🇵🇭 Philippines

Informations

Extracts :

Extract :

"POPIA does not contain provisions on this matter, see PAIA for further information."

2021

Reference :

GDPR vs countries' comparison | DataGuidance

Comparison of GDPR vs countries' data protection laws, definitions etc. - ZAF

Extracts :

Extract :

No mention of the subject rignt related to Persons within their jurisdiction

2022

Reference :

Philippines Data protection overview | DataGuidance

(Data Protection Overview 2021)/ DataGuidance reports

Extracts :

Extract :

No mention of the subject rignt related to Legal entities

2022

Reference :

Philippines Data protection overview | DataGuidance

(Data Protection Overview 2021)/ DataGuidance reports

Extracts :

Extract :

No mention of the data controller's obligation/responsibility to Organizations located outside the jurisdiction processing regulated subjects data.

2022

Reference :

Philippines Data protection overview | DataGuidance

(Data Protection Overview 2021)/ DataGuidance reports

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Extracts :

Extract :

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2023

Reference :

Philippines Data protection overview | DataGuidance

Information on Philippines data protection | DataGuidance

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2023

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

"The right to object to the processing of his or her personal data, including processing for direct marketing, automated processing, or profiling."

2022

Reference :

Philippines Data protection overview | DataGuidance

(Data Protection Overview 2021)/ DataGuidance reports

Extracts :

Extract :

"There are also rights to data portability. Where Personal Information is processed by electronic means and in a structured and commonly used format, the data subject has a right to obtain the Personal Information in that format."

2022

Reference :

Data Protection in different countries | Linklaters

Database for comparing other databases for the same information on data protection

Link to reference

Extracts :

Extract :

"8.7. Right not to be subject to automated decision-making The right to object to the processing of his or her personal data, includes automated processing."

2022

Reference :

Philippines Data protection overview | DataGuidance

(Data Protection Overview 2021)/ DataGuidance reports

Extracts :

Extract :

"8.1. Right to be informed The right to be informed when personal data pertaining to him or her is being processed. 8.2. Right"

2022

Reference :

Philippines Data protection overview | DataGuidance

(Data Protection Overview 2021)/ DataGuidance reports

Extracts :

Extract :

"8.1. Right to be informed The right to be informed when personal data pertaining to him or her is being processed. 8.2. Right"

2022

Reference :

Philippines Data protection overview | DataGuidance

(Data Protection Overview 2021)/ DataGuidance reports

Extracts :

Extract :

"8.2. Right to access The right to reasonably access matters relating to the processing of his or her personal data such as, among others, the identity of the PICs or PIPs that will be given access to his or her personal data."

2022

Reference :

Philippines Data protection overview | DataGuidance

(Data Protection Overview 2021)/ DataGuidance reports

Extracts :

Extract :

"8.3. Right to rectification The right to rectification or the right to dispute the inaccuracy or error in his or her personal data and have the PIC correct it within a reasonable period of time."

2022

Reference :

Data Protection in different countries | Linklaters

Database for comparing other databases for the same information on data protection

Link to reference

Extracts :

Extract :

"8.4. Right to erasure The right to suspend, withdraw, or order the blocking, removal, or destruction of his or her personal data from the PIC's filing system."

2022

Reference :

Data Protection in different countries | Linklaters

Database for comparing other databases for the same information on data protection

Link to reference

Extracts :

Extract :

Data entered based on reference.

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

The reference mentions the notion of approved jurisdictions present.

2021

Reference :

GDPR vs countries' comparison | DataGuidance

Comparison of GDPR vs countries' data protection laws, definitions etc. - PHL

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

It is interpreted as having some type of legal or professional requirement.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

"Where a private entity has branches, sub-offices, or any other component units, it may also appoint or designate a COP for each component unit. Subject to the approval of the NPC, a group of related companies may appoint or designate the DPO of one of its members to be primarily accountable for ensuring the compliance of the entire group with all data protection policies. Where such common DPO is allowed by the NPC, the other members of the group must still have a COP, as defined in the Advisory."

Reference :

APPOINTING A DATA PROTECTION OFFICER

Information on Philippines Data protection officer requirements | Official website

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Extracts :

Extract :

Extracts :

Extract :

Data entered based on reference.

