PhilippinesData Privacy Act of 2012, comprehensive regime and lawful processing criteria
Republic Act No. 10173 (2012), Sections 3, 12, 13
In force since .
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that processes the personal information of an individual in the Philippines must satisfy one of the Act's lawful-processing criteria, with a stricter, separate standard for sensitive personal information, even though the Act's own sensitive-category list does not name biometric data specifically; a faceprint or voiceprint is still personal information subject to the Act's general processing criteria.
These lines are LexLint's reading of the law's text. Also read by: National Privacy Commission, Privacy Policy Office (Advisory Opinion No. 2023-012 of , lawful criteria for processing: consent and legitimate interest) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://web.archive.org/web/2025if_/https://privacy.gov.ph/wp-content/uploads/2023/05/Advisory-Opinion-No.-2023-012.pdf
- Guidance body
- National Privacy Commission, Privacy Policy Office (Advisory Opinion No. 2023-012 of , lawful criteria for processing: consent and legitimate interest)
- Open questions
- Does the phrase "genetic or sexual life" in Section 3(l)(2) reach biometric identifiers such as a faceprint or voiceprint, so that the prohibition in Section 13 on processing sensitive personal information applies to them?
What it makes you log
What the log must hold
Consent or opt-out state
Logging duty
Section 3(b) defines the consent that sections 12(a) and 13(a) require as consent evidenced by written, electronic or recorded means, so a controller that relies on consent must hold something that evidences it. The Act names no log field beyond that evidence, sets no retention period and names no one entitled to see it. The cited sections state no territorial hook (the Act's scope is in sections 4 and 6, which this row does not cite).
- Kind
- Implicit
- As of
- Provision
- Republic Act No. 10173, Section 3(b), read with Sections 12(a) and 13(a)
- Trigger
- consent_or_optout
What this law does
The Data Privacy Act of 2012 (Republic Act No. 10173) uses a criteria-based consent model under Section 12 for ordinary personal information, with a stricter standard under Section 13 for sensitive personal information, and adopts personal information controller and personal information processor terminology, a controller and processor style split. The National Privacy Commission (NPC) enforces the Act.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .