Philippines

Section 3(a) defines "child", for purposes of the Act's offenses, to include not only a natural person below eighteen and a person presented, depicted, or portrayed as a child regardless of actual age, but also a "computer-generated, digitally or manually crafted image, or graphic of a person who is represented or who is made to appear to be a child".

Section 4 makes it unlawful for any person, through online or offline means, to commit the Act's listed acts against a "child" as so defined, regardless of the child's consent, so an entirely synthetic, AI-generated depiction of what appears to be a child in a sexual context falls within the same prohibition as a depiction of a real child. Section 10(a) punishes a violation of most Section 4 offenses with life imprisonment and a fine of not less than two million pesos.

Section 45 provides that the Act takes effect after fifteen (15) days following its complete publication in the Official Gazette or in a newspaper of general circulation. No notice stating the day of that publication has been located.

Section 20(f) requires a personal information controller to promptly notify the National Privacy Commission and affected data subjects when sensitive personal information, or other information that may enable identity fraud, is reasonably believed to have been acquired by an unauthorized person, where the controller or the Commission believes the acquisition is likely to give rise to a real risk of serious harm. The Act itself sets no fixed numeric deadline.

Section 17(A) of NPC Circular 16-03 requires the Commission to be notified within seventy-two (72) hours upon knowledge of, or reasonable belief that, a personal data breach has occurred. Section 38(a) of the Implementing Rules and Regulations sets the same 72-hour period for notifying the Commission and affected data subjects.

The Data Privacy Act of 2012 (Republic Act No. 10173) uses a criteria-based consent model under Section 12 for ordinary personal information, with a stricter standard under Section 13 for sensitive personal information, and adopts personal information controller and personal information processor terminology, a controller and processor style split. The National Privacy Commission (NPC) enforces the Act.

The Act applies to an act done or practice engaged in and outside of the Philippines by an entity where three conditions are met: the act, practice or processing relates to personal information about a Philippine citizen or a resident; the entity has a link with the Philippines and is processing personal information in the Philippines, or, even if the processing is outside the Philippines, it is about Philippine citizens or residents; and the entity has other links in the Philippines.

Section 6 gives as links a contract entered in the Philippines, a juridical entity unincorporated in the Philippines that has central management and control in the country, and an entity with a branch, agency, office or subsidiary in the Philippines whose parent or affiliate has access to personal information, and as other links carrying on business in the Philippines and personal information collected or held by an entity in the Philippines.

The Implementing Rules and Regulations, Rule II, Section 4, state the reach as applying to an act done or practice engaged in and outside of the Philippines if the person processing is found or established in the Philippines, the processing relates to personal data about a Philippine citizen or resident, the processing is done in the Philippines, or the entity has links to the Philippines such as using equipment located in the country or maintaining an office, branch or agency there, with due consideration to international law and comity.

The Act applies to the processing of all types of personal information by any natural or juridical person, including a controller or processor not found or established in the Philippines that uses equipment located in the Philippines or maintains an office, branch or agency there.

Section 4 excludes seven kinds of information: information about a government officer or employee that relates to the position or functions; information about an individual performing service under contract for a government institution that relates to the services performed; information about a discretionary financial benefit such as a license or permit; personal information processed for journalistic, artistic, literary or research purposes; information necessary to carry out the functions of public authority; information that banks and other financial institutions under the central monetary authority need to comply with the Credit Information System Act and the Anti-Money Laundering Act; and personal information originally collected from residents of foreign jurisdictions under their own laws and processed in the Philippines.

The Implementing Rules and Regulations apply the exclusions only to the minimum extent of collection, access, use, disclosure or other processing necessary to the purpose, function or activity concerned, and limit the research exclusion to research intended for a public benefit.

The Rules put the burden of proving that the Act does not apply on the party claiming the non-applicability, have the controller or processor keep upholding data subjects' rights and the general data privacy principles where they are not incompatible with the exclusion, and have any exemption read liberally in favor of the data subject.

Section 21's Principle of Accountability makes a personal information controller responsible for personal information under its control or custody, including data transferred to a third party for processing domestically or internationally, and requires the controller to use contractual or other reasonable means to provide a comparable level of protection while the data is processed abroad.

This is an accountability-based transfer regime rather than an adequacy list or a localization mandate; no data-localization requirement was found.

Section 16 grants a data subject rights including to be informed, to object, to access, to rectification or correction, to erasure or blocking, and to damages for inaccurate, unlawfully obtained, or unauthorized use of personal information, alongside the right to file a complaint before the Commission. Section 17 makes these rights transmissible to lawful heirs after the data subject's death or incapacity.

