Philippine Data Privacy Act and automated processing

What it is

The Data Privacy Act of 2012, Republic Act No. 10173, is the Philippines’ general data protection law. It was approved on 15 August 2012 and created the National Privacy Commission (NPC) to administer and enforce it. Its Implementing Rules and Regulations (IRR) followed in 2016.

The Act was written before today’s AI, but it already contains rules on automated processing. Those rules, with the NPC’s later issuances, are how Philippine law currently governs AI that decides things about people.

Who it applies to

The Act applies to the processing of personal information by personal information controllers and processors. Section 21 makes each controller responsible for personal information under its control or custody, including information transferred to a third party for processing, and requires it to use contractual or other reasonable means to keep a comparable level of protection.

Section 6 gives the Act reach outside the Philippines where the processing relates to Philippine citizens or residents and the entity has a link to the country, such as a contract entered there, business carried on there or personal data collected or held there.

An organization that uses a vendor’s AI system to score credit, screen applicants or flag fraud stays the controller for those decisions. The vendor is usually a personal information processor acting for it.

What it requires

Information on automated processes. Section 16 sets out the data subject’s rights. Section 16(c)(6) gives a right to reasonable access to information on automated processes where the data will, or is likely to, be made the sole basis for any decision significantly affecting the data subject.

Notice of automated decision-making and profiling. The IRR’s statement of the right to be informed includes being told of the existence of automated decision-making and profiling.

Right to object. The IRR lets the data subject object to processing, including processing for direct marketing, automated processing or profiling.

Registration and notification. NPC Circular 2022-04, issued on 5 December 2022 and in effect since 11 January 2023, covers registration of data processing systems, notification regarding automated decision-making or profiling, and designation of data protection officers. Registration is required where an organization employs at least 250 people, processes the sensitive personal information of at least 1,000 individuals, or processes data likely to pose a risk to data subjects’ rights and freedoms. Registration is made through the NPC’s online registration system.

Breach notification. Section 20(f) requires a controller to notify the NPC and affected data subjects promptly when sensitive personal information, or information that could enable identity fraud, is reasonably believed to have been acquired by an unauthorized person and the breach is likely to give rise to a real risk of serious harm.

For an AI system, those rules turn into practical questions. Which systems make decisions about people on their own, with significant effects? Do the privacy notice and the NPC registration say so? Can a person get information on how the decision was made, and can they object? The NPC’s Advisory No. 2024-04 answers how it expects controllers to handle each of these for AI.

Key dates

• 15 August 2012. Data Privacy Act approved.
• 24 August 2016. Implementing Rules and Regulations issued.
• 11 January 2023. NPC Circular 2022-04 took effect, with registration due by 10 July 2023 for covered organizations.
• 19 December 2024. NPC Advisory No. 2024-04 on the application of the Act to AI systems issued.

How it relates to other frameworks

The Act’s approach differs from GDPR Article 22. It does not restrict solely automated decisions outright. It works through transparency, access, the right to object and registration. Singapore’s PDPC AI advisory guidelines take a similar guidance-led route under a general privacy law.

The Philippines has no AI-specific law. Public sector agencies follow the DICT and Civil Service Commission’s Joint Memorandum Circular No. 003, s. 2026, on ethical and responsible AI in government, and the Bangko Sentral ng Pilipinas has published voluntary AI governance principles for supervised financial institutions. Organizations often pair the Act with ISO/IEC 42001 or the NIST AI RMF to structure their AI risk and impact assessments.

A note on this page

This is Aicura’s reading of the Data Privacy Act and its rules on automated processing. It is not legal advice and it is not the Act itself. Read the primary source published by the National Privacy Commission, and take advice on how the Act applies to your organization.