Philippine Data Privacy Act Compliance: A Checklist for SMEs

By Atty. Ray John Bangi. Published 2026-02-18.

The Five Building Blocks

The National Privacy Commission expects every personal information controller to address five areas: governance, risk assessment, organization-wide measures, technology, and breach management.

1. Appoint a Data Protection Officer

The DPO must be a full-time or organic employee with sufficient authority. Outsourcing the function alone does not satisfy the law.

2. Register With the NPC

Required if you process personal data of 1,000+ individuals, employ 250+ persons, or process sensitive personal information.

3. Privacy Impact Assessments

Conduct PIAs for major processing activities — onboarding, marketing platforms, HR systems.

4. Privacy Manual and Notices

Adopt an internal privacy manual and external privacy notices in plain language.

5. Breach Response Plan

Have a written breach response plan. Reportable breaches must be notified to the NPC and to affected data subjects within 72 hours.

Common Pitfalls

• Treating consent as the only lawful basis
• Indefinite retention of records
• Sharing data with vendors without a Data Sharing Agreement
• No vendor due diligence

Contact Eleazar Bangi & Associates Law Firm

Office: 511 Bell Mansion, Bagong Pag-asa, Quezon City, Metro Manila 1105, Philippines. Hours: Monday to Friday, 9:00 AM to 6:00 PM. Email: rjbangi@reblegal.com. WhatsApp and Viber available. Contact us.