Section 18 grants a right to data portability, obtaining personal data in an electronic or structured, commonly used format that allows further use by the data subject; this right was already present in the original 2012 Act, unlike some regimes that added it only by later amendment.

The National Privacy Commission is the supervisory authority, with Chapter VIII (Sections 25-36) setting criminal penalties, including imprisonment and fines, for unauthorized processing, negligent access, improper disposal, unauthorized purposes, unauthorized access due to negligence, malicious disclosure, unauthorized disclosure, and combinations of these acts, scaling with whether sensitive personal information is involved.

Section 37 provides that restitution for any aggrieved party is governed by the general Civil Code, a private civil remedy but one routed through general civil law rather than a freestanding, Data Privacy Act-specific statutory cause of action with its own procedural rules.

National Privacy Commission Circular No. 2022-04, dated 5 December 2022, requires a covered personal information controller or processor to register its Data Protection Officer and its data processing systems with the Commission. Section 5 covers a controller or processor that employs 250 or more persons, one that processes the sensitive personal information of 1,000 or more individuals, and one whose processing will likely pose a risk to the rights and freedoms of data subjects.

A data processing system involving automated decision-making or profiling must be registered in all instances. Under Section 7, a newly implemented data processing system or a first Data Protection Officer must be registered within 20 days from the commencement of the system or the effectivity of the appointment. Under Section 7, a minor amendment to the registration, including a change of Data Protection Officer, must be updated within 10 days.

Section 39 gives covered controllers and processors 180 days from the effectivity of the Circular to complete their registration. The Commission states that covered controllers and processors were allowed until 10 July 2023 to comply under Section 39.

Section 4(a) makes illegal access (accessing the whole or any part of a computer system without right), illegal interception (intercepting a non-public transmission of computer data without right), and data interference (intentionally or recklessly altering, damaging, deleting, or deteriorating computer data without right) offenses against the confidentiality, integrity, and availability of computer data and systems.

On a plain reading each offense turns on acting "without right", so reading a public, unauthenticated page without defeating any access control does not itself fall within any of the three. Section 8 punishes a Section 4(a) or 4(b) offense with imprisonment of prision mayor (six years and one day to twelve years) or a fine of at least two hundred thousand pesos up to an amount commensurate to the damage incurred, or both.

Section 21 gives the Regional Trial Court jurisdiction over any violation of the Act, including a violation committed by a Filipino national regardless of the place of commission. Jurisdiction lies if any of the elements was committed within the Philippines or with the use of any computer system wholly or partly situated in the country, or if the commission damages a natural or juridical person who was then in the Philippines.

Only the ground for a Filipino national mentions nationality; the others turn on where an element was committed, which computer system was used, or where the person damaged was. Section 31 of the Act provides that it takes effect fifteen (15) days after the completion of its publication in the Official Gazette or in at least two (2) newspapers of general circulation. No notice stating the day that publication was completed has been located.

Section 185 makes the fair use of a copyrighted work for criticism, comment, news reporting, teaching, scholarship, research, and similar purposes a defense to infringement, weighed on the purpose and character of the use, the nature of the work, the amount used, and the effect on the work's potential market.

The same section treats decompilation, reproducing and translating a computer program's code to achieve interoperability with another independently created program, as a use that may also constitute fair use. Section 216.1 makes any person infringing a right protected under the Code liable to an injunction and to damages.

Section 173.1(b) protects "compilations of data and other materials which are original by reason of the selection or coordination or arrangement of their contents" as a derivative work: an unoriginal compilation, one that merely reproduces facts without a protectable selection or arrangement, earns no copyright under this section.

Section 175 excludes "mere data as such" and "news of the day and other miscellaneous facts having the character of mere items of press information" from protection outright, regardless of Sections 172 and 173. Section 216.1 makes any person infringing a right protected under the Code liable to an injunction and to damages.

Section 12 permits the processing of personal information only if not otherwise prohibited by law and only when at least one of several listed conditions exists, most commonly the data subject's consent or another enumerated lawful basis; the section draws no exception for personal data that is publicly available online.

The National Privacy Commission's NPC Advisory No. 2026-01 (13 April 2026), Guidelines on Data Scraping of Publicly Available Personal Data, states as guidance that the public availability of personal data does not by itself constitute the data subject's consent to its processing, so a controller scraping publicly available personal data must still identify one of Section 12's lawful bases for the specific purpose of that processing.

Section 45 of the Act provides that it takes effect fifteen (15) days after its publication in at least two (2) national newspapers of general circulation. No notice stating the day of that publication has been located.

Section 6 of Republic Act No. 12010 requires Institutions to ensure that access to their clients' Financial Accounts is protected by adequate risk management systems and controls such as multi-factor authentication, fraud management systems, and other Account Owner enrollment and verification processes. Section 6 requires those systems and controls to be proportionate and commensurate to the nature, size and complexity of the Institution's operations.

