CevroAsia · Data protection
Philippines: Data Privacy Act 2012 and what it requires
Data Privacy Act 2012: an established law with an active enforcement record. Overseen by National Privacy Commission (NPC).
Key requirements at a glance
| Registration with the regulator | Required |
|---|---|
| Data protection officer | Required |
| Breach notification | Within 72 hours |
| Cross-border transfer restrictions | Required |
| Data localization | Not required |
Penalties and enforcement
Fines and, for serious violations, imprisonment.
What to know in practice
Active regulator with a significant enforcement track record.
How Cevro helps
- Maps Data Privacy Act 2012 to the rest of your compliance program, so evidence collected for SOC 2 or ISO 27001 also counts here where it overlaps.
- Gives every failing control a specific fix and a way to re-check it.
Frequently asked questions
Who regulates data protection in Philippines?
National Privacy Commission (NPC) oversees Data Privacy Act 2012.
Is breach notification mandatory under Data Privacy Act 2012?
The law sets a 72-hour window for notifying the regulator of a personal data breach, so you need detection and an incident process that can meet it.
Does Philippines restrict cross-border data transfers?
Yes. Moving personal data out of Philippines is restricted, so confirm a lawful transfer basis before data leaves the jurisdiction.
Do you need a data protection officer under Data Privacy Act 2012?
Yes. Appointing a data protection officer is required.
What are the penalties for non-compliance in Philippines?
Fines and, for serious violations, imprisonment.