Learn / Compliance / Lesson 17
Privacy and personal data
What the Philippine Data Privacy Act asks of every website, from the privacy policy and cookie banner to the day someone asks you to delete them.
Last updated: 2026-09-19
What it is
Any site that collects a name, an email, an IP address or a cookie is processing personal data. In the Philippines that is governed by Republic Act 10173, the Data Privacy Act of 2012, enforced by the National Privacy Commission (NPC). Visitors from the EU bring the GDPR with them, which asks for much the same things.
Why it is a rule
- "Comeleak", 2016. The Commission on Elections' website was defaced and its voter database, around 55 million records, was published online. The NPC found COMELEC had violated the Data Privacy Act and recommended criminal charges against its chairman. It was the case that showed the law has teeth, and that it reaches public bodies too.
- Google and Facebook, France, 2022. The French regulator fined Google €150 million and Facebook €60 million because refusing cookies took several clicks while accepting took one. The cookies were not the problem. The unequal buttons were.
How to do it
A privacy policy people can find
Linked from every page footer and next to every form. It names who controls the data and how to reach the Data Protection Officer, every kind of data collected and why, every outside company that receives it, how long each kind is kept, and the rights people have.
The rights under Section 16 of the Act: to be informed, to access, to object, to erasure or blocking, to correct, to data portability, to damages, and to complain to the NPC.
Cookies: list them, and ask only when you must
- List every cookie and local-storage key: name, purpose, lifetime, and whether the site cannot work without it.
- A session or security cookie is strictly necessary and needs no banner.
- Analytics and marketing are not. They need consent before they load.
- If you need a banner, "Reject" is as big and as easy as "Accept". No pre-ticked boxes. Scrolling is not consent.
Forms: say why, next to the button
Each form states what the data is for and links the policy. Agreeing to the terms is not agreeing to marketing email; that is its own, unticked checkbox. Store what was agreed and when.
Collect less
Every field needs a purpose. No birthday, gender or phone number "just in case". Data you never collected cannot leak.
Children
A business site is not aimed at children and says so. The age of majority in the Philippines is 18; a minor's data needs a parent's or guardian's consent.
Deletion requests
- A named way to ask, at least the DPO's email.
- Verify identity, then delete from the database, logs and every outside processor. Backups age out on their normal schedule.
- Law can require you to keep some records. Tax books and invoices stay for the period the BIR requires; they are locked from every other use, and the person is told why.
Breaches
A breach likely to cause serious harm is reported to the NPC and to the people affected within 72 hours of discovery.
How we do it here
Our privacy policy and terms are written in Markdown and served from one source, so the page and the raw text always match; the raw file is public for anyone who wants to archive it. Inside our business apps, the client is the controller of their own customers' data, and we provide the tools to export and delete it.
Benefits
- Trust: clients handing you their books need to know where the data goes.
- A shorter list of data and processors is a smaller breach, and an easier audit.
- A clear deletion process turns a legal risk into a routine task.
Disadvantages
- A policy must be kept true. Every new cookie, form field or service is a policy change.
- Consent banners, when needed, reduce analytics data, because many people say no.
- Deletion and record-keeping laws pull in opposite directions and need case-by-case care.
Checklist
- Privacy policy linked from every page and form, naming every processor.
- Every cookie listed; non-essential ones wait for consent.
- Accept and Reject are equally easy.
- Forms carry separate, unticked consents.
- A working deletion channel and a 72-hour breach plan.
Sources
- National Privacy Commission — Data Privacy Act of 2012
- National Privacy Commission
- CNIL, deliberations against Google and Facebook on cookie refusal, January 2022.