Laws and data licensing
Philippines: privacy laws and AI data licensing
Short answer
If your records include people in Philippines, the main rules are: Data Privacy Act of 2012.
In short
- Country
- Philippines
- Main privacy laws
- Data Privacy Act of 2012.
- Note
- Registration and consent rules.
- Last reviewed
- 2026-10-09
- 01Your work records
- 02Personal details removed
- 03You approve the release
- 04Licensed to AI developers
What to know#
Registration and consent rules.
For suppliers#
- SourceX works with businesses in the U.S., Canada, the EU, the UK, Australia, New Zealand, India, Singapore, South Africa, Latin America, the UAE and Saudi Arabia; businesses based in Philippines aren't covered yet, but their customers can appear in covered companies' records
- Records tied to other countries are reviewed against their rules or excluded
- Personal details are removed before anything is shared
Which lawful basis covers reusing Philippine records for AI work?#
The business needs one of the criteria in Section 12 of the Data Privacy Act for ordinary personal information, or one of the narrower exceptions in Section 13 for sensitive personal information. Section 12 lists consent, performance of a contract with the person, a legal obligation, vital interests, public functions and the legitimate interests of the controller or a third party, unless those interests are overridden by the person's fundamental rights and freedoms.
Consent under the Act must be freely given, specific and informed, and evidenced by written, electronic or recorded means. Sensitive personal information, which includes health, education, genetic and sexual life data, age, marital status, religious or political affiliations and government-issued identifiers such as social security numbers, may not be processed at all unless a Section 13 exception applies, such as consent specific to the purpose given before processing.
The National Privacy Commission's AI advisory (NPC Advisory No. 2024-04) confirms these rules reach the development of AI systems, including training and testing. It says the lawful basis under Sections 12 and 13 must be identified before processing, that publicly available personal data remains protected, and that data which does not help the system should be excluded. The Act protects information from which a person's identity is apparent or can be reasonably and directly ascertained, so the review turns on whether records still identify people after preparation.
How do outsourcing and BPO rules change who is responsible?#
In an outsourcing arrangement the Philippine company that decides the purpose stays the personal information controller, and the provider that processes on its behalf is a personal information processor. NPC Circular 2020-03 treats this subcontracting, where the controller retains control over the processing, as separate from data sharing between two controllers.
The Implementing Rules require the controller-processor contract to say, among other things, that the processor acts only on documented instructions, including for transfers to another country, keeps personnel under confidentiality, applies appropriate security measures and engages no sub-processor without the controller's prior instruction.
Business process outsourcing raises one special case. Section 4 of the Act excludes personal information originally collected from residents of foreign jurisdictions under their laws and then processed in the Philippines. The Implementing Rules put the burden of proving the foreign law on whoever relies on the exclusion; without that proof, the Act and its rules apply. A BPO provider also cannot license client records for its own use, because a processor acts only on the controller's instructions.
What does cross-border accountability require when records leave the Philippines?#
Section 21 makes each controller responsible for personal information under its control or custody, including information transferred to a third party for processing, whether domestically or internationally. The controller must use contractual or other reasonable means to provide a comparable level of protection while the third party processes it.
When a recipient will use records for its own purposes, the transfer is controller-to-controller data sharing rather than outsourcing. An NPC clarification issued in 2025 states that a data sharing agreement is optional, but the Commission encourages one because it demonstrates accountability. Under Section 6 the Act can also reach processing outside the Philippines when it concerns Philippine citizens or residents and the entity has a link to the country, such as a contract entered into there.
Which NPC checkpoints apply before records leave a Philippine business?#
These are the points a reviewer usually confirms for records that still contain personal information about people in the Philippines, based on the National Privacy Commission texts as checked on 13 October 2026.
The stakes are criminal as well as regulatory. Under Section 25, processing personal information without consent or other legal authority carries one to three years' imprisonment and a fine of PHP 500,000 to PHP 2,000,000; for sensitive personal information the range is three to six years and PHP 500,000 to PHP 4,000,000.
| Checkpoint | Rule | Question to answer | Typical evidence |
|---|---|---|---|
| Lawful basis | DPA Sections 12 and 13 | Which criterion or exception supports the new use? | Consent records or a documented legitimate-interest assessment |
| AI use | NPC Advisory No. 2024-04 | Is the training or testing use identified and minimized? | Purpose statement and a privacy impact assessment |
| Foreign-resident data | DPA Section 4 and the Implementing Rules | Was the data collected abroad under foreign law and only processed here? | Client contracts and proof of the governing foreign law |
| Processor terms | Implementing Rules on outsourcing | Does the provider act only on documented instructions? | Processing agreement with security and sub-processor terms |
| Third-party transfer | DPA Section 21 and NPC Circular 2020-03 | How is comparable protection ensured by the recipient? | Data sharing agreement or other contractual safeguards |
| Registration | NPC Circular 2022-04 | Does the business employ 250 or more people, process sensitive data of 1,000 or more individuals, or run processing likely to pose a risk to people? | Registration records or the documented reason registration is not required |
| Breach readiness | NPC Circular 16-03 | Can the Commission be notified within 72 hours of knowledge or reasonable belief of a notifiable breach? | Breach response plan and notification templates |
Sources for this section
- The Data Privacy Act of 2012 sets the lawful processing criteria (Section 12), the sensitive data rules (Section 13), the foreign-resident special case (Section 4), extraterritorial reach (Section 6), accountability for transfers (Section 21) and penalties (Section 25). Source
- The Implementing Rules set the required terms of controller-processor contracts and place the burden of proving foreign law on whoever relies on the Section 4 exclusion. Source
- NPC Advisory No. 2024-04 applies the Data Privacy Act to AI development and deployment, including training and testing. Source
- NPC Circular 2020-03 governs data sharing between controllers and excludes transfers incidental to subcontracting with a processor. Source
- An NPC 2025 clarification (SGD 2025-01) states that executing a data sharing agreement is optional but encouraged as evidence of accountability. Source
- NPC Circular 2022-04 sets the registration triggers of 250 employees, sensitive data of 1,000 or more individuals, or processing likely to pose a risk. Source
- NPC Circular 16-03 requires notifying the Commission within 72 hours of knowledge or reasonable belief of a notifiable personal data breach. Source
Frequently asked questions
Which privacy laws apply to records about people in Philippines?
Data Privacy Act of 2012. Registration and consent rules.
Can a company based in Philippines license its data through SourceX?
Not yet. SourceX prioritizes companies in the U.S. and also works with companies in Canada and the EU, and with companies in the UK, Australia, New Zealand, India, Singapore, South Africa, Latin America, the UAE and Saudi Arabia when at least 90% of their data is in English. Companies based elsewhere can still apply and are contacted when their region opens.
Can a U.S. business license records that include customers in Philippines?
Records tied to Philippines are reviewed against its rules or excluded from the license, and personal details are removed before anything is shared.
What happens to records that cannot be cleared?
Records that can't be cleared under the rules that apply are excluded, and the company approves every release before data moves.
General information, not legal advice. Laws change and their application depends on your facts. SourceX assesses which rules apply deal by deal with your counsel. Last reviewed 2026-10-09.