The Data Privacy Act and AI: what Philippine companies need to do

The Data Privacy Act of the Philippines was written in 2012, long before today's AI tools, but it applies to them in full. Whenever an AI system collects, reads, stores or decides on personal data, the company running it is responsible under the law. Since December 2024 the National Privacy Commission (NPC) has also set out what it expects from companies that use AI on personal data.

This guide covers what those rules mean in practice and where to start.

Does the Data Privacy Act apply to AI?

Yes. The Data Privacy Act of 2012 (Republic Act No. 10173) covers all processing of personal information, and it makes no exception for AI. If your chatbot reads customer messages, your system screens job applicants, or a staff member pastes a customer list into an AI tool, that is processing, and your company is the personal information controller accountable for it.

The law even anticipated automated decisions. Section 16 gives people the right to access "information on automated processes where the data will or likely to be made as the sole basis for any decision significantly affecting" them.

What the NPC's AI guidelines ask of companies

On 19 December 2024 the NPC issued Advisory No. 2024-04, its guidelines on applying the Data Privacy Act to AI systems that process personal data. It applies to companies that develop, train, test or deploy such systems, which includes businesses using AI built by someone else.

The advisory applies the law's privacy principles to AI:

It also requires a lawful basis for the processing, effective ways for people to exercise their rights, including objecting and having data corrected or erased, and it treats publicly available personal data as still protected by the law. Where AI makes decisions with significant effects, people must be able to get meaningful review by a qualified person and to contest the result. Ambiguities are to be resolved in favor of the people whose data is processed.

Do you need to register with the NPC?

Under NPC Circular No. 2022-04, a company must register its data protection officer and its data processing systems with the NPC if it:

• employs at least 250 people,
• processes sensitive personal information of at least 1,000 individuals, or
• processes personal data in a way likely to pose a risk to people's rights and freedoms.

Systems that involve automated decision-making or profiling must be registered in every case, whatever the company's size. If your AI scores, ranks or decides on people, check whether it needs to be registered. The NPC reminds companies of these requirements and handles registration through its online portal.

1. Does any system make automated decisions about people or profile them?
   YesRegister it with the NPC, whatever the size of your company.
   No
2. Does any of these apply to your company?

   • At least 250 employees
   • Sensitive personal information of at least 1,000 people
   • Processing likely to put people’s rights and freedoms at risk
   YesRegister your data protection officer and data processing systems.
   No
3. Registration is not mandatory, but every other obligation under the Data Privacy Act still applies.

Five risks we see most often

1. Customer data in public AI tools. Staff paste names, contracts or payslips into free AI chat tools because nobody has said what is allowed.
2. AI switched on by vendors. Software you already use adds AI features, sometimes on by default, and personal data starts flowing somewhere new without anyone deciding it should.
3. No list of what AI is in use. Without an inventory, nobody can answer a data subject's request or an NPC question about how their data was processed.
4. Automated decisions without a person. A score or classification decides on a loan, a hire or a claim with no human review and no record of why.
5. Training on more data than needed. Whole databases are fed into a system when a small, cleaned subset would do, which breaks data minimization and widens the damage of any breach.

A practical checklist to start from

1. Write a short AI policy. Which tools are approved, what data may go into them, and who to ask. One page that staff actually read beats a long one they do not.
2. List the AI you use. Every tool and feature that processes personal data, what data it touches, where that data goes, and who owns it.
3. Assess the systems that matter. Run a privacy impact assessment on anything that processes sensitive data or makes decisions about people, with your data protection officer.
4. Put controls in the systems, not just on paper. Limit who can use what, log what the AI does, set retention periods, and use private deployments where data must not leave your environment.
5. Keep a person in significant decisions. Make the AI explain its result, record it, and have a qualified person review it before it takes effect, with a way for the affected person to contest it.

Then review the list whenever a new tool or AI feature arrives, not once a year.

Is there an AI law in the Philippines yet?

Not yet. Several AI bills are pending in Congress, but the Philippines has yet to enact a comprehensive law on AI. Until one passes, the Data Privacy Act and the NPC's guidance are the main rules for AI that handles personal data, and they already carry weight: unauthorized processing of personal information alone can mean imprisonment of one to three years under Section 25 of the Act, and three to six years where sensitive personal information is involved.

Where we fit in

We are an engineering company, not a law firm. We work with your data protection officer and counsel and turn their requirements into working controls: approved AI tools, access rights, logging and private AI deployments. Our AI governance and data privacy team can help you take stock of the AI you already use and make it safe under the Data Privacy Act.