PhilippinesData Privacy Act of 2012, cross-border transfer accountability
Republic Act No. 10173 (2012), Section 21
In force since .
A cross border transfer rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app transferring the personal information of an individual in the Philippines, including a faceprint, voiceprint, or other biometric identifier, to a recipient outside the country remains accountable for that data and must use contractual or other reasonable means to secure a level of protection comparable to the Act.
These lines are LexLint's reading of the law's text. Also read by: National Privacy Commission, Privacy Policy Office (Advisory Opinion No. 2017-005, cross-border transfer of personal data and Section 21) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
The Commission's advisory on model contractual clauses for cross-border transfers is voluntary: the Commission does not require the parties to adopt the clauses.
- As of
- Guidance link
- https://web.archive.org/web/2024if_/https://privacy.gov.ph/wp-content/uploads/2022/01/NPC_AdvisoryOpinionNo._2017-005.pdf
- Guidance body
- National Privacy Commission, Privacy Policy Office (Advisory Opinion No. 2017-005, cross-border transfer of personal data and Section 21)
- Open questions
- What level of protection is a "comparable level of protection" under Section 21(a) when a third party outside the Philippines processes the information, and does use of the Commission's model contractual clauses show it?
What it makes you log
Logging duty
Section 21 makes each personal information controller responsible for personal information under its control or custody, including information transferred to a third party for processing at home or abroad, requires contractual or other reasonable means to secure a comparable level of protection, and requires the controller to designate the individuals accountable for compliance. It states no duty to create, keep or produce a log or record of a transfer.
- Kind
- None
- As of
What this law does
Section 21's Principle of Accountability makes a personal information controller responsible for personal information under its control or custody, including data transferred to a third party for processing domestically or internationally, and requires the controller to use contractual or other reasonable means to provide a comparable level of protection while the data is processed abroad.
This is an accountability-based transfer regime rather than an adequacy list or a localization mandate; no data-localization requirement was found.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .