On 11 March 2025, the Insurance Commission (IC) and the National Privacy Commission (NPC) issued Joint Advisory No. 2025-001 (“Joint Advisory”), or Considerations on the Use of Privacy Enhancing Technologies (PETs) in the Insurance Industry.
The Joint Advisory values the adoption of PETs in the insurance industry, which may supplement existing privacy-preserving practices to mitigate data privacy risks and ensure protection of personal data processed by personal information controllers (PICs) and personal information processors (PIPs).

Various agencies led by the Department of Trade and Industry (DTI) have signed Joint Administrative Order No. 24-03, Series of 2024 containing the Implementing Rules and Regulations (IRR) of Republic Act No. 11967, or The Internet Transactions Act of 2023 (ITA).
The ITA is intended to regulate e-commerce, protect consumer rights and data privacy, and uphold intellectual property rights.
The IRR clarifies the scope and coverage of the ITA, the enforcement powers of the DTI vis-à-vis other agencies, and the applicable procedure for imposition of fines.

Various agencies led by the Department of Trade and Industry (DTI) have signed Joint Administrative Order No. 24-03, Series of 2024 containing the Implementing Rules and Regulations (IRR) of Republic Act No. 11967, or The Internet Transactions Act of 2023 (ITA).
The ITA is intended to regulate e-commerce, protect consumer rights and data privacy, and uphold intellectual property rights.
The IRR clarifies the scope and coverage of the ITA, the enforcement powers of the DTI vis-à-vis other agencies, and the applicable procedure for imposition of fines.

The National Privacy Commission (NPC) recently issued NPC Advisory No. 2024-02, which lays down guidelines on the processing of sensitive personal information for the protection of lawful rights and interests or the establishment, exercise or defense of legal claims, pursuant to Section 13(f) of the Data Privacy Act (DPA).
Entities who process sensitive personal information or privileged information must ensure that such processing is compliant with the guidelines provided in the Advisory. A legitimate interest assessment will be helpful in evaluating compliance with NPC Circular No. 2023-07.

The National Privacy Commission (NPC) recently issued NPC Circular No. 2024-02 (“Circular“), which provides an updated policy framework on the use of closed-circuit television (CCTV) systems. The Circular is intended to address emerging privacy risks arising from the use of CCTV systems, and to enable data controllers and processors to properly manage personal data processing carried out through such systems.

The Circular took effect on 27 August 2024.

On 24 May 2024, Republic Act No. 11996, also known as the “Eddie Garcia Law,” was signed into law by the president of the Philippines. It took effect on 13 June 2024. The secretary of the Department of Labor and Employment, in consultation with the Movie and Television Industry Tripartite Council, other concerned government agencies, non-government organizations, and other stakeholders, is mandated to formulate the implementing rules and regulations within 90 days from the law’s effectivity.

The National Privacy Commission issued a press release on 5 June 2024 to “sternly” warn businesses processing personal information that it will issue show cause orders in the case of non-compliance with the Data Privacy Act of 2012 and relevant NPC issuances, particularly NPC Circular No. 2022-04, which outlines the registration framework for data processing systems and data protection officers.

The Data Privacy Act provides that a personal information controller (PIC) must implement reasonable and appropriate organizational, physical and technical measures intended for the protection of personal information against accidental or unlawful destruction, alteration and disclosure, as well as against any other unlawful processing. The PIC shall also protect personal information against natural dangers and human dangers. For this purpose, the National Privacy Commission (NPC) recently issued NPC Circular No. 2023-06 (“Circular”), which sets out the updated minimum requirements for the security of personal data.

The National Privacy Commission (NPC) recently issued NPC Circular No. 2023-05, which sets out the prerequisites for certification under the Philippine Privacy Mark Certification Program.
The NPC Privacy Mark, obtained through the PPM Certification Program, offers the highest level of assurance on data privacy compliance and secure cross-border data transfers of personal information controllers and personal information processors. It helps data subjects identify organizations they can entrust their personal data with.
The Circular took effect on 15 March 2024.

The National Privacy Commission (NPC) recently issued NPC Circular No. 2024-01 (“Circular”), which amends certain provisions of the 2021 Rules of Procedure. The Circular aims to further streamline the process of receiving complaints and instituting investigations on matters affecting any personal information. The amendments impose certain requirements in case of privacy violation complaints by minors or persons alleged to be incompetent.