iRealtee OS Glossary

NPC Circular No. 2023-04

This Circular provides guidance on what constitutes valid consent and how personal information controllers (PICs) must obtain and manage consent in compliance w...

NPC Circular No. 2023-04

NPC Circular No. 2023-04 is a regulation issued by the National Privacy Commission (NPC) on November 7, 2023, that establishes comprehensive guidelines on obtaining and managing consent for personal data processing under the Data Privacy Act of 2012 (Republic Act No. 10173).

Definition

This Circular provides guidance on what constitutes valid consent and how personal information controllers (PICs) must obtain and manage consent in compliance with Philippine data privacy law. It applies to all PICs engaged in processing personal data based on the consent of data subjects.

Key Provisions

The Circular establishes the following requirements for valid consent:

  • Freely given — Data subjects must have genuine choice and control over their decision; consent obtained through pressure, intimidation, deceptive design patterns, or coercion is invalid
  • Specific — Consent must be granular; PICs must present separate purposes and allow data subjects to select which purposes they consent to; vague or blanket consent is prohibited
  • Informed — PICs must provide all relevant information in clear, plain language using layered privacy notices and just-in-time disclosures
  • Indication of will — Consent must be expressly given through a clear assenting action; implied consent or non-response does not constitute valid consent
  • Evidenced — Consent must be documented through written, electronic, or recorded means

Who is Affected?

Penalties

Processing personal data in violation of this Circular carries:

  • Criminal liability under Sections 25-34 of the Data Privacy Act (fines ranging from PHP 500,000 to PHP 5,000,000 and imprisonment of 1-6 years)
  • Civil liability for damages suffered by data subjects
  • Administrative sanctions imposed by the NPC, including cease and desist orders

Relevance to Philippine Real Estate

For real estate professionals, NPC Circular No. 2023-04 directly impacts how you collect and use client information for promotional activities:

SMS and Viber Marketing You must obtain explicit opt-in consent before sending promotional messages. Pre-ticked boxes or assumed consent from property inquiries are not valid. Each lead captured through marketing forms must include a clear, separate consent mechanism for marketing communications.

Data Sharing with Developers When sharing client information with property developers, you must disclose the identities of all parties in the data sharing arrangement and obtain specific consent for the sharing purpose.

Withdrawal Rights Clients must be able to withdraw consent as easily as they gave it. Your CRM system should include simple opt-out mechanisms, and you cannot continue marketing to clients who withdraw consent by claiming "legitimate interest."

Consent Documentation Maintain records of when and how consent was obtained. Platforms with built-in audit trail capabilities help demonstrate compliance during NPC investigations.

References

Looking for another term? Browse the full glossary.

Back to Glossary