The Philippines was one of Asia’s early adopters of a comprehensive data protection law. The National Privacy Commission (NPC) is an active regulator with detailed circulars on registration, breach management and security.
The Internet Transactions Act of 2023 adds duties for online merchants and e-marketplaces serving Filipino consumers.
- Core data law
- Data Privacy Act of 2012 (RA 10173)
- Regulator
- National Privacy Commission (NPC)
- Registration
- DPO and data processing systems, above thresholds
- Breach notice
- Within 72 hours to the NPC and data subjects
- E-commerce
- Internet Transactions Act 2023
- Penalties
- Criminal penalties and NPC fines
Who needs to comply
Startups processing personal data of Filipinos
The DPA applies to processing in the Philippines and to some offshore processing of Filipino citizens’ or residents’ data.
Online merchants and marketplaces
The Internet Transactions Act sets registration, disclosure and liability rules.
The laws, in detail
01Data Privacy Act & IRR
Transparency, legitimate purpose, proportionality, rights, security and breach notification.
When it applies
Processing in the Philippines, or of Filipino citizens’ or residents’ data with a link to the Philippines.
What you must do
- Appoint a DPO and register with the NPC where thresholds are met
- Privacy notice and lawful criteria for processing
- Organisational, physical and technical security measures
- Notify the NPC and data subjects within 72 hours of a qualifying breach
- Data sharing and outsourcing agreements
Regulator
National Privacy Commission
Penalties
Imprisonment and fines for listed offences; administrative fines under NPC rules.
02Internet Transactions Act 2023
Online commerce, e-marketplaces and consumer protection.
When it applies
Online merchants and platforms transacting with consumers in the Philippines.
What you must do
- Disclose merchant information
- Handle complaints
- Shared liability for some marketplace transactions
Regulator
Department of Trade and Industry (E-Commerce Bureau)
Penalties
Fines and takedown orders.
03Cybercrime Prevention Act 2012
Cybercrime offences, data preservation and cooperation with law enforcement.
When it applies
Service providers and users in the Philippines.
What you must do
- Preserve traffic data on request
- Cooperate with lawful orders
Regulator
DOJ Office of Cybercrime
Penalties
Fines and imprisonment.
04Anti-Financial Account Scamming Act 2024 (AFASA)
Prevention of financial account scams, money muling and social engineering.
When it applies
Banks, e-money issuers and other BSP-supervised institutions and their partners.
What you must do
- Fraud management systems
- Temporary holding of suspicious funds
- Investigation cooperation
Regulator
Bangko Sentral ng Pilipinas
Penalties
Fines and penalties.
05BSP rules for virtual asset service providers
Licensing and supervision of VASPs.
When it applies
Exchanging or safekeeping virtual assets in the Philippines.
What you must do
- BSP VASP licence
- Risk management and consumer protection
- AML/CFT and Travel Rule
Regulator
Bangko Sentral ng Pilipinas
Penalties
Sanctions and licence action.
Compliance checklist
01 · Before you launch
- Appoint a DPO
- Privacy notice
- Check NPC registration thresholds
02 · At launch
- 72-hour breach plan
- Outsourcing and data sharing agreements
- Security measures documented
03 · As you scale
- Privacy impact assessments
- Annual security incident reports to the NPC
Key dates
- 2012Data Privacy Act enacted
- 2016Implementing rules and regulations
- 2023Internet Transactions Act
Common mistakes
- No DPO
- Missing NPC registration
- Late breach notification
FAQs
Do offshore companies need to comply?
Often yes, where they process data of Filipino citizens or residents with a link to the Philippines.
Sources
Reviewed 12 October 2026. General information, simplified for planning; not legal advice. Check current law before relying on any requirement, and get advice for your facts. For markets outside India, advice is coordinated with locally qualified counsel.