2020

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Actors
Name	Short name	Classification	Jurisdiction	Year of creation
National Privacy Commission (NPC)	NPC	Regulator	Independant agency	2016

Texts
Legal text name	Original text name	Legislation type	Year signed	Regulation status	In effect since	Latest update initiated	Latest update areas	Latest update signed year

🇵🇭 Philippines

Data subject classification

Citizens outside their jurisdiction are considered as data subjects : No

Persons within their jurisdiction are considered as data subjects : Yes

Legal entities are considered as data subjects : Yes

Data controller definition and responsibilities

Organizations located outside the jurisdiction processing regulated subjects data are considered as data controllers within the personal data legislation : No

Organizations located outside the jurisdiction monitoring regulated subjects data are considered as data controllers within the personal data legislation : No

Differentiation between how data controller and data processor are defined : Yes

Organizations with economic activities within the jurisdiction are considered as data controllers within the personal data legislation : Yes

Special/sensitive personal data definition

Definition of personal data that are "special" or "sensitive": biometric data : Yes

Definition of personal data that are "special" or "sensitive": genetic data : Yes

Definition of personal data that are "special" or "sensitive": financial data : No

Definition of personal data that are "special" or "sensitive": medical/health data : Yes

Definition of personal data that are "special" or "sensitive": criminal records data : Yes

Definition of personal data that are "special" or "sensitive": racial/ethnic origin : No

Definition of personal data that are "special" or "sensitive": political opinions : Yes

Definition of personal data that are "special" or "sensitive": religious/philosophical beliefs : Yes

Definition of personal data that are "special" or "sensitive": trade union membership : No

Definition of personal data that are "special" or "sensitive": geo-location data : No

Legal bases for data processing

Potential legal bases for processing personal data: appropriate notice has been provided to or made available to the data subject : No

Potential legal bases for processing personal data: the data subject has provided consent to the processing for the identified purposes : Yes

Potential legal bases for processing personal data: the personal data is necessary to perform a contract with the data subject : Yes

Potential legal bases for processing personal data: the personal data is necessary to comply with a legal obligation : Yes

Potential legal bases for processing personal data: the personal data is necessary to protect the vital interests of a natural person : Yes

Potential legal bases for processing personal data: the personal data is necessary for a public interest : Yes

Potential legal bases for processing personal data: the personal data is necessary to fulfil a legitimate interest of the controller or third party : Yes

Enforcement and penalties

Subject private remedies - presence of individual personal actions? : Yes

Subject private remedies - representative actions? : Yes

Subject private remedies - class actions? : Yes

Provision of administrative penalties by laws : Yes

Max value of monetary penalties for violations (in euros) : 94795

Consideration of turnover rates for penalties? : No

Provision of criminal penalties - fines : Yes

Subject private remedies - file complaints with Data Protection Authorities? : Yes

Provision of criminal penalties - imprisonment : Yes

Data processing and security controls

Audit or supervise Data Processors : Yes

Requirement of a DPIA : Yes

Ensuring encryption/pseudonymisation as a security control : No

Requirement for Controller to notify subjects of a data breach : Yes

Requirement for Controller to notify DPA of a data breach : Yes

Requirement for Processor to notify controller of data breach : Yes

Requirement for Processor to notify DPA of data breach : No

Requirement for Processor to notify subjects of data breach : No

Obligation to maintain information security control to protect personal data from unauthorized access or processing: general technical/physical/organizational security controls : Yes

Rights of data subjects

Right to object data use or/opt out : Yes

Right to data portability : Yes

Right against automated decision making : Yes

Right to be informed : Yes

Consent required for processing children's data : Yes

Right to access information : Yes

Right to rectification : Yes

Right to erase : Yes

Right to withdraw consent : Yes

Right to restrict data processing : No

International data transfer and data localization

Legal basis for international data transfer: approved jurisdictions : Yes

Legal basis for international data transfer: approved standard contractual clauses : Yes

Legal basis for international data transfer: derogations, such as consent, contract performance, necessity to establish, exercise or defend legal claims : No

Legal basis for international data transfer: binding corporate rules : Yes

Data localisation requirements: retention of personal data in local jurisdiction : No

Data localisation requirements: tax or financial record laws : No

Legal basis for international data transfer: EU/EEA adequacy : No

Legal basis for international data transfer: Convention 108 : No

Data localisation requirements: national security laws : No

Legal basis for international data transfer: APEC CBPRs : No

Data localisation requirements (such data is part of another type of record or dataset): retention or storage of personal data in the local jurisdiction or otherwise prohibit the transfer or disclosure of the personal data outside of the local jurisdiction : No

Data localisation requirements: anti-investigatory/blocking statutes that restrict any activity on local territory that aids a foreign government investigation : No

Data localisation requirements: other data localization regulations (export control laws/medical laws/employment laws etc.) : No

Data protection officer (DPO) requirements

Consulting the supervisory authority (DPA) before data processing : Yes

Mandatory appointment of a DPO : Yes

Requirement of professional/legal qualification/expert knowledge for DPO : Yes

Clear DPO role specification : Yes

Group appointments: a group of undertakings to appoint a single DPO : Yes