Philippines

Section 3(a) defines "child", for purposes of the Act's offenses, to include not only a natural person below eighteen and a person presented, depicted, or portrayed as a child regardless of actual age, but also a "computer-generated, digitally or manually crafted image, or graphic of a person who is represented or who is made to appear to be a child".

Section 4 makes it unlawful for any person, through online or offline means, to commit the Act's listed acts against a "child" as so defined, regardless of the child's consent, so an entirely synthetic, AI-generated depiction of what appears to be a child in a sexual context falls within the same prohibition as a depiction of a real child. Section 10(a) punishes a violation of most Section 4 offenses with life imprisonment and a fine of not less than two million pesos.

Section 20(f) requires a personal information controller to promptly notify the National Privacy Commission and affected data subjects when sensitive personal information, or other information that may enable identity fraud, is reasonably believed to have been acquired by an unauthorized person, where the controller or the Commission believes the acquisition is likely to give rise to a real risk of serious harm.

The Act itself sets no fixed numeric deadline; a fixed 72-hour operational deadline is commonly cited as set by a subordinate NPC Circular, which was not read.

The Data Privacy Act of 2012 (Republic Act No. 10173) uses a criteria-based consent model under Section 12 for ordinary personal information, with a stricter standard under Section 13 for sensitive personal information, and adopts personal information controller and personal information processor terminology, a controller and processor style split. The National Privacy Commission (NPC) enforces the Act.

The Official Gazette's own page sits behind a Cloudflare CAPTCHA, which was not bypassed, and the NPC's own PDF mirror serves a PDF.js viewer render rather than document text; the substantive text here is read from the NPC's own HTML reproduction of the Act at privacy.gov.ph, with the Official Gazette recorded as the more authoritative citation.

Section 21's Principle of Accountability makes a personal information controller responsible for personal information under its control or custody, including data transferred to a third party for processing domestically or internationally, and requires the controller to use contractual or other reasonable means to provide a comparable level of protection while the data is processed abroad.

This is an accountability-based transfer regime rather than an adequacy list or a localization mandate; no data-localization requirement was found.

Section 16 grants a data subject rights including to be informed, to object, to access, to rectification or correction, to erasure or blocking, and to damages for inaccurate, unlawfully obtained, or unauthorized use of personal information, alongside the right to file a complaint before the Commission. Section 17 makes these rights transmissible to lawful heirs after the data subject's death or incapacity.

Section 18 grants a right to data portability, obtaining personal data in an electronic or structured, commonly used format that allows further use by the data subject; this right was already present in the original 2012 Act, unlike some regimes that added it only by later amendment.

The National Privacy Commission is the supervisory authority, with Chapter VIII (Sections 25-36) setting criminal penalties, including imprisonment and fines, for unauthorized processing, negligent access, improper disposal, unauthorized purposes, unauthorized access due to negligence, malicious disclosure, unauthorized disclosure, and combinations of these acts, scaling with whether sensitive personal information is involved.

Section 37 provides that restitution for any aggrieved party is governed by the general Civil Code, a private civil remedy but one routed through general civil law rather than a freestanding, Data Privacy Act-specific statutory cause of action with its own procedural rules.

Section 4(a) makes illegal access (accessing the whole or any part of a computer system without right), illegal interception (intercepting a non-public transmission of computer data without right), and data interference (intentionally or recklessly altering, damaging, deleting, or deteriorating computer data without right) offenses against the confidentiality, integrity, and availability of computer data and systems.

On a plain reading each offense turns on acting "without right", so reading a public, unauthenticated page without defeating any access control does not itself fall within any of the three. Section 8 punishes a Section 4(a) or 4(b) offense with imprisonment of prision mayor (six years and one day to twelve years) or a fine of at least two hundred thousand pesos up to an amount commensurate to the damage incurred, or both.

Section 185 makes the fair use of a copyrighted work for criticism, comment, news reporting, teaching, scholarship, research, and similar purposes a defense to infringement, weighed on the purpose and character of the use, the nature of the work, the amount used, and the effect on the work's potential market.

The same section treats decompilation, reproducing and translating a computer program's code to achieve interoperability with another independently created program, as a use that may also constitute fair use. The Code has no dedicated text-and-data-mining exception; a scraper or a model trainer reproducing a copyrighted work would rely on this general fair-use standard rather than a text and data mining (TDM)-specific carve-out.

Section 173.1(b) protects "compilations of data and other materials which are original by reason of the selection or coordination or arrangement of their contents" as a derivative work, a compilation-only standard rather than a sui generis database right: an unoriginal compilation, one that merely reproduces facts without a protectable selection or arrangement, earns no copyright under this section.

Section 175 excludes "mere data as such" and "news of the day and other miscellaneous facts having the character of mere items of press information" from protection outright, regardless of Sections 172 and 173. No sui generis database right, distinct from this originality-based compilation copyright, was found in the Code.

Section 12 permits the processing of personal information only if not otherwise prohibited by law and only when at least one of several listed conditions exists, most commonly the data subject's consent or another enumerated lawful basis; the section draws no exception for personal data that is publicly available online.

The National Privacy Commission's NPC Advisory No. 2026-01 (13 April 2026), Guidelines on Data Scraping of Publicly Available Personal Data, states as guidance that the public availability of personal data does not by itself constitute the data subject's consent to its processing, so a controller scraping publicly available personal data must still identify one of Section 12's lawful bases for the specific purpose of that processing.

Section 9 makes it unlawful for a person below eighteen years of age to enter, or to misrepresent or use false evidence of age to gain admission into, a moviehouse or theater showing a motion picture the Movie and Television Review and Classification Board (MTRCB) has classified "Restricted" or "For Adults Only". It is likewise unlawful for a theater employee to sell or accept from such a person an admission ticket to such a screening.

Where there is doubt as to a person's age, the person seeking admission must exhibit a residence certificate or other proof of age. Section 11 punishes a violation of the Decree, including this admission restriction, with imprisonment of three months and one day to one year and a fine of not less than fifty thousand pesos nor more than one hundred thousand pesos.

Section 175 excludes "news of the day and other miscellaneous facts having the character of mere items of press information" from copyright protection outright, regardless of Sections 172 and 173, so a bare news item carries no protection an aggregator could infringe.

Section 184.1(b) separately permits quotations from a published work, including quotations from newspaper articles and periodicals in the form of press summaries, where compatible with fair use and the source and author's name are mentioned.

Section 184.1(c) permits reproducing or communicating to the public by mass media an article on a current political, social, economic, scientific, or religious topic, or a public address of the same nature, for information purposes, unless the rightsholder has expressly reserved the use, provided the source is clearly indicated.

Section 184.1(d) separately permits reproducing and communicating to the public a literary, scientific, or artistic work as part of a report of current events, by photography, cinematography, or broadcasting, to the extent necessary for that purpose.

No press-publisher neighbouring right, comparable to the EU's Digital Single Market (DSM) Article 15 or Germany's Leistungsschutzrecht, exists in the Code; a news aggregator's reproduction of headlines and short extracts is addressed instead by these copyright limitations, and by the Code's own exclusion of news items as such from protection.