Data Privacy Act Compliance in the Philippines: Who Is Covered, What You Must Build, and Where Employee Monitoring Stops

Who Is Covered: Controllers, Processors, and When a Foreign Company Counts

Identify your role first, because the duties attach to the role. The Act separates two positions:

• Personal information controller (PIC) - the party that decides why data is collected and how it is used. If your Philippine entity keeps employee files, customer orders and supplier contacts, you are the controller. Responsibility sits with you, and it does not transfer when you outsource the work.
• Personal information processor (PIP) - a party processing on the controller's instructions: a payroll bureau, a cloud HR platform, an outsourced service desk, a collections agency. It acts on instructions but carries its own security and confidentiality duties.

Three assumptions need dismantling before anything else:

• "We are too small for this." Coverage depends on whether you process personal data, not on headcount. Size and data volume affect whether certain additional steps are triggered - registration of processing systems with the regulator being the obvious one - but not the baseline duties of notice, security and confidentiality.
• "We paid to collect it, so it is company property." Personal data carries a set of rights belonging to the data subject. Holding it is closer to custody than to ownership of a machine.
• "We are foreign; the parent sits offshore." Not automatically outside scope. An entity in the country, processing equipment or staff located here, or business genuinely directed at individuals in the Philippines can all bring you in. Cross-border service operations should read this closely alongside setting up a BPO operation in the Philippines.

One more distinction worth drawing early: company information is not personal data. Contract values, stock levels and price lists are commercial information. Names, addresses, mobile numbers, government ID numbers, bank accounts, health details, biometrics and criminal records are personal data, and the last several sit in a more sensitive tier with a higher bar for processing. The first compliance step is not buying software - it is separating those two piles.

When Duties Are Triggered: Three Moments, None of Them "When We Get Audited"

Compliance is not a project with an end date. Specific obligations attach to specific acts, and three moments are routinely missed.

Moment one: the first time you collect anything. Not the first time you deploy a system, and certainly not the first time something goes wrong. The first CV that lands, the first membership form signed at the counter, the first phone number typed into your website - the duty to give notice attaches right there. That means the privacy notice has to exist before collection begins; issuing one afterwards has almost no remedial value. Recruitment-stage limits are covered in what a background check may and may not cover.

Moment two: when your processing reaches the scale or nature that requires registration. The triggers relate to headcount thresholds and to whether you handle sensitive personal information; the current criteria are set by the National Privacy Commission. Two things deserve emphasis: appointing a data protection officer is not size-dependent, and even below any registration threshold, a privacy impact assessment is the only real answer you will have when someone asks why you collect what you collect.

Moment three: the instant you hand data to someone else. Payroll outsourcing, cloud migration, giving a customer list to a marketing agency, syncing employee records to an offshore parent. What this triggers is a written agreement obligation: purpose, scope, security measures, limits on sub-processing, and destruction on termination, all in writing. Verbal trust counts for nothing in front of a regulator.

Two reverse moments matter just as much. When an employee leaves, access is revoked that day and data no longer needed is disposed of per your retention schedule - the sequencing sits alongside resignation and clearance. When a breach is suspected, the notification clock starts from the moment you knew or should have known, the statutory window is short, and the current rules govern.

Six Things the Company Builds, Against Six Rights the Individual Holds

The framework is symmetrical. Every duty on the company exists because a data subject holds a corresponding right. Reading them side by side is what makes the paperwork feel necessary rather than bureaucratic.

Six things the company builds:

• A data inventory. What you hold, from whom, where it lives, who can reach it, how long it stays. Nothing else can be built without this, because you cannot govern what you have never listed.
• Privacy notices - one for staff, one for customers - covering what is collected, why, on what legal basis, who sees it, whether it is outsourced or sent abroad, retention, the rights available and who to contact. The staff version is most cheaply delivered inside the handbook with its own acknowledgement page: see writing an employee handbook that holds up.
• A data protection officer with a name, contact details published internally and reachable externally, who is still employed. Listing someone who left months ago is the most common easy loss during an inspection.
• Three layers of security measures: organisational (access tiers, confidentiality clauses, training), physical (locked cabinets, server room access, shredding), and technical (encryption, logging, backups, patching). Miss a layer and you cannot claim reasonable measures were taken.
• Written processing agreements with every party you hand data to, covering purpose, scope, security and destruction.
• A breach response procedure naming who leads, how severity is assessed, the internal escalation window, who gets notified, and how evidence is preserved.

Six rights on the other side: to be informed, to access, to correct, to object to processing, to erasure or blocking, and to complain and seek damages - plus, often forgotten, data portability. The practical consequence is blunt: an employee can ask to see what you hold on them, and payroll and attendance records are requested most often. Retention requirements are in how to keep payroll records, and what belongs in a foreign employee's file is in the foreign employee document checklist.

