PhilippinesData Privacy Act of 2012, enforcement and restitution
Republic Act No. 10173 (2012), Sections 25-37
In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Breach notice, Consent, Security
- Audit expectation
- none
What it requires
- An app processing the personal information of an individual in the Philippines must be prepared to answer to the National Privacy Commission for a Chapter VIII criminal violation, and an individual harmed by unlawful processing may seek restitution under the general Civil Code.
These lines are LexLint's reading of the law's text. Also read by: National Privacy Commission (NPC Advisory No. 2026-01 of , Guidelines on Data Scraping of Publicly Available Personal Data) (guidance, recorded ).
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Chapter VIII (Sections 25 to 33) of Republic Act No. 10173 makes unauthorized processing, negligent access, improper disposal, unauthorized-purpose processing, unauthorized access or intentional breach, concealment of a security breach, malicious disclosure, and unauthorized disclosure of personal information each a distinct criminal offense, with imprisonment ranging from six months to seven years and fines from PHP 100,000 to PHP 5,000,000 depending on the offense and whether sensitive personal information is involved; a combination or series of these acts carries the highest range, three to six years' imprisonment and a fine of PHP 1,000,000 to PHP 5,000,000.
Penalty structure
The National Privacy Commission computes each infraction as a percentage of the personal information controller's or processor's annual gross income for the preceding year (Grave Infractions 0.5% to 3%; Major Infractions 0.25% to 2%; Other Infractions a fixed PHP 50,000 to PHP 200,000, or up to PHP 50,000 for non-compliance with a Commission order), but the total imposable fine for a single act, whether resulting in single or multiple infractions, cannot exceed this amount.
- Rule
- Fixed only
- As of
- Currency
- PHP
- Fixed cap
- 5,000,000
Who enforces it
Enforcement body
National Privacy Commission (NPC), for administrative fines and referral for criminal prosecution; Philippine courts adjudicate the Chapter VIII criminal offenses and Section 37 civil restitution claims.
Settledness
The Commission's advisory on data scraping deems scraping unauthorized when it violates the Act, the implementing rules, Commission issuances or a site's terms of use, so it construes unauthorized processing for scraping only.
- As of
- Guidance link
- https://web.archive.org/web/2026if_/https://privacy.gov.ph/wp-content/uploads/2026/04/SGD_A_1.pdf
- Guidance body
- National Privacy Commission (NPC Advisory No. 2026-01 of , Guidelines on Data Scraping of Publicly Available Personal Data)
- Open questions
- Does Section 37, which says "Restitution for any aggrieved party shall be governed by the provisions of the New Civil Code", let the Commission award damages in its own proceedings, or only a court in a civil action?
What it makes you log
Logging duty
Sections 25 to 37 set the penalties for unauthorized processing, negligent access, improper disposal, processing for unauthorized purposes, unauthorized access, concealment of a security breach, malicious and unauthorized disclosure, and the extent of liability, and leave restitution to the Civil Code. They state no duty to create, keep or produce a log or record. Section 30 penalizes concealing a breach that Section 20(f) requires to be notified, which is a notification offense and not a record duty.
- Kind
- None
- As of
What this law does
The National Privacy Commission is the supervisory authority, with Chapter VIII (Sections 25-36) setting criminal penalties, including imprisonment and fines, for unauthorized processing, negligent access, improper disposal, unauthorized purposes, unauthorized access due to negligence, malicious disclosure, unauthorized disclosure, and combinations of these acts, scaling with whether sensitive personal information is involved.
Section 37 provides that restitution for any aggrieved party is governed by the general Civil Code, a private civil remedy but one routed through general civil law rather than a freestanding, Data Privacy Act-specific statutory cause of action with its own procedural rules.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .