The framework
The Philippines' framework rests on the Data Privacy Act of 2012 (RA 10173), with the National Privacy Commission as the supervisory authority.
That puts the Philippines in the global opt-in majority, where permission comes before processing and marketing waits for consent.
Key instruments
Data Privacy Act of 2012 (RA 10173)
The Philippines was an early ASEAN adopter and has an unusually active regulator. The NPC issues compliance orders, runs breach investigations and added percentage-based administrative fines in 2022. On 22 September 2026 it issued show-cause orders to Meta, Roblox, Reddit and Discord over registration duties as part of a push on children's privacy. Amendment bills to modernize the 2012 Act recur each Congress.
Marketing and advertising
Consent or another lawful criterion; direct marketing and profiling effectively require consent, and the NPC polices deceptive consent design. That single sentence decides most channel plans here.
Cross-border transfers
Accountability-based: the transferor remains responsible; contracts expected.
Enforcement and penalties
Criminal penalties under the Act plus NPC administrative fines of up to 3% of annual gross income, capped at PHP 5M per act (2022 circular).