How to Register with the National Privacy Commission in the Philippines: A Complete Guide

The Legal Foundation: RA 10173 and the NPC

The Data Privacy Act of 2012, signed into law on August 15, 2012, is the primary legislation governing the collection, handling, use, and protection of personal data in the Philippines. It applies to any natural or juridical person in the government or private sector that processes personal information. If your organization collects names, contact details, health records, financial data, or any other information that identifies or could identify a person, the DPA applies to you.

The National Privacy Commission is the independent body created under the DPA to administer and implement the law. The NPC issues circulars, advisories, and orders that give the DPA its operational detail. For registration purposes, the governing instrument is NPC Circular No. 2022-04, issued on December 5, 2022 and effective January 11, 2023, which supersedes the earlier NPC Circular No. 17-01 in its entirety. All registration under the current framework is done through the NPC's online platform, the NPC Registration System (NPCRS).

Understanding the Three Registration Tracks

NPC Circular No. 2022-04 establishes three tracks depending on the nature of your organization's data processing activities. Your track determines whether you register through the NPCRS, register voluntarily, or file a notarized sworn declaration. The first step in any compliance process is identifying which track applies to you.

For most new consulting firms, NGOs, and small corporations in the Philippines — including organizations below 250 employees and processing fewer than 1,000 individuals' sensitive personal information — Track 3 applies at the start. However, voluntary registration under Track 2 is strongly recommended for any organization that handles client health data, processes project beneficiary information, or works with government agencies and international development funders. Demonstrating NPC compliance is increasingly expected by donors and government counterparts as part of due diligence.

Key Terms You Need to Know

Before proceeding with registration, these definitions from the DPA and NPC Circular No. 2022-04 are essential:

Step-by-Step: Mandatory or Voluntary Registration Through the NPCRS

If your organization falls under mandatory registration (Track 1) or chooses voluntary registration (Track 2), the process is conducted entirely through the NPCRS. Physical submissions are no longer accepted. All registrations done manually before the NPCRS was operational must be migrated to the NPCRS — prior manual registration is not considered sufficient.

Step-by-Step: Filing the Sworn Declaration (Track 3)

Organizations that do not meet the mandatory threshold and do not elect voluntary registration must file a notarized Sworn Declaration and Undertaking for Exemption from Registration of Data Processing Systems. This is Annex 1 of NPC Circular No. 2022-04.

Registration Fees

Beginning October 1, 2024, all PICs and PIPs are required to pay corresponding fees to register their DPS or renew their registration through the NPCRS. Registration was previously free. The NPC has not published a fixed public fee schedule in a single document — current fees are reflected within the NPCRS platform at the time of filing. Check the NPCRS and the NPC website at privacy.gov.ph for the current fee schedule before beginning your registration.

Ongoing Compliance Obligations After Registration

Registration is not the end of the compliance process. The DPA imposes a set of continuing obligations that all PICs and PIPs must fulfill regardless of their registration track.

Annual Renewal of Registration

For organizations registered under Track 1 or Track 2, the Certificate of Registration is valid for one year from its date of issuance. Renewal must be completed within the 30-day period before expiration. The NPCRS sends renewal notifications 30 days before expiration. Organizations that allow their registration to lapse face erasure of prior registration details from the system and must re-register from the beginning. Monitor the NPCRS dashboard regularly and do not wait for the notification email before initiating renewal.

Annual Security Incident Report (ASIR)

All PICs and PIPs subject to the DPA — regardless of registration track — must submit an Annual Security Incident Report every year. The deadline is March 31 of each year, covering the prior calendar year. The 2025 ASIR deadline is March 31, 2026, as confirmed on the NPC's official website. The ASIR must be filed exclusively through the NPC's Data Breach Notification Management System (DBNMS).

The ASIR covers the total number of security incidents categorized by type — including theft, identity fraud, hardware or software failure, hacking, natural disaster, and user error — and the number of personal data breaches classified by notification type. Organizations with zero security incidents must still file, entering "0" in the relevant fields. Once submitted, the ASIR cannot be edited. Use the Save as Draft option if you are unsure of information before final submission.

