The Philippine Privacy Impact Assessment Revolution: What the 2026 Draft Circular Means for Foreign Companies
The NPC's August 2026 draft circular would replace the blanket Privacy Impact Assessment obligation that has governed Philippine data privacy compliance since 2017 with a risk-tiered framework. For foreign companies operating in or serving the Philippine market, the shift from a one-size-fits-all requirement to a threshold-based trigger system carries significant compliance and cost implications. This guide explains the eight mandatory PIA trigger categories, the new quantitative thresholds, what the draft circular means for AI systems and cross-border transfers, and the practical steps foreign companies must take now.