Data protection
The Data Privacy Act 2012 gives rights of information, access, correction, erasure, damages and data portability, enforced by the National Privacy Commission. Unusually, it carries criminal penalties — including imprisonment — for unauthorised processing and malicious disclosure.
Key points
| Rights | Information, access, correction, erasure or blocking, damages, portability |
|---|---|
| Timeframe | Organisations must respond promptly; the NPC sets expectations |
| Breach notification | Mandatory within 72 hours for breaches involving sensitive data and risk of harm |
| Data protection officer | Mandatory for personal information controllers |
| Criminal penalties | Imprisonment and fines for unauthorised processing and malicious disclosure |
| Sensitive personal information | Includes health, sexual life, and government identifiers |
| Regulator | National Privacy Commission |
| Criminal offences | Unauthorised processing, negligent access and malicious disclosure are crimes |
| 72-hour notification | For breaches involving sensitive personal information |
| Registration | Data processing systems above thresholds must be registered |
| Damages | The Act provides for indemnity in addition to penalties |
In practice
- File the complaint with the National Privacy Commission using its prescribed form.
- Exhaust the organisation's internal process first — the Commission requires it.
Cost and coverage
Complaints to the NPC are free; the Commission mediates many disputes.
Recent changes
The NPC has been particularly active on online lending applications that harvest contact lists to shame borrowers — a practice it has repeatedly sanctioned.
Where to go
- National Privacy Commission — complaints and advisory opinions.
- Data protection officers, whose details must be published.
- Cybercrime units of the police and NBI for criminal matters.
Worth knowing
If a lending app has accessed your contacts and messaged them, that is a recognised violation with an established complaints route at the NPC — screenshots and the app's privacy policy are the key evidence. The Philippine Act provides both criminal penalties and indemnity to the individual, which is unusual in the region and makes complaints worth pursuing.
The general article: Data protection · Compare with another country
Privacy
Article III of the Constitution protects the privacy of communication and correspondence. The Data Privacy Act of 2012 created the National Privacy Commission and criminal offences for unauthorised processing and disclosure. The Supreme Court's writ of habeas data allows a person to compel the correction or destruction of data held about them where their privacy, life, liberty or security is threatened.
Key points
| Constitution | Article III sections 2 and 3 |
|---|---|
| Statute | Data Privacy Act of 2012 |
| Regulator | National Privacy Commission |
| Criminal offences | Unauthorised processing, negligent access, malicious disclosure |
| Writ of habeas data | Petition to compel access, correction or destruction of data |
| Breach notification | Within 72 hours to the Commission for certain breaches |
| Data subject rights | Include the right to damages and the right to file a complaint |
| Consent requirements | Strict, with additional rules for sensitive personal information |
| Government | Covered by the Act, unlike several regional statutes |
In practice
- Exhaust the organisation's internal complaint process: the Commission requires it before acting.
Where to go
- National Privacy Commission.
- Regional trial courts for a writ of habeas data petition.
- Public Attorney's Office.
Worth knowing
The writ of habeas data is a powerful and distinctively Philippine remedy, but it requires a real threat to privacy, life, liberty or security — it is not a general data access tool. The Act covers government agencies as well as private companies, which makes it a genuine route against public sector misuse of data.
Image rights
Republic Act 9995 of 2009 prohibits recording a sexual act or the private parts of a person without consent, and — crucially — separately prohibits copying, selling, distributing or publishing such material even if the recording itself was consensual. The Safe Spaces Act extends protection to gender-based online sexual harassment.
Key points
| Statute | Republic Act 9995, the Anti-Photo and Video Voyeurism Act of 2009 |
|---|---|
| Key point | Consent to the recording is not consent to its distribution |
| Safe Spaces Act | Gender-based online sexual harassment, including unwanted sexual images |
| Evidence | The material is inadmissible if obtained in violation of the Act |
| Cybercrime | Penalties are increased where the offence is committed online |
| Penalties | Imprisonment and substantial fines |
| Inadmissibility | Material obtained in breach of the Act cannot be used as evidence |
| Hosting | Online publication attracts the higher cybercrime penalties |
| Protection orders | Available under the anti-violence law where the parties are or were partners |
In practice
- If the person is a partner or ex-partner, a barangay protection order can be obtained the same day.
Where to go
- PNP Anti-Cybercrime Group.
- NBI Cybercrime Division.
- Commission on Human Rights and women's desks in police stations.
Worth knowing
The separation between consent to record and consent to share is the heart of the statute: an ex-partner who shares a video you agreed to make is committing an offence.
The general article: Image rights · Compare with another country
Copyright
The Intellectual Property Code, with a term of life plus fifty years and an active enforcement office.
Copyright is governed by Part IV of the Intellectual Property Code, Republic Act 8293. The term is the author's life plus fifty years. Fair use is recognised with four factors similar to the American test. The Intellectual Property Office operates an enforcement office and a deposit and recordation system that is useful as evidence.
The Philippines protects works for the author's life plus fifty years under the Intellectual Property Code, and the Intellectual Property Office has an enforcement office with powers to order site blocking for infringing websites — a fast administrative route that does not require a court. Fair use is recognised in a form modelled on the American doctrine, with the same four-factor analysis.
