NPC Circular No. 2023-06 is a regulatory issuance by the National Privacy Commission that mandates minimum security standards for personal data processed by Personal Information Controllers (PICs) and Personal Information Processors (PIPs) in the Philippines.
Dated 01 December 2023 and effective 30 March 2024, this Circular repeals NPC Circular No. 16-01 and provides updated requirements aligned with evolving cybersecurity threats and international data protection standards.
Key Provisions
The Circular establishes comprehensive security requirements across multiple domains:
- Data Protection Officer (DPO) Registration – PICs and PIPs must designate and register a DPO with the NPC
- Data Processing System Registration – All systems processing personal data must be registered with the Commission
- Privacy Impact Assessment (PIA) – Required for every processing system, including off-the-shelf software
- Privacy Management Program (PMP) – Organizations must implement a holistic program embedding privacy into operations
- Control Framework – Comprehensive organizational, physical, and technical measures addressing identified risks
- Access Logs – Mandatory logging of who accessed files, when, where, and whether copies were made
- Secure Authentication – Multifactor authentication required for online access to sensitive personal information
Who is Affected?
This Circular applies to:
- All natural or juridical persons processing personal data within and outside the Philippines
- Government agencies and instrumentalities
- Private sector organizations handling personal information
- Real estate service practitioners managing client data
- Property developers maintaining buyer and tenant records
- Real estate brokerages using CRM systems and digital platforms
Real estate businesses handling sensitive client information—including financial records, government IDs, and property transaction documents—must comply with these security requirements.
Penalties
Non-compliance with NPC Circular No. 2023-06 may result in:
- Compliance and enforcement orders
- Cease and desist orders
- Temporary or permanent ban on processing personal data
- Payment of fines as determined by the NPC
- Criminal, civil, and administrative liabilities against erring officers or employees
- Disciplinary sanctions under existing laws
Relevance to Philippine Real Estate
For real estate organizations, this Circular directly impacts how you manage:
- Client databases – Buyer, seller, and tenant personal information requires access controls and audit trails
- Session management – Secure authentication mechanisms must govern user access to property management systems
- Document handling – TCTs, CCTs, and buyer identification documents need encryption during transfer
- CRM systems – Lead data and client profiles must be protected under a documented Control Framework
- Commission records – Agent payment data containing sensitive financial information requires security clearance protocols
The 12-month transitory period ended on 30 March 2025, meaning all covered entities must now be fully compliant.
Related Terms
- Data Privacy Act of 2012
- National Privacy Commission
- Privacy Impact Assessment
- Data Protection Officer
- Personal Information Controller
References
Looking for another term? Browse the full glossary.
Back to Glossary