Question

Can I license data from Philippines BPO operations?

By SourceX Editorial · Updated October 2, 2026

Short answer

Data created by a Philippine BPO is subject to the Philippines Data Privacy Act and to your client contracts, which often own the underlying data. In many BPO setups, the client, not the BPO, holds the rights.

Part of: How licensing works

Explanation#

Check client agreements first; they usually decide.

Agent performance data may be treated differently from customer data.

Rights and privacy#

Confirm customer, vendor and employee agreements allow the use
Remove or de-identify personal details before anything leaves the company
Approve the final dataset and permitted uses in writing

How licensing works#

A business describes its data, buyer demand is assessed, scope and permitted use are proposed, the data is prepared and de-identified, an agreement is signed, and the approved dataset is delivered. See data licensing for detail.

Sources

Philippines: Data Privacy Act of 2012 (National Privacy Commission)

General information, not legal advice. Editorial policy.

Who controls the records a Philippine BPO handles for a client?#

In most client programs the client controls the records and the BPO processes them on the client's behalf. Philippine rules call the client the personal information controller and the BPO the personal information processor, and the Implementing Rules of the Data Privacy Act require their contract to say the BPO processes personal data only on the client's documented instructions, including for any transfer to another country.

The National Privacy Commission treats this subcontracting, where the controller keeps control over the processing, as different from data sharing between two controllers. Clients bring the same expectation from home. Under the GDPR a processor acts only on documented instructions from the controller, and California's CCPA regulations bar a service provider from retaining, using or disclosing personal information collected under its contract except for permitted purposes.

Building a dataset from client records to license on the BPO's own account is a new purpose that the processor role does not cover. It needs the client's written authorization, or the client licenses the data itself with the BPO preparing it under instruction. Who owns the data commercially is then set by the master services agreement and its data processing addendum, not by where the work was done.

Which BPO records could the BPO license itself?#

Usually only records about the BPO's own operations, and even those need a privacy and contract review. This table shows the common record types in a support operation and where the right to license typically sits.

Which BPO records could the BPO license itself?
Record type	Who usually controls it	What decides the right	Practical path
Call recordings, chats and emails with the client's customers	The client	Client contract and the privacy law that applied when the customers' data was collected	Client licenses it, or authorizes the use in writing
Tickets, CRM notes and case histories in client systems	The client	Client contract; the BPO usually works inside client-owned tools	Client-led deal with the BPO preparing data on instruction
Agent performance, QA scores, schedules and attendance	The BPO as employer	Philippine privacy law for employee data, plus any client confidentiality terms on program metrics	Possible BPO-led use after de-identification and a lawful basis review
Agent voices and names inside customer recordings	Both parties, for different people in one file	The client's rights over the interaction and the BPO's duties to its agents	Needs client authorization and an agent-side lawful basis
Scripts, SOPs and training material written by the BPO	Depends on the intellectual property clause	Work-product and confidentiality terms in the services agreement	BPO-led only if the contract leaves the rights with the BPO and no client confidential content remains
Aggregated operations metrics across many programs	The BPO, subject to client confidentiality	Whether a figure could reveal a client, a customer or an agent	Remove client identifiers and confirm confidentiality clauses first

Does English-language support work change which rules apply?#

No. The language of a support record does not change who controls it or which law applies. Records of customers abroad follow the client's contract and the law where those customers were served, while records about agents working in the Philippines are personal information the BPO handles as their employer.

That second layer matters for AI use. The National Privacy Commission's AI advisory (NPC Advisory No. 2024-04) applies the Data Privacy Act to the development of AI systems, including training and testing, so agent data reused for a model falls under the Data Privacy Act, even when the customer side of the same file is governed by foreign law.

What should a BPO confirm before offering any support records?#

Confirm control, location and authorization before any record is copied for a dataset. A short review usually covers these points:

Where the records live: inside the client's own cloud tenant, or exported to BPO storage in the Philippines.
The data ownership, permitted use, confidentiality and intellectual property clauses in the services agreement and its data processing addendum.
Written client authorization that names the AI use, the dataset and the recipient, or a decision to route the deal through the client.
A separation of agent data from customer data, with a documented lawful basis and employee notice for any agent data used.
Confirmation that no transfer or new sub-processor falls outside the client's documented instructions.
De-identification before anything leaves, and a written record of who approved the final file and its permitted uses.

Sources for this section

The Implementing Rules of the Data Privacy Act require a personal information processor to process personal data only on the controller's documented instructions, including for transfers to another country. Source
NPC Circular 2020-03 distinguishes subcontracting, where the controller retains control over the processing, from data sharing between controllers. Source
NPC Advisory No. 2024-04 applies the Data Privacy Act to the development and deployment of AI systems, including training and testing. Source
GDPR Article 28(3)(a) requires a processor to process personal data only on documented instructions from the controller, including for transfers to a third country. Source
The CCPA regulations bar a service provider from retaining, using or disclosing personal information collected under its written contract except for permitted purposes. Source

Related resources

See if your company qualifies

A short company assessment. No data uploads are needed.

See if your company qualifies Talk to SourceX