Key points
| Statute | Intellectual Property Code, RA 8293 |
|---|---|
| Term | Life plus 50 years |
| Fair use | Four-factor test, closely modelled on the American formulation |
| Recordation | Deposit with the National Library and IPOPHL as evidence |
| Enforcement | IPOPHL enforcement office; site blocking powers have been strengthened |
| Moral rights | Attribution and integrity, lasting for the term of economic rights |
| Site blocking | IPOPHL can direct blocking of infringing sites |
| Deposit | With the National Library and the Office, useful as evidence |
In practice
- Deposit significant works: the certificate is the practical proof of authorship.
Where to go
- Intellectual Property Office of the Philippines.
- National Library deposit service.
- FILSCAP and other societies.
Worth knowing
The Philippines applies a fair use test on the American model, which makes United States case law persuasive here — unusually among common law jurisdictions in the region.
Frequently asked questions
Does the Philippines have fair use?
Yes, the Intellectual Property Code adopts a fair use provision with the familiar four factors: purpose and character, nature of the work, amount used and effect on the market. It is one of the few jurisdictions outside the United States with a genuinely open-ended exception.
The general article: Copyright · Compare with another country
Identity theft
Computer-related identity theft is a specific offence under the Cybercrime Prevention Act.
Section 4(b)(3) of the Cybercrime Prevention Act of 2012 makes computer-related identity theft a distinct offence: the intentional acquisition, use, misuse or deletion of identifying information belonging to another. The SIM Registration Act requires SIM cards to be registered, which has changed both the risk and the investigative picture.
Computer-related identity theft is a specific offence under the Cybercrime Prevention Act of 2012, punished more severely than the equivalent offline offence. The practical tools have improved since: the anti-financial account scamming legislation allows accounts used in fraud to be frozen and investigated, and the SIM registration law was intended to make disposable numbers harder to use, with mixed results.
Key points
| Statute | Cybercrime Prevention Act of 2012, section 4(b)(3) |
|---|---|
| Penalty | Imprisonment and fines, increased where other offences are committed through it |
| SIM registration | Required by law; report a lost SIM to the provider immediately |
| Reporting | PNP Anti-Cybercrime Group and NBI Cybercrime Division |
| Banking | BSP rules on unauthorised transactions and consumer redress |
| Credit | Credit Information Corporation holds credit data |
| BSP escalation | Consumer assistance mechanism reviews bank refusals |
| Anti-Financial Account Scamming Act | Strengthened powers to freeze mule accounts |
In practice
- Report to the bank and to the PNP Anti-Cybercrime Group or the NBI without delay.
- Have the compromised SIM deactivated and re-registered.
- File a complaint with the BSP consumer assistance mechanism if the bank refuses to refund.
- Request your credit report from the Credit Information Corporation.
- Escalate to the BSP consumer assistance mechanism if the bank rejects your dispute.
Where to go
- PNP Anti-Cybercrime Group.
- NBI Cybercrime Division.
- BSP Consumer Assistance Mechanism.
Worth knowing
If the bank rejects your dispute, the central bank's consumer assistance mechanism can review it: that escalation is free and often decisive. Recent legislation gave regulators power to freeze accounts used to receive scam proceeds. Speed of reporting determines whether that power can be used.
Frequently asked questions
Can a fraudulent account be frozen in the Philippines?
Yes. The anti-financial account scamming law allows banks and the regulator to freeze accounts implicated in fraudulent transfers and to investigate money mules, on a much faster timetable than a court order. Report to your bank and to the police cybercrime unit immediately.
The general article: Identity theft · Compare with another country
Online shopping
The Internet Transactions Act 2023 created a dedicated e-commerce regulator with takedown powers.
The Internet Transactions Act 2023 established the E-Commerce Bureau with authority over online merchants and platforms, including powers to issue compliance and takedown orders and to blacklist persistent violators. It sits alongside the Consumer Act, which governs warranties and deceptive sales practices.
Key points
| E-Commerce Bureau | Regulator for online commerce, with takedown and blacklisting powers |
|---|---|
| Platform liability | Platforms have duties regarding merchant verification and complaint handling |
| Cooling-off | No general right; the Act focuses on disclosure and redress |
| Warranties | Consumer Act implied warranties apply |
| Deceptive practices | Prohibited, with administrative penalties |
| Cross-border | The Act asserts jurisdiction over foreign merchants targeting Philippine consumers |
| Redress | Online dispute resolution being developed |
| Consumer Act | Governs warranties, labelling and deceptive sales practices |
| Internet Transactions Act 2023 | Created an E-Commerce Bureau and platform obligations |
| DTI mediation | Free mediation of consumer complaints |
| Seven-day return | Applies to specified transactions, not to all online purchases |
In practice
- File with the Department of Trade and Industry: mediation is free and generally effective.
- Keep the order confirmation and chat logs; platforms are now required to preserve records.
Cost and coverage
Complaints to the DTI are free.
Recent changes
The 2023 Act substantially strengthened what had been a thin framework, and its implementing rules have been rolled out since. The Internet Transactions Act of 2023 created a dedicated regulator for online commerce.
Where to go
- Department of Trade and Industry consumer care.
- E-Commerce Bureau for platform and merchant complaints.
- Barangay conciliation for small local disputes.
Worth knowing
The DTI takes complaints about online sellers directly, and mediation through it is generally faster than any court route for consumer-value claims. The Internet Transactions Act gave regulators power over online platforms and merchants, including takedown orders. It is recent, so many sellers do not yet comply.
The general article: Online shopping · Compare with another country
General sources
- gov.ph — official government portal