PhilippinesData Privacy Act of 2012, enforcement and restitution
Republic Act No. 10173 (2012), Sections 25-37
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 15 August 2012.
An enforcement supervision rule binding public and private bodies.
As of 2 September 2026.
What it requires
- An app processing the personal information of an individual in the Philippines must be prepared to answer to the National Privacy Commission for a Chapter VIII criminal violation, and an individual harmed by unlawful processing may seek restitution under the general Civil Code.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Chapter VIII (Sections 25 to 33) of Republic Act No. 10173 makes unauthorized processing, negligent access, improper disposal, unauthorized-purpose processing, unauthorized access or intentional breach, concealment of a security breach, malicious disclosure, and unauthorized disclosure of personal information each a distinct criminal offense, with imprisonment ranging from six months to seven years and fines from PHP 100,000 to PHP 5,000,000 depending on the offense and whether sensitive personal information is involved; a combination or series of these acts carries the highest range, three to six years' imprisonment and a fine of PHP 1,000,000 to PHP 5,000,000.
Penalty structure
The National Privacy Commission computes each infraction as a percentage of the personal information controller's or processor's annual gross income for the preceding year (Grave Infractions 0.5% to 3%; Major Infractions 0.25% to 2%; Other Infractions a fixed PHP 50,000 to PHP 200,000, or up to PHP 50,000 for non-compliance with a Commission order), but the total imposable fine for a single act, whether resulting in single or multiple infractions, cannot exceed this amount.
- Rule
- Fixed only
- As of
- 2 September 2026
- Currency
- PHP
- Fixed cap
- 5,000,000
Who enforces it
Enforcement body
National Privacy Commission (NPC), for administrative fines and referral for criminal prosecution; Philippine courts adjudicate the Chapter VIII criminal offenses and Section 37 civil restitution claims.
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
The National Privacy Commission is the supervisory authority, with Chapter VIII (Sections 25-36) setting criminal penalties, including imprisonment and fines, for unauthorized processing, negligent access, improper disposal, unauthorized purposes, unauthorized access due to negligence, malicious disclosure, unauthorized disclosure, and combinations of these acts, scaling with whether sensitive personal information is involved.
Section 37 provides that restitution for any aggrieved party is governed by the general Civil Code, a private civil remedy but one routed through general civil law rather than a freestanding, Data Privacy Act-specific statutory cause of action with its own procedural rules.
When LexLint raises it
crawls_webtrains_modelsgenerates_contentdeploys_chatbotautomated_outreachhigh_risk_decisionsprocesses_voiceprocesses_biometrics
Read the law
National Privacy Commission's official HTML reproduction of the Act
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.