Glossary

Data Privacy Act of 2012: what it is and what it means for you as a buyer

Also called: Republic Act No. 10173, RA 10173, Philippine Data Privacy Act, DPA 2012. Last reviewed .

The Data Privacy Act of 2012 (Republic Act 10173) is the Philippine law on collecting and handling personal information. It created the National Privacy Commission (NPC), which enforces the Act and issues the rules under it.

What it means for you as a buyer

For your customers' data, your own country's privacy law stays your main rulebook. Section 4(g) of the Act carves out personal information collected from residents of other countries under their own laws and then processed in the Philippines, although the NPC's implementing rules still hold the provider to the Act's security duties. So you still answer to the EU or UK General Data Protection Regulation (GDPR), HIPAA (the US health privacy law), the California Consumer Privacy Act (CCPA) or the Australian Privacy Act, whichever covers your customers. The Act fully covers the provider's own staff files, and Section 21 keeps whoever controls data responsible for it after handing it on.

A worked example with numbers

In this example support inbox, three of the four kinds of record fall mainly under the customer's own law, and only the agent's payroll file falls fully under the Data Privacy Act.

Example: which law mainly applies to each record
Record Example contents Main law Where it says so
A California customer's order email Name, address, order number Your law, such as the CCPA Section 4(g) of the Act
A UK customer's refund chat Name, card's last four digits UK GDPR Section 4(g) of the Act
Your agent's payroll file Salary, social security number Data Privacy Act of 2012 Sections 3 and 4 of the Act
Any record handed on by the controller Any of the above Controller stays responsible Section 21 of the Act

In GDPR terms, you are the controller and the provider is your processor. Your agent is a dedicated agent employed by the provider, so the payroll file is the provider's to protect. A US healthcare practice also needs a business associate agreement before an agent sees patient data.

Where this appears in our pricing or process

The Act shapes the security checks, not the price: the security section of the home page lists what the provider has confirmed in writing, including where the work happens, its NPC registration status and the agreements it signs for your law. The provider holds no formal security or industry certificate at present, so we show no certificate or compliance badge.

Questions buyers ask

Is the provider registered with the National Privacy Commission?

The provider's written answer is that it is not currently registered with the National Privacy Commission.

Will the provider sign a data processing agreement with me?

Yes, for UK and EU clients: the provider has said in writing that it will sign a data protection agreement. It has not said whether that includes the EU Standard Contractual Clauses or the UK Addendum, the clauses for sending data out of Europe, so ask for the draft before you sign the service contract.

  • Business associate agreement (BAA)
    A BAA is the contract HIPAA requires before an outside company handles patient data for a US healthcare business. What to ask, with a worked example.
  • Employer of record (EOR)
    An employer of record legally employs a worker for you and runs payroll while you direct the work. When it fits and what it leaves to you, with an example.
  • Dedicated agent
    A dedicated agent is one person who works only on your account, every working day. What that means for training, cost and cover, with a worked example.

Security and compliance: office-based agents and the paperwork the provider signs

Sources

  1. Republic Act No. 10173, the Data Privacy Act of 2012 (Sections 3, 4, 7 and 21), The LawPhil Project, approved 15 August 2012; text checked 7 November 2026.
  2. Implementing Rules and Regulations of the Data Privacy Act of 2012, Section 5 (special cases), National Privacy Commission, via ChanRobles, promulgated 24 August 2016; text checked 7 November 2026.
  3. National Privacy Commission, Wikipedia, checked 7 November 2026.

We publish what the provider has confirmed in writing. If a figure is not here, we have not been able to confirm it.