Personal Data Breach Notification

If a personal data breach occurs that is likely to give rise to a real risk of serious harm to any affected data subject, the PIC must notify the NPC and affected data subjects within 72 hours of the organization becoming aware of the breach. Notification is made through the DBNMS. The NPC's DBNMS includes an assessment aid to help organizations determine whether a breach triggers the mandatory notification obligation. A breach that does not pose a risk of serious harm is still reportable — it is captured in the ASIR as a voluntary notification.

Amendments to Registration Information

Minor amendments to existing registration — including updates to an existing DPS or a change in DPO — must be updated in the NPCRS within 10 days from the effective date of the change. Only one DPO may be registered per entity at any time. If the DPO changes, the incoming DPO must complete the update process in the NPCRS using their own credentials.

Security of Personal Data (NPC Circular No. 2023-06)

NPC Circular No. 2023-06, issued on April 1, 2024 and effective March 30, 2024, sets the updated minimum requirements for the security of personal data in both the government and private sector. It enumerates the general obligations of a PIC or PIP, which include the designation and registration of a DPO, registration of DPS, conduct of a Privacy Impact Assessment, implementation of a Privacy Management Program, periodic training of personnel on privacy and data protection, and compliance with NPC orders. The transitory period for compliance expired on March 30, 2025, meaning all organizations must now be fully compliant with its provisions.

What the Five Compliance Pillars Require in Practice

The NPC synthesizes DPA compliance into five pillars. Understanding these pillars is essential because they represent what the NPC looks for during compliance audits and what funders and government partners increasingly expect from implementing organizations.

Pillar 1: Commit

The organization's top leadership formally commits to data privacy compliance. This is demonstrated through a board resolution or management order designating the DPO, approving the Privacy Manual, and authorizing the implementation of the organization's Privacy Management Program.

Pillar 2: Know Your Data

The organization conducts a thorough inventory of all personal data it processes — what data is collected, from whom, for what purpose, how it is stored, who has access, how long it is retained, and how it is disposed of. This inventory is the basis for the DPS registration and for the Privacy Impact Assessment.

Pillar 3: Build Your Privacy Program

The organization develops and implements a Privacy Management Program — a documented, organization-wide framework covering privacy policies, procedures for upholding data subject rights, security measures, breach response procedures, staff training, and a schedule for regular review and updating. The Privacy Manual is the primary document embodying this program.

Pillar 4: Maintain Your Privacy Program

The program is not a one-time document. It must be reviewed and updated regularly to reflect changes in the organization's data processing activities, staff changes, technology changes, and new NPC issuances. Annual staff training on data privacy, regular internal privacy audits, and updating DPS registrations when systems change are all part of this pillar.

Pillar 5: Demonstrate Accountability

The organization can show evidence of compliance — registration records, the Certificate of Registration, training records, PIA reports, the Privacy Manual, and ASIR submissions. This documented evidence is what the NPC examines during audits and what government and donor partners request during due diligence reviews.

Why This Matters for Health Consulting and Implementing Organizations

For health consulting firms, NGOs, and implementing organizations operating in the Philippines, NPC compliance is not only a legal obligation — it is increasingly a prerequisite for engaging with government agencies and international development partners.

DOH-funded programs, UNICEF implementing partner agreements, and UNFPA-funded projects all involve the processing of personal data — beneficiary health records, community survey data, patient tracking data, and program participant information. The HACT micro-assessment that UN agencies conduct before transferring cash to implementing partners evaluates data management systems as part of its scope. An organization that cannot demonstrate basic data privacy compliance is at a disadvantage during this assessment.

Under the Universal Health Care Act, primary care facilities and health programs generate and process patient data that qualifies as sensitive personal information. Organizations providing technical assistance to DOH programs that involve beneficiary data are functioning as PIPs at minimum, and often as PICs in their own right when they design and operate the data collection systems.

KOICA, JICA, and World Bank-funded programs in the Philippines also increasingly include data governance provisions in their implementing partner agreements. Having a registered DPO, a functional Privacy Management Program, and a current Certificate of Registration from the NPC demonstrates institutional maturity that strengthens an organization's credibility in competitive procurement processes.

Compliance Checklist

Key NPC Links and References