The Order of Work: From Inventory to Producible Documents

Most companies stall on where to start, then buy a platform - which is the sequence inverted. This is the order that works:

1. Inventory. Two weeks, no budget. Ask HR, finance, sales, service and admin the same question: which spreadsheets and systems in your hands contain names, phone numbers, ID numbers, account details or health information? Which machine, which cloud, which cabinet? Who holds the key or the login? This step is meetings and lists.
2. Classify, and pull the sensitive pile out. Government ID numbers, bank details, health and medical results, biometrics and criminal records belong in a separate tier with a higher justification bar and stronger controls. Medical data handling is discussed in pre-employment medical examinations.
3. Write one sentence of justification per category. Lawful bases typically include necessity for a contract, compliance with a legal obligation, protection of vital interests, legitimate interests that do not override the individual's rights, and consent. In an employment setting, resting everything on a signed consent form is the weakest possible position - the power imbalance means voluntariness can be challenged at any time. Contract necessity and legal obligation should carry the weight.
4. Issue notices and capture acknowledgement. The staff version ships with the onboarding pack; the customer version sits where people can read it before submitting - website, order page, membership form.
5. Set access tiers and retention periods. Authorise by role, revoke on the day someone leaves or moves, state how long each category is kept and how it is disposed of, and produce an annual purge record.
6. Sign the agreements, run the assessment, rehearse a breach. Put processing agreements in place with vendors, register if you meet the threshold, then walk a hypothetical incident through your procedure. The first rehearsal almost always reveals that nobody knows who to call first.

The value of that order is that the first three steps cost nothing and determine whether everything after them is correct. Companies that buy the system first usually discover it collects far more than they can justify, enlarging the risk rather than reducing it. This can be built in-house or scheduled as part of compliance support.

Where Employee Monitoring Stops: Attendance, Cameras, Devices and Chat

This is the area foreign employers most often get wrong, because the imported default is that company equipment implies unrestricted visibility. Monitoring is not prohibited here, but it has to pass three tests: a purpose you can state out loud, the least intrusive means that achieves it, and clear notice given in advance. Fail any one and ownership of the hardware will not save you.

Item by item:

• Attendance and biometric clock-ins. Lawful, but biometric templates sit in the sensitive tier, demanding stronger justification and controls, plus a non-biometric alternative for those who object. That subject has its own article covering system selection and retention: is fingerprint and face attendance legal, and what it requires.
• Workplace cameras. Security is a legitimate purpose, but placement and notice decide the outcome. Entrances, stockrooms and cash points are generally fine. Changing rooms, toilets and lactation rooms are not. A camera aimed at one person's desk struggles the necessity test. Post visible signage and state the purpose, viewers and retention in the notice. Whether footage can support a disciplinary case depends on whether it was lawfully obtained - see the right order when you discover employee theft.
• Company mailboxes and computers. You may state that company devices and accounts are for work only and may be reviewed under a defined policy - provided that policy is in the handbook and acknowledged in advance, and provided review has a trigger and an approver rather than being available to any curious manager. Reading a mailbox with no prior notice loses on both the privacy and the labour front.
• Personal chat and personal phones. This is the hardest boundary. Private accounts and personal devices are outside what you may process. Demanding personal chat logs, or installing monitoring software on an employee's own phone, carries serious exposure. Evidence has to come from channels the company actually owns.
• Location tracking and screenshots for field or remote staff. The problem is not the technology but over-collection: continuous location and random screen capture usually exceed what confirming hours and output requires. Verifying deliverables is both safer and, in practice, more informative.

A specific warning for companies importing systems from head office: many attendance, access-control and productivity platforms ship with behaviour analytics, emotion detection or desk-occupancy modules enabled by default. Switching those on expands your stated purpose from timekeeping to behavioural surveillance, and the notice you issued no longer covers you. Turning off what you do not need is far cheaper than explaining it later.

After Something Goes Wrong: Breaches, Complaints, and When to Get Help

Good compliance does not prevent incidents; it determines what the first few hours look like.

On a suspected breach - a lost device, an intrusion, an employee emailing a customer list out - the first move is containment and evidence, not blame:

1. Isolate the affected system or account but preserve the logs. The instinctive response is to rebuild the machine, which destroys the only evidence you had.
2. Establish scope: whose data, which categories, whether anything sensitive is involved. That determines whether notification is mandatory.
3. Escalate to the DPO and management. The clock runs from when you knew or should have known, the statutory window is short, and the Commission's current rules govern.
4. Where notification is required, inform the regulator and the affected individuals, describing the remedial steps already taken. Notifying and finding it was minor costs far less than not notifying.
5. Document throughout. Back-dating paperwork afterwards converts a manageable compliance gap into a credibility problem.

In a complaint, the outcome usually turns on whether you can produce the file on the spot: notices and acknowledgements, the DPO appointment, the access register, the retention policy, processing agreements, the breach procedure. Companies lose on inability to evidence, not on what they actually did. Note too that privacy complaints frequently arrive attached to labour claims - a departing employee alleging both illegal dismissal and misuse of personal data is a common pairing, and the procedural failures that decide those cases are set out in where employers most often lose at labour arbitration. Consumer-facing operations carry an extra layer, covered in compliance risks for e-commerce platforms in the Philippines.

Get professional help in these situations: you have received an inquiry from the regulator; a breach involves sensitive data or a significant number of people; you intend to route Philippine employee or customer data to an offshore parent as routine practice, which needs a documented arrangement and does not shed your responsibility; or you are about to launch a system that will collect personal data at volume - involvement at design stage costs a fraction of rework after go-live.

YIXING is a private consultancy operating in the Philippines (SEC registration CS202009551, Bureau of Immigration accreditation CA-202624381-1, with DOLE and PRA accreditation), not affiliated with any government agency, and can assist with data inventory, document frameworks and implementation. For an individual case, consult a Philippine lawyer; this article is not legal advice. Registration thresholds, notification windows and specific requirements follow the Data Privacy Act and the National Privacy Commission's current issuances.