Philippines Data Privacy Act for IT Outsourcing: A Compliance Checklist for Foreign Clients

The Philippines Data Privacy Act shapes how your offshore IT team stores, moves, and protects personal data. If you plan to hand off code, databases, or support tickets to a Philippine team, you need to know who carries the risk, what your contract must say, and which foreign laws still apply. This guide gives you a plain checklist you can use before you sign.

For the wider picture on costs, roles and partner selection, read our main guide to IT outsourcing in the Philippines.

What Is the Philippines Data Privacy Act?

The Data Privacy Act of 2012, or Republic Act №10173, governs how organizations collect, use, store, and share personal information in the Philippines. The National Privacy Commission (NPC) enforces it. The Act builds on three principles: transparency, legitimate purpose, and proportionality. In plain terms, you tell people what you collect, you use it only for a clear reason, and you collect only what you need.

The law splits roles into two groups. A personal information controller (PIC) decides why and how data gets processed. A personal information processor (PIP) handles data on the controller’s behalf. In most outsourcing deals, your company acts as the controller and your Philippine team or provider acts as the processor.

Does the Data Privacy Act Apply to Foreign Clients?

This question splits opinion, and both camps have a point.

The narrow view points to Section 4 of the Act. It carves out personal information that a company collected from residents of foreign countries under those countries’ laws and then sends to the Philippines for processing. Under this view, a US client sending US customer data to Manila follows US law, and the Philippine Act stays in the background.

The broad view points to the Implementing Rules and Regulations. These rules still require Philippine processors to meet security standards, keep staff under confidentiality duties, and report breaches. So even when the carve-out applies to your data, your provider’s people, systems and offices still fall under NPC oversight.

The practical view wins in most boardrooms. Treat both sets of rules as live. Your home-country law governs your duties to your customers. The Philippine Act governs how your offshore team protects that data day to day. When you build to the stricter of the two, you rarely get caught out.

Who Is Responsible When Data Leaks?

The controller stays responsible. The rules state that a controller remains accountable for personal data it outsources or transfers to a processor, at home or across borders. So you carry the liability even when your provider does the work.

That matters because breaches cost real money. IBM’s Cost of a Data Breach Report 2025 put the global average at $4.44 million per breach. US companies paid far more, at a record $10.22 million on average. The same report found that organizations took 241 days on average to find and contain a breach, and that one in five organizations in the study suffered a breach linked to shadow AI, meaning staff using unapproved AI tools.

Get Aristosourcing’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Under NPC rules, a controller must notify the Commission and affected people within 72 hours of learning about a breach that puts sensitive data at real risk. Penalties under the Act include prison terms of up to six years and fines of up to PHP 5 million for the most serious offenses, according to the IAPP summary linked above.

What Should Your Outsourcing Contract Include?

The rules require a written agreement between the controller and the processor. A strong contract covers these points:

• Scope: The subject matter, duration, nature, and purpose of the processing.
• Data types: The categories of personal data and of the people it describes.
• Instructions: A clause that the processor acts only on your documented instructions.
• Confidentiality: A duty on every staff member who touches the data.
• Security: The technical and physical safeguards the provider must keep.
• Subcontractors: A ban on further outsourcing without your written approval.
• Breach duties: A short reporting window so that you can meet your own 72-hour clock.
• Return and deletion: What happens to the data when the contract ends.
• Audit rights: Your right to check compliance.

Our guide to the outsourcing agreement covers the commercial terms that sit around these clauses. For smaller teams, our breakdown of data processing agreement requirements shows the same ideas in a lighter format.

How Do GDPR, HIPAA and Other Laws Stack on Top?

Your home-country law travels with your data. Here is how the common ones apply:

• GDPR (EU and UK clients): The European Commission has made no adequacy decision for the Philippines. You need a transfer tool such as Standard Contractual Clauses, plus a transfer risk assessment.
• HIPAA (US healthcare): Any team that touches protected health information needs a Business Associate Agreement. Our guide to healthcare IT outsourcing covers this in more depth.
• State privacy laws (US): Laws such as the California Consumer Privacy Act require written service provider contracts with use limits.

A 10-Point Compliance Checklist

Use this list before your offshore team gets access to live data:

1. Map every system the team will touch and the personal data inside it.
2. Confirm your role as controller and the provider’s role as processor in writing.
3. Sign a data processing agreement that covers the clauses above.
4. Add GDPR transfer clauses or a HIPAA BAA where they apply.
5. Ask whether the provider has a registered Data Protection Officer with the NPC.
6. Give least-privilege access, so each person sees only what their role needs.
7. Turn on multi-factor login and a password manager for every account.
8. Ban unapproved AI tools for any task that involves customer data.
9. Run a breach drill and test your 72-hour reporting path.
10. Review access every quarter and remove anyone who has left.

Our article on remote work security procedures gives you practical steps for points 6 to 10.

Different Views on How Far to Go

Privacy by design, a concept from former Ontario privacy commissioner Ann Cavoukian, says you should build protection into systems from the start. In practice, your Philippine developers work with masked or synthetic test data and never see real customer records.

Zero trust goes further. It treats every login and device as untrusted until verified, every time. This model suits fintech and healthcare work but adds friction for small teams.

The pragmatic school argues that heavy controls slow delivery and push staff toward workarounds. Its supporters favor clear rules, good training, and spot audits over locked-down systems.

Most companies blend the three. They mask data in development, apply zero trust to production access, and keep rules simple enough that people follow them.

Example: A US SaaS Company Sets Up Safely

Picture a 40-person US software company that hires three developers and a support specialist in Cebu. The company signs a data processing agreement, gives developers a masked copy of the database, and limits production access to one senior engineer. Support staff sees customer names and emails only, with payment data hidden. A quarterly access review takes 30 minutes. When a contractor leaves, the company removes all access the same day.

Build Compliance Into Your Offshore Team From Day One

The Philippines Data Privacy Act gives you a solid framework, and your home-country law adds the rest. Put the contract in place, limit access, and test your breach plan. Then your offshore team can work fast without putting your customers at risk.

Aristo Sourcing hires remote developers, IT support staff, and tech virtual assistants from the Philippines and South Africa, and helps you set NDAs and data-handling rules for each placement. See how our process works, or return to our full guide to outsourcing IT to the Philippines.