PhilippinesData Privacy Act of 2012, extraterritorial application
Republic Act No. 10173 (2012), Section 6; Implementing Rules and Regulations, Rule II, Section 4
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Data subject residence, Operator establishment
- Audit expectation
- none
As of .
What it requires
- Treat the Act as applying to processing done outside the Philippines where it relates to personal information about a Philippine citizen or resident, you have a link with the Philippines (for example a contract entered in the Philippines, central management and control in the country of a juridical entity unincorporated there, or a branch, agency, office or subsidiary there whose parent or affiliate has access to the personal information) and you have other links there (for example carrying on business in the Philippines, or personal information collected or held by an entity in the Philippines) (Section 6).
- Under the Rules, treat the Act and the Rules as applying to processing outside the Philippines if you are found or established in the Philippines, the processing relates to personal data about a Philippine citizen or resident, the processing is done in the Philippines, or you have links to the Philippines such as using equipment located in the country or maintaining an office, branch or agency there (Rules, Rule II, Section 4).
These lines are LexLint's reading of the law's text, as of .
What it makes you log
Logging duty
Section 6 of the Act and Section 4 of Rule II of the Rules state the reach of the Act and set no duty to keep a log or record.
- Kind
- None
- As of
What this law does
The Act applies to an act done or practice engaged in and outside of the Philippines by an entity where three conditions are met: the act, practice or processing relates to personal information about a Philippine citizen or a resident; the entity has a link with the Philippines and is processing personal information in the Philippines, or, even if the processing is outside the Philippines, it is about Philippine citizens or residents; and the entity has other links in the Philippines.
Section 6 gives as links a contract entered in the Philippines, a juridical entity unincorporated in the Philippines that has central management and control in the country, and an entity with a branch, agency, office or subsidiary in the Philippines whose parent or affiliate has access to personal information, and as other links carrying on business in the Philippines and personal information collected or held by an entity in the Philippines.
The Implementing Rules and Regulations, Rule II, Section 4, state the reach as applying to an act done or practice engaged in and outside of the Philippines if the person processing is found or established in the Philippines, the processing relates to personal data about a Philippine citizen or resident, the processing is done in the Philippines, or the entity has links to the Philippines such as using equipment located in the country or maintaining an office, branch or agency there, with due consideration to international law and comity.
When LexLint raises it
When your app profile says your app processes personal data.