CEIAI Governance Database
Back to the database
Record STMT-W85AA84Legally binding

NPC Advisory No. 2024-04: Guidelines on the Application of Republic Act No. 10173 or the Data Privacy Act of 2012 (DPA), Its Implementing Rules and Regulations, and the Issuances of the Commission to Artificial Intelligence Systems Processing Personal Data

NPC Advisory No. 2024 – 04: GUIDELINES ON THE APPLICATION OF REPUBLIC ACT NO. 10173 OR THE DATA PRIVACY ACT OF 2012 (DPA), ITS IMPLEMENTING RULES AND REGULATIONS, AND THE ISSUANCES OF THE COMMISSION TO ARTIFICIAL INTELLIGENCE SYSTEMS PROCESSING PERSONAL DATA

Guidelines State lawSouth-eastern Asia · PHin force

This advisory from the National Privacy Commission of the Philippines clarifies how the Data Privacy Act of 2012 applies to artificial intelligence systems that process personal data. It outlines obligations for Personal Information Controllers and Processors regarding transparency, accountability, fairness, accuracy, data minimization, and lawful bases for processing. Additionally, it addresses how data subjects can exercise their rights in the context of AI development and deployment.

Summary and content fields are drawn from the document text and are pending editorial review.

Who issued it

National Privacy CommissionRegulator · PH
Lead issuer
Legal forceLegally binding
Under whose authorityState law
Judged fromfull text

Who it governs

CompaniesGeneral publicRegulatorsAI developers and providersAI deployers and users

This advisory is for any entity or individual developing, deploying, or testing AI systems involving personal data in the Philippines to understand their legal compliance obligations under data privacy laws.

Sectors
Cross-sector

What the document contains

What's covered

This advisory covers the application of data privacy principles, lawful bases, security measures, and data subject rights to artificial intelligence systems that process personal or sensitive personal information in the Philippines. It details specific compliance requirements for developers and deployers of AI, including transparency mandates, governance mechanisms like PIAs, bias mitigation, and human intervention safeguards.

What's missing

The document does not establish specific administrative fines or penalties for non-compliance, nor does it provide technical definitions for AI engineering terms beyond citing external frameworks.

Key takeaways
  • The Data Privacy Act of 2012 and its implementing rules apply to all forms of personal data processing involved in AI development, testing, and deployment.
  • Personal Information Controllers must ensure transparency by explaining AI processing purposes, risks, logic, and impact to data subjects using plain language.
  • Controllers remain accountable for AI processing outcomes and must implement governance mechanisms such as Privacy Impact Assessments and human oversight.
  • AI systems must be designed to avoid unfairness, systemic and human biases, and deceptive practices like AI washing.
  • Data subject rights, including the right to object, rectify, and erase data, must be upheld throughout the AI lifecycle, even when data is incorporated into datasets.
Principles it states
TransparencyAccountabilityFairnessAccuracyData Minimization
Outline
· SECTION 1. Scope
· SECTION 2. Application of the DPA
  - A. Transparency
  - B. Accountability
  - C. Fairness
  - D. Accuracy
  - E. Data Minimization
  - F. Lawful Basis for Processing
· SECTION 3. Rights of the Data Subject
· SECTION 4. Interpretation
Issued19 December 2024
Length1,901 words · 5 pages
FormatNot recorded
Scopenational

How it scores

Pending review

Each score is backed by a quote verified against the document text. Editorial review has not yet confirmed them.

Accountability

4/5

Clear responsibility for AI outcomes

PICs shall be accountable for the processing of AI systems and for the outcomes and consequences of such processing when personal data is involved.

SECTION 2. B

screening score · 2026-10-23

Fairness

4/5

Non-discrimination and equitable treatment

PICs shall ensure that personal data is processed in a manner that is neither manipulative nor unduly oppressive to data subjects. As such, PICs shall implement mechanisms to identify and monitor biases in the AI systems

SECTION 2. C

screening score · 2026-10-23

Human Dignity

2/5

Respect for the inherent worth of persons

the effects of such automated decisions can pose a significant risk to the rights and freedoms of data subjects.

SECTION 2. B. 2. a

screening score · 2026-10-23

Human Oversight

4/5

Humans remain in control of consequential decisions

PICs shall implement mechanisms to allow for meaningful human intervention carried out by persons with the necessary competence and authority.

SECTION 2. B. 2. a

screening score · 2026-10-23

Privacy

5/5

Protection of personal data and private life

GUIDELINES ON THE APPLICATION OF REPUBLIC ACT NO. 10173 OR THE DATA PRIVACY ACT OF 2012 (DPA), ITS IMPLEMENTING RULES AND REGULATIONS, AND THE ISSUANCES OF THE COMMISSION TO ARTIFICIAL INTELLIGENCE SYSTEMS PROCESSING PERSONAL DATA

SUBJECT

screening score · 2026-10-23

Transparency

4/5

Openness about how AI systems work and are used

PICs shall inform their data subjects of the nature, purpose, and extent of the processing of personal data when such processing is involved in the development or deployment of AI systems

SECTION 2. A

screening score · 2026-10-23

Enforcement

4/5

Consequences and compliance mechanisms with real force

PICs and, in cases where the processing is subcontracted or outsourced, their PIPs, must be able to demonstrate that they have implemented effective policies and procedures to comply with the DPA, its IRR, and other issuances of the Commission.

SECTION 2. B. 1

screening score · 2026-10-23

Topics

data_privacy artificial_intelligence transparency accountability data_subject_rights