, whether the terms of service or terms of use permit third parties to scrape, and how data subjects may object to or seek the termination of scraping.
A hosting PIC shall also implement reasonable and appropriate security measures to mitigate data privacy risks from data scraping, which may include a PIA, data breach notification procedures where unauthorized scraping is a notifiable personal data breach, and continuous monitoring such as detecting bot activity patterns, imposing rate limits or access restrictions, and blocking IP addresses or disabling accounts tied to unauthorized scraping.
A PIC remains accountable for its scraping, including scraping performed by PIPs, and must maintain documented policies and practices governing its data scraping activities, including documentation of the PIAs conducted. A PIC must also establish policies and procedures for the periodic review and updating of authorized or conducted data scraping activities.
Where a PIP scrapes for a PIC, the agreement governing it shall explicitly prohibit unauthorized data scraping and the circumvention of security measures. Personal data obtained through data scraping shall be retained only for as long as necessary to fulfill the declared purpose and shall be securely disposed of thereafter.
A PIC that obtains scraped personal data from another PIC must establish policies and procedures, including contractual or other reasonable means, for verifying that the data was obtained in compliance with the Act, its implementing rules, and NPC issuances including the Advisory, and any further processing of data obtained through unauthorized scraping is likewise considered unauthorized.
A PIC must disclose in its privacy notices when personal data are obtained from publicly available sources, including the source of the data, the purpose of the collection, and the manner of processing.
A PIC must not use scraped personal data in a manner that would cause harm to the data subject, such as identity fraud, doxxing, or unauthorized surveillance, and must not use it for purposes beyond those originally declared unless a lawful basis under Sections 12 and 13 of the Act exists, sufficient notice is given to affected data subjects, and a new PIA is conducted.