NPC Advisory No. 2024-04 on artificial intelligence

What it is

NPC Advisory No. 2024-04 is the National Privacy Commission’s guidance on applying the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations and other NPC issuances to artificial intelligence systems that process personal data. It was issued on 19 December 2024.

It does not create new law. It sets out how the NPC reads existing obligations for AI, which makes it the clearest statement of what the regulator expects to see when it looks at an AI system in the Philippines.

Who it applies to

Personal information controllers and personal information processors that develop, train, test or deploy AI systems processing personal data. The Advisory applies across the AI lifecycle, so it reaches organizations building their own models and those using AI from a vendor. Controllers remain responsible for the processing and its outcomes even where the work is outsourced.

What it requires

Transparency. Controllers should tell data subjects, in clear language, the nature, purpose and extent of AI processing, its inputs and outputs, the risks and likely impacts, and how to dispute outcomes.

Accountability. Controllers are accountable for both the processing and its outcomes. The Advisory points to documented policies, privacy impact assessments, privacy by design and by default, monitoring of AI operations and governance mechanisms such as AI ethics boards.

Human intervention. Where AI decisions carry significant risks to rights and freedoms, controllers should provide meaningful human intervention and a way for data subjects to question and contest decisions.

Fairness. Controllers should detect, monitor and limit systemic, human and statistical bias. They should also avoid AI washing, which misrepresents how far AI is involved.

Accuracy and data minimization. Personal data used in AI should be verified and kept up to date, and personal data that does not contribute meaningfully to developing, training or deploying the system should be left out.

Lawful basis. Controllers must identify the most appropriate lawful basis under sections 12 and 13 of the Act. Publicly available personal data is still protected and still needs one.

Data subject rights. Rights to object, to rectification and to erasure or blocking must be workable before, during and after the AI lifecycle. Including data in a dataset does not by itself make a request unreasonable. Where a request cannot be met, the controller should explain why and try to achieve its intended effect another way. Ambiguities are to be resolved in favor of the data subject.

For an organization running AI, that is a recognizable governance program. An inventory of AI systems that process personal data, a privacy impact assessment for each, human review where decisions matter, bias monitoring once live, and notices that say plainly what the AI does. The AI impact assessment guide and the bias assessment guide cover the core assessments.

Key dates

• 15 August 2012. Data Privacy Act approved.
• 19 December 2024. NPC Advisory No. 2024-04 issued.

How it relates to other frameworks

The Advisory builds on the Act’s own rules on automated processing, including the right to information on automated decisions and the right to object to profiling. It is close in spirit to Singapore’s PDPC advisory guidelines on AI and personal data.

In the public sector, the DICT and Civil Service Commission’s Joint Memorandum Circular No. 003, s. 2026, applies the same data protection expectations to AI in government. In finance, the Bangko Sentral ng Pilipinas’ voluntary AI governance principles ask supervised institutions to respect data subject rights. Organizations that want a full management system often build on ISO/IEC 42001.

A note on this page

This is Aicura’s reading of NPC Advisory No. 2024-04. It is not legal advice and it is not the Advisory itself. Read the primary source published by the National Privacy Commission, and take advice on how the Data Privacy Act applies to your organization.