Current position
Overview
AI legislation is in progress.
Regulatory developments
Latest updates
Latest event import:
Updates sourced from Digital Policy Alert ↗. The latest available entries for this jurisdiction.
passage
House of Representatives passed Child Online Safety and Protection Act of 2026 including design requirements
Source: Digital Policy Alert · View update ↗
outline
National Privacy Commission issued statement on nature of registration and its jurisdiction under Data Privacy Act 2012
Source: Digital Policy Alert · View update ↗
On 13 October 2025, the National Privacy Commission (NPC) issued a statement reaffirming its role as the Philippines’ independent data protection authority under the Data Privacy Act of 2012. The statement clarified that registration with the Commission does not imply approval or confirmation of lawful data processing. It stressed that organisations remain responsible for compliance and safeguarding personal data. The NPC also stressed its exclusive authority to determine the legality of data processing activities and stated that only formal issuances, including decisions or orders.
investigation
National Privacy Commission issued cease and desist order against Tools for Humanity
Source: Digital Policy Alert · View update ↗
On 23 September 2025, the National Privacy Commission (NPC) issued a cease-and-desist order (CDO) against Tools for Humanity (TFH), the entity operating the World App and Orb verification system. The order prohibits making the World App available, conducting Orb device verification, and transferring or sharing any previously collected personal data. TFH is also required to submit the total number of Filipino registrants and its operating locations. The NPC found that TFH's data processing practices violated the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations, and other NPC issuances. The CDO was issued on the grounds of invalid consent, as monetary incentives provided by TFH in exchange for iris scanning constituted undue influence. The CDO was also issued on grounds of a lack of transparency for data subjects regarding the purpose, scope, extent, and duration of data processing, as well as the excessive collection of immutable biometric identifiers. Furthermore, the NPC determined that the continued processing of such biometric data exposed Filipino data subjects to risk of identity theft, fraud, and reputational harm.
law
Open Access in Data Transmission Act, including data protection regulation, enters into force
Source: Digital Policy Alert · View update ↗
On 8 September 2025, the Open Access in Data Transmission Act, including data protection regulation, enters into force. The Act embeds data protection by requiring providers to safeguard the confidentiality, integrity, and security of transmitted information. It also mandates full compliance with the Data Privacy Act and related cybersecurity laws under the oversight of the National Privacy Commission. It guarantees end users' rights to privacy and non-discriminatory access, prohibits unlawful interception, blocking, or throttling that may compromise data. The Act also establishes penalties, including fines and suspension for violations affecting data security or user rights.
law
Open Access in Data Transmission Act, including business registration requirement, enters into force
Source: Digital Policy Alert · View update ↗
On 8 September 2025, the Open Access in Data Transmission Act enters into force. The Act requires all segments of the data transmission network to be competitive and open, and all industry participants must register with the National Telecommunications Commission (NTC). The NTC, in coordination with the Department of Information and Communications Technology (DICT) and the Philippine Competition Commission (PCC), shall develop criteria for qualifying participants to encourage broad participation. Operators of international cable landing stations must secure a legislative franchise, and operators of nationwide backbone networks must obtain a permit from the NTC and submit proposed routes and construction plans. All other participants are not required to secure a legislative franchise or certificate of public convenience and necessity (CPCN) but must meet registration criteria. Registered participants must comply with national and international cybersecurity standards, undergo network audits, and obtain third-party cybersecurity certification after three years of operation.
Showing 5 of 15 available API entries. Dates and summaries are supplied by Digital Policy Alert.