Data Privacy Act is a Philippine law (Republic Act No. 10173) enacted by the Congress of the Philippines that mandates the protection of individual personal information in both government and private sector information and communications systems.
Signed into law on August 15, 2012, by President Benigno S. Aquino III, this legislation establishes the legal framework for data protection in the Philippines. The law created the National Privacy Commission (NPC) as the independent body responsible for administering and implementing its provisions.
Key Provisions
- Consent requirement: Processing of personal information requires the data subject's freely given, specific, and informed consent
- Data subject rights: Individuals have the right to be informed, access their data, object to processing, and request correction or erasure
- Security measures: Organizations must implement reasonable organizational, physical, and technical safeguards against unauthorized access or breaches
- Breach notification: Entities must notify the NPC and affected data subjects within 72 hours of discovering a security breach involving sensitive personal information
- Extraterritorial application: The law applies to entities outside the Philippines if they process personal information of Filipino citizens or residents
Who is Affected?
The Data Privacy Act applies to:
- Real estate brokerages and PRC-licensed brokers collecting buyer data
- Property developers maintaining client databases
- Marketing teams using lead generation forms
- CRM systems storing prospect and client information
- Any organization processing personal data of Philippine residents
Penalties
| Offense | Imprisonment | Fine (PHP) |
|---|---|---|
| Unauthorized processing of personal information | 1-3 years | 500,000 - 2,000,000 |
| Unauthorized processing of sensitive personal information | 3-6 years | 500,000 - 4,000,000 |
| Improper disposal of personal information | 6 months - 2 years | 100,000 - 500,000 |
| Concealment of security breach | 1.5 - 5 years | 500,000 - 1,000,000 |
| Unauthorized disclosure | 1-5 years | 500,000 - 2,000,000 |
Penalties escalate when 100 or more individuals are affected.
Relevance to Philippine Real Estate
You must comply with the Data Privacy Act when collecting information from property buyers during live chat sessions, inquiry forms, or site tripping reservations. This includes:
- Buyer Information Sheets: Collecting income documents, valid IDs, and contact details requires explicit consent
- Lead forms: Marketing campaigns capturing phone numbers and email addresses must include privacy notices
- CRM storage: Prospect data must be secured with appropriate access controls
- Agent recruitment: Personal documents from salespersons require proper handling procedures
The NPC has issued NPC Circular No. 2023-06 providing specific guidance on consent mechanisms for electronic platforms. Real estate entities processing over 1,000 records must register with the NPC and designate a Data Protection Officer.
Failure to comply exposes your brokerage to criminal penalties and reputational damage. We recommend implementing data privacy compliance features in your property management software to automate consent collection and breach notification workflows.
Related Terms
- National Privacy Commission
- Sensitive Personal Information
- Personal Information Controller
- Data Privacy Compliance
- Data Protection Officer
References
Looking for another term? Browse the full glossary.
Back to Glossary