Data Privacy Act (RA No. 10173) Overview

The right to control access to and use of personal information.

A legal framework protecting the personal information of individuals in information and communications systems (ICS).

A system used to generate, send, receive, store, or process electronic data messages, including computers and networks.

The policy of the Philippine government to protect the fundamental human right to privacy while ensuring free flow of information.

Any information, whether recorded or not, that can reveal an individual's identity.

The agency responsible for enforcing the Data Privacy Act in the Philippines.

The goal of promoting innovation and growth while protecting personal information.

A system for collecting, processing, and storing personal information.

The National Privacy Commission (NPC) is an independent body responsible for enforcing the Data Privacy Act in the Philippines. It ensures compliance with international data protection standards and safeguards personal information.

The NPC is responsible for administering and enforcing the Data Privacy Act, monitoring compliance, and ensuring the country adheres to international data protection standards.

The NPC must keep any personal information it receives confidential. This means they cannot share it with others without a good reason.

The term 'Commission' refers to the National Privacy Commission, established by the Data Privacy Act (RA 10173).

A personal information controller is someone or an organization that collects, stores, uses, processes, or shares personal information. This could be a business or a government agency.

A personal information processor is someone or an organization that processes personal data on behalf of the controller. This could be a third-party company hired to manage data.

The term excludes: a person or organization receiving instructions for data processing and individuals handling personal information for personal or household matters.

The Data Privacy Act (RA 10173) aims to protect personal information. It defines certain key terms, including personal information controller and processor, to ensure clear understanding and implementation.

Any freely given, specific, informed indication of will by the data subject to allow the collection and processing of their personal information.

Any operation or set of operations performed on personal information, including collection, storage, retrieval, and deletion.

An individual whose personal information is being processed.

Personal information about an individual's race, ethnic origin, marital status, age, color, religious, philosophical, or political affiliation.

Personal information about an individual's health, education, genetic or sexual life, or any legal proceedings involving them.

Personal information issued by government agencies, including social security numbers, health records, licenses, and tax returns.

Personal information specifically designated by the government to be kept classified.

This Act applies to all types of personal information and to any natural or juridical person involved in processing it.

Any form of data that is protected by law as privileged communication, usually involving legal or medical information.

Information that relates to an individual's employment with the government, including their title, address, salary, and position.

The processing of personal information should be allowed if it follows the principles of transparency, legitimate purpose, and proportionality, while abiding by the Data Privacy Act and allowing public disclosure under other laws.

The data subject (the person whose information is being processed) provides clear agreement to the processing of their information.

Processing personal information is necessary to fulfill a contractual obligation between the data subject and the controller, or to take steps at the data subject's request before entering an agreement.

The controller needs to process personal data to comply with a legal requirement, like a law or court order.

The processing of personal data is essential to protect the vital interests of the data subject, such as their life or health.

The processing of personal information is necessary to respond to a national emergency, maintain public order, or fulfill the functions of a public authority, which might include the processing of personal data for fulfilling their mandate.

The processing of personal information aligns with the legitimate interests of the controller or a third party, except when these interests conflict with fundamental rights and freedoms of the data subject requiring protection under the Philippine Constitution

Personal information should be collected for clearly defined and specific purposes before or shortly after collection. It should only be processed for those stated purposes later.

Personal information should be processed lawfully and fairly.

Personal information should be accurate and relevant, and kept updated. If information is inaccurate or incomplete, then it must be corrected, supplemented, or destroyed.

A personal information controller can delegate the processing of personal information to another party, but remains responsible for ensuring the safety and compliance of the processed information.

Companies with less than 250 employees are exempt from registration unless their data processing poses risks, is not occasional, or involves sensitive information about many individuals.

A personal information controller is accountable for the safe and compliant transfer of personal information, even when processed by another party.

This refers to the information that needs to be submitted when registering a personal information processing system.

The purpose of processing needs to be stated during registration, including whether the processing is done through an outsourcing agreement.

This refers to the individual or organization responsible for collecting, storing, and processing personal information.

This refers to the individual or organization that processes personal information on behalf of the controller.

Organizations are required to submit an annual summary report to the Commission about their personal information processing activities.

Data subjects have the right to know whether their information is being processed, and to access specific details about the processing.

Before personal information is processed, data subjects must be provided with information about the type of data being processed, the purpose of processing, the methods used, and other important details.

Data subjects have the right to correct any inaccurate or incomplete personal information held by the data controller.

The processing of sensitive personal information and privileged information is generally prohibited, but exceptions are allowed for specific purposes.

The data controller must ensure that the principles of personal information processing are followed, including obtaining valid consent, limiting the processing purpose, and maintaining data security.

The data controller must implement safeguards to protect personal information stored for extended periods. These safeguards ensure the information is not mishandled or compromised.

The processing of sensitive personal information can be allowed if the data subject has given their explicit consent, even if the information is privileged.

The processing of sensitive information is permitted if it's necessary to protect the life or health of the data subject. This applies even if they can't express their consent due to circumstances.

Public organizations can process sensitive personal information if it aligns with their lawful, non-commercial objectives and benefits their members. However, it should not be shared with outside parties.

The processing of sensitive information can be allowed if it's required by existing laws and regulations. This requires proper safeguards to protect the data.