PhilippinesNational Privacy Commission Circular on Registration of Data Processing Systems and Data Protection Officers
NPC Circular No. 2022-04, Sections 5, 7 and 39
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://privacy.gov.ph/reminder-on-mandatory-data-protection-officer-and-data-processing-system-registration/In force.
An enforcement supervision rule binding public and private bodies.
As of .
What it requires
- A personal information controller or processor in the Philippines that employs 250 or more persons, processes the sensitive personal information of 1,000 or more individuals, or processes data likely to pose a risk to the rights and freedoms of data subjects must register all its data processing systems and its Data Protection Officer with the National Privacy Commission, within 20 days of a new system's commencement or a new appointment, and must update the registration within 10 days of a minor amendment; a system involving automated decision-making or profiling must always be registered.
These lines are LexLint's reading of the law's text, as of .
What this law does
National Privacy Commission Circular No. 2022-04, dated , requires a covered personal information controller or processor to register its Data Protection Officer and its data processing systems with the Commission. Section 5 covers a controller or processor that employs 250 or more persons, one that processes the sensitive personal information of 1,000 or more individuals, and one whose processing will likely pose a risk to the rights and freedoms of data subjects.
A data processing system involving automated decision-making or profiling must be registered in all instances. Under Section 7, a newly implemented data processing system or a first Data Protection Officer must be registered within 20 days from the commencement of the system or the effectivity of the appointment. Under Section 7, a minor amendment to the registration, including a change of Data Protection Officer, must be updated within 10 days.
Section 39 gives covered controllers and processors 180 days from the effectivity of the Circular to complete their registration. The Commission states that covered controllers and processors were allowed until to comply under Section 39.
When LexLint raises it
When your app profile says your app crawls the web, trains models, generates content with AI, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings or processes biometric data.