Section 6 relieves an Institution that the Bangko Sentral ng Pilipinas determines to be compliant with the risk management requirements of liability for loss or damage arising from the offenses in sections 4 and 5. Section 6 makes an Institution liable for restitution of funds to the Account Owner where it failed to employ adequate risk management systems and controls, or failed to exercise the highest degree of diligence in preventing loss or damage from the offenses in sections 4 and 5.

Section 3(f) defines Institutions as banks, non-banks, other financial institutions, and payments and financial services providers under the jurisdiction of the Bangko Sentral ng Pilipinas. Section 26 provides that the Act takes effect after fifteen days following its publication in the Official Gazette or in a national newspaper of general circulation. The President approved the Act on July 20, 2024. No day of publication of the Act has been located.

Section 148 sets out guidelines on information technology risk management that serve as the Bangko Sentral's baseline requirement for all Bangko Sentral-supervised financial institutions. Section 148 applies its guidelines to banks, non-banks with quasi-banking function, non-bank electronic money issuers and other non-bank institutions under Bangko Sentral supervision or regulation. Section 148 provides that these institutions must establish an effective IT governance framework.

Section 148 provides that the board and senior management should appoint a chief information security officer responsible and accountable for the organization-wide information security program. Section 148 requires these institutions to submit an Annual IT Profile to the supervising department of the Bangko Sentral within twenty-five days from the end of the reference year.

Section 148 provides that the Bangko Sentral may deploy applicable enforcement actions on the institution and its directors, officers and employees for violations of its reporting requirement. Section 148 rests on six circulars of the Bangko Sentral dated between 28 May 2014 and 31 October 2018, and no notice stating the day the provisions this entry describes came into force has been located.

Section 148 requires the Compliance Officer or a designated officer of a Bangko Sentral-supervised financial institution to notify the supervising department of the Bangko Sentral within two hours from discovery of a reportable major cyber-related incident or a disruption of financial services and operations.

Section 148 describes a reportable major cyber-related incident as an event that may seriously jeopardize the confidentiality, integrity or availability of critical information, data or systems of the institution, its customers and other stakeholders. Section 148 treats as a reportable disruption a disruption of critical operations that lasts for more than two hours.

Section 148 provides that a follow-up report should be sent by e-mail within twenty-four hours from the time of discovery of the incident or disruption. Section 148 requires the notice to disclose at least the nature of the incident and the specific system or business function involved. Section 148 subjects non-compliance with the event-driven reporting procedure to the High penalty level of monetary sanctions under section 1102 of the Manual.

Section 148 rests on six circulars of the Bangko Sentral dated between 28 May 2014 and 31 October 2018, and no notice stating the day the provisions this entry describes came into force has been located.

Section 9 makes it unlawful for a person below eighteen years of age to enter, or to misrepresent or use false evidence of age to gain admission into, a moviehouse or theater showing a motion picture the Movie and Television Review and Classification Board (MTRCB) has classified "Restricted" or "For Adults Only". It is likewise unlawful for a theater employee to sell or accept from such a person an admission ticket to such a screening.

Where there is doubt as to a person's age, the person seeking admission must exhibit a residence certificate or other proof of age. Section 11 punishes a violation of the Decree, including this admission restriction, with imprisonment of three months and one day to one year and a fine of not less than fifty thousand pesos nor more than one hundred thousand pesos.

Section 24 provides that the Decree takes effect after fifteen (15) days following its publication in the Official Gazette and/or in newspapers of general circulation in the Philippines. No notice stating the day of that publication has been located.

Section 175 excludes "news of the day and other miscellaneous facts having the character of mere items of press information" from copyright protection outright, regardless of Sections 172 and 173, so a bare news item carries no protection an aggregator could infringe.

Section 184.1(b) separately permits quotations from a published work, including quotations from newspaper articles and periodicals in the form of press summaries, where compatible with fair use and the source and author's name are mentioned.

Section 184.1(c) permits reproducing or communicating to the public by mass media an article on a current political, social, economic, scientific, or religious topic, or a public address of the same nature, for information purposes, unless the rightsholder has expressly reserved the use, provided the source is clearly indicated.

Section 184.1(d) separately permits reproducing and communicating to the public a literary, scientific, or artistic work as part of a report of current events, by photography, cinematography, or broadcasting, to the extent necessary for that purpose.

No press-publisher neighbouring right, comparable to the EU's Digital Single Market (DSM) Article 15 or Germany's Leistungsschutzrecht, exists in the Code; a news aggregator's reproduction of headlines and short extracts is addressed instead by these copyright limitations, and by the Code's own exclusion of news items as such from protection.