iRealtee OS Glossary

Personal Information Controller

The term includes entities that instruct another person or organization to collect, hold, process, use, transfer, or disclose personal information on their beha...

Personal Information Controller

Personal Information Controller (PIC) is a legal designation under Republic Act No. 10173 (Data Privacy Act of 2012) for any person or organization that controls the collection, holding, processing, or use of personal information.

The term includes entities that instruct another person or organization to collect, hold, process, use, transfer, or disclose personal information on their behalf. However, the definition excludes:

  • A person or organization performing data processing functions as instructed by another entity (this would be a Personal Information Processor)
  • An individual collecting or processing personal information for personal, family, or household affairs

Key Components

A Personal Information Controller must:

  • Determine the purpose and means of processing personal data
  • Ensure compliance with the Data Privacy Act of 2012
  • Implement organizational, physical, and technical security measures
  • Designate a Data Protection Officer accountable for compliance
  • Register with the National Privacy Commission when required
  • Uphold data subject rights (access, correction, erasure, portability)

How it Works

You become a Personal Information Controller when your organization decides why and how personal data gets processed. Here's how the accountability chain operates:

  1. Data Collection - You collect personal information directly from data subjects or through third parties
  2. Purpose Determination - You define why the data is collected and how it will be used
  3. Processing Control - You control the processing activities, even if outsourced to a Personal Information Processor
  4. Accountability - You remain responsible for data protection compliance regardless of where processing occurs

The PIC designation applies across industries. In Philippine real estate, this means developers, brokerages, and property management firms processing client data (names, contact details, IDs, financial records) qualify as PICs.

Pros & Cons

Pros:

  • Clear legal accountability framework for data handling
  • Builds client trust through transparent data practices
  • Enables lawful cross-border data transfers with proper safeguards

Cons:

  • Requires dedicated compliance resources (DPO appointment, security measures)
  • Registration and reporting obligations to NPC
  • Criminal and civil penalties for non-compliance (PHP 500,000 to PHP 5,000,000 fines; imprisonment up to 6 years)

Real-World Application

In Philippine real estate, PICs include:

  • Real estate developers collecting buyer information for reservations, sales, and title transfers
  • Brokerage firms maintaining agent and client databases
  • Property management companies processing tenant records and association dues
  • Real estate platforms aggregating property listings and lead information

As a PIC, you must obtain consent before collecting sensitive personal information such as government IDs (TIN, SSS), health records, or financial data required for home loan applications. When sharing client data with banks for financing or with DHSUD for compliance, you must ensure comparable protection through Data Sharing Agreements.

References

Looking for another term? Browse the full glossary.

Back to Glossary