Data Privacy

Philippine data-protection law has teeth. The Data Privacy Act of 2012 (RA 10173) reaches any business that handles the personal data of people in the Philippines — wherever that business is incorporated — and the National Privacy Commission (NPC) enforces it with registration requirements, breach-notification deadlines, and real penalties. We keep clients compliant before the NPC ever calls, and stand between them and the Commission when it does.

Privacy compliance

Compliance starts at the NPC and works outward. We handle registration and the appointment and ongoing support of your Data Protection Officer, and we build the documents the law actually inspects: privacy notices, consent mechanics, and privacy impact assessments. Around those sit the contracts — data processing and data sharing agreements with vendors, affiliates, and platforms, and cross-border transfer arrangements for multinationals moving data in and out of the Philippines — all shaped to the sector-specific rules that govern fintech, e-commerce, health, and outsourcing businesses.

Breach readiness and response

When an incident happens, the clock is short — notifiable breaches must reach the NPC and affected data subjects within 72 hours. We prepare clients before that clock ever starts: incident-response playbooks, tabletop reviews, and vendor obligations that hold up under pressure. When it does start, we manage the notification, the investigation, and the defense — including complaints and enforcement proceedings before the NPC.

Cybercrime and online defamation

The Cybercrime Prevention Act (RA 10175) turned online speech and online conduct into criminal exposure — and this is where our practice has been tested most. We have prosecuted and defended cyber libel and related cybercrime cases for businesses, private individuals, and public figures, from the complaint before the prosecutor's office through trial. If your name is being attacked online, or a post of yours has become a criminal complaint, we know the terrain on both sides.

Who we act for

Technology companies and startups, fintech and e-commerce operators, multinationals with Philippine data flows, public figures whose reputations live online, and the boards and officers accountable for all of it. Where a matter involves artificial intelligence — model training, automated decision-making, AI deployment — we work hand in hand with our Technology and Artificial Intelligence practice.

If you are getting oriented, start with our guide to Data Privacy Act compliance and NPC enforcement for foreign companies — then bring us the specifics.