Data Privacy Act 2012

Every controller designates someone accountable for compliance. With 250 or more employees, sensitive data on 1,000 or more people, or risky processing, register the DPO and processing systems with the National Privacy Commission (NPC) within 20 days.

As of 21 Oct 2026

For breaches that meet the notification conditions: the NPC and the people affected within 72 hours of knowing or reasonably believing it happened; the full report within 5 days.

As of 21 Oct 2026

Administrative fines up to PHP 5 million per act: 0.5–3% of annual gross income for grave violations and 0.25–2% for major ones.

As of 21 Oct 2026