PhilippinesData Privacy Act of 2012, data subject rights
Republic Act No. 10173 (2012), Sections 16-18
In force since .
A data subject rights rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app holding the personal information of an individual in the Philippines must give that individual a way to be informed, object, access, correct, and erase their data, and must provide a copy of their data in a structured, commonly used, machine-readable format on request.
These lines are LexLint's reading of the law's text. Also read by: National Privacy Commission, Privacy Policy Office (Advisory Opinion No. 2022-018 of , data subject rights: the right to object and the right to erasure or blocking under Section 16) (guidance, recorded ).
In the frameworks
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://web.archive.org/web/2025if_/https://privacy.gov.ph/wp-content/uploads/2022/10/Advisory-Opinion-No.-2022-018-for-publication-redacted.pdf
- Guidance body
- National Privacy Commission, Privacy Policy Office (Advisory Opinion No. 2022-018 of , data subject rights: the right to object and the right to erasure or blocking under Section 16)
- Open questions
- Does "processed by electronic means and in a structured and commonly used format" in Section 18 give a data subject portability only for data a controller already holds in such a format, or must a controller convert other electronic data into a "commonly used" format on request?
What it makes you log
Who may demand the log
Data subject
What the log must hold
Event time, Access record
Logging duty
Section 16(c) gives a data subject reasonable access, on demand, to the names and addresses of the recipients of their personal information, the reasons for each disclosure and the date their information was last accessed and modified. A controller can answer that only from a record of disclosures and of access and modification. The Act does not call the record a log, names no retention period and sets no audit. The cited sections state no territorial hook.
- Kind
- Implicit
- As of
- Provision
- Republic Act No. 10173, Section 16(c)(3), (5) and (7)
- Trigger
- personal_data_processing
What this law does
Section 16 grants a data subject rights including to be informed, to object, to access, to rectification or correction, to erasure or blocking, and to damages for inaccurate, unlawfully obtained, or unauthorized use of personal information, alongside the right to file a complaint before the Commission. Section 17 makes these rights transmissible to lawful heirs after the data subject's death or incapacity.
Section 18 grants a right to data portability, obtaining personal data in an electronic or structured, commonly used format that allows further use by the data subject; this right was already present in the original 2012 Act, unlike some regimes that added it only by later amendment.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .