Data Privacy Act of 2012, comprehensive regime and lawful processing criteria

Republic Act No. 10173 (2012), Sections 3, 12, 13

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 15 August 2012.

A comprehensive regime rule binding public and private bodies.

As of 29 August 2026.

What it requires

An app that processes the personal information of an individual in the Philippines must satisfy one of the Act's lawful-processing criteria, with a stricter, separate standard for sensitive personal information, even though the Act's own sensitive-category list does not name biometric data specifically; a faceprint or voiceprint is still personal information subject to the Act's general processing criteria.

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

The Data Privacy Act of 2012 (Republic Act No. 10173) uses a criteria-based consent model under Section 12 for ordinary personal information, with a stricter standard under Section 13 for sensitive personal information, and adopts personal information controller and personal information processor terminology, a controller and processor style split. The National Privacy Commission (NPC) enforces the Act.

The Official Gazette's own page sits behind a Cloudflare CAPTCHA, which was not bypassed, and the NPC's own PDF mirror serves a PDF.js viewer render rather than document text; the substantive text here is read from the NPC's own HTML reproduction of the Act at privacy.gov.ph, with the Official Gazette recorded as the more authoritative citation.

When LexLint raises it

crawls_web
trains_models
generates_content
deploys_chatbot
automated_outreach
high_risk_decisions
processes_voice
processes_biometrics

Read the law

Official Gazette citation
substantive text read from the National Privacy Commission's official HTML reproduction (privacy.gov.ph/data-privacy-act)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app