PhilippinesData Privacy Act of 2012, Application to Scraped Public Personal Data
Republic Act No. 10173 (2012), Section 12
In force.
A personal data rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app scraping the publicly available personal data of an individual in the Philippines must still identify a lawful basis for processing that data under the Data Privacy Act; the data's public availability does not by itself supply the data subject's consent or any other lawful basis.
These lines are LexLint's reading of the law's text. Also read by: NPC Advisory No. 2026-01, Guidelines on Data Scraping of Publicly Available Personal Data (guidance from the Philippine National Privacy Commission).
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Section 12 lists the conditions under which processing of personal information is permitted (consent, contract, legal obligation, vital interests, public functions, legitimate interests), and states no duty to create, keep or produce a log or record. The row cites Section 12 only, so the Act's other sections, such as the controller's duty to implement security measures and the breach-notification rules, are not borrowed. The Act's territorial scope sits in a section the row does not cite.
- Kind
- None
- As of
What this law does
Section 12 permits the processing of personal information only if not otherwise prohibited by law and only when at least one of several listed conditions exists, most commonly the data subject's consent or another enumerated lawful basis; the section draws no exception for personal data that is publicly available online.
The National Privacy Commission's NPC Advisory No. 2026-01 (), Guidelines on Data Scraping of Publicly Available Personal Data, states as guidance that the public availability of personal data does not by itself constitute the data subject's consent to its processing, so a controller scraping publicly available personal data must still identify one of Section 12's lawful bases for the specific purpose of that processing.
Section 45 of the Act provides that it takes effect fifteen (15) days after its publication in at least two (2) national newspapers of general circulation. No notice stating the day of that publication has been located.
Guidance on this law
How the bodies that enforce this law read it. Guidance binds nobody by itself, so LexLint never raises a finding from it; the duty is this law's.
- NPC Advisory No. 2026-01, Guidelines on Data Scraping of Publicly Available Personal Data, the Philippine National Privacy Commission
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .