Law note · Philippines

Data Privacy Act of 2012, enforcement and restitution

cite Republic Act No. 10173 (2012), Sections 25-37 stage IN FORCE in force since 2012-08-15 kind Enforcement supervision binds public and private bodies reviewed 2026-08-29

What it requires

An app processing the personal information of an individual in the Philippines must be prepared to answer to the National Privacy Commission for a Chapter VIII criminal violation, and an individual harmed by unlawful processing may seek restitution under the general Civil Code.

When LexLint raises it

crawls_web
trains_models
generates_content
deploys_chatbot
automated_outreach
high_risk_decisions
processes_voice
processes_biometrics

Private right of action: Yes

What we found

The National Privacy Commission is the supervisory authority, with Chapter VIII (Sections 25-36) setting criminal penalties, including imprisonment and fines, for unauthorized processing, negligent access, improper disposal, unauthorized purposes, unauthorized access due to negligence, malicious disclosure, unauthorized disclosure, and combinations of these acts, scaling with whether sensitive personal information is involved.

Section 37 provides that restitution for any aggrieved party is governed by the general Civil Code, a private civil remedy but one routed through general civil law rather than a freestanding, Data Privacy Act-specific statutory cause of action with its own procedural rules.

Primary source

National Privacy Commission's official HTML reproduction of the Act

← Back to the example · Lint your app →