Data privacy confidentiality and human accountability
AI governance gives a business a defined basis for approving tools, controlling information, and assigning responsibility for results. In the Philippines, that review should connect the proposed use with data privacy obligations, contractual confidentiality, and the decisions that employees remain responsible for making.
Businesses can use AI to help draft content, summarize records, and support decisions. Before adopting a tool, decide what information it may receive, what work it may perform, and who will check the result.
The Data Privacy Act of 2012 and applicable National Privacy Commission (NPC) issuances govern AI processing of personal data, including development, training, testing, and deployment.[1]
An effective AI policy connects those obligations with daily work. Staff need usable rules for customer files, confidential documents, generated content, and decisions affecting people.
Defining the scope of AI governance
Maintain an inventory of approved AI uses and responsible owners. Drafting a public announcement from approved facts presents different concerns from ranking applicants or reviewing customer creditworthiness. Identify the information involved, who could be affected, and what an incorrect output could cause.
Assess privacy risks before deployment and when the use changes, including through a privacy impact assessment. Where automated decisions pose significant risks to people’s rights and freedoms, NPC guidance requires meaningful human intervention by qualified reviewers with authority to act. Affected individuals must also have a way to question and contest those decisions.[2]
For example, a recruitment team should examine whether an AI screening tool treats applicants unfairly and whether a qualified reviewer can change its recommendation. Merely asking an employee to approve every result without examining it provides little practical protection.
Describe the proposed task before approving access. Record whether the tool will draft material, search internal files, recommend a course of action, or take an action through another system. Identify the employee who requests the use and the manager responsible for its business purpose.
An AI governance assessment should cover the information the tool can reach through connected accounts. A short prompt may trigger access to a larger document collection or customer database. Review the permissions and available records alongside the text that an employee intends to type.
Approval should state the permitted task and any limits. For example, a marketing team might use an approved service to prepare copy from public product specifications, with publication subject to review. That approval should explain whether customer testimonials, unpublished pricing, or identifiable photographs require a further assessment.
The NPC advisory on AI systems processing personal data provides the local privacy framework for this assessment. AI governance procedures should translate that framework into decisions about access, permitted activities, review, and continuing supervision.
Controlling personal data and confidential information
Determine and document the lawful basis before processing personal data through AI. Apply the separate statutory conditions for sensitive personal information and privileged information. Publicly accessible personal data also requires a lawful processing assessment. Explain the nature, purpose, and extent of relevant AI processing to affected individuals in clear language.[3]
As an internal control, require approval before staff upload customer files, employee records, contracts, legal communications, or unpublished business plans. Removing a name can leave a person identifiable from other details.[4] Use synthetic examples or material assessed as effectively anonymized where the task allows it.
Confidentiality also extends to material that contains no personal data. Review contractual restrictions before submitting pricing, product plans, source code, or another party’s documents. Permission to use a document for a transaction does not necessarily authorize disclosure to a tool provider.
Map the information needed for each task. Identify the people concerned, the source of the records, and the reason each data field is necessary. A request to summarize a customer complaint may require the relevant correspondence while allowing unrelated identification documents or payment details to be excluded.
AI governance should distinguish personal information from sensitive personal information and privileged information. The legal assessment must reflect the category actually involved. A general statement that processing serves a business purpose does not by itself establish that every document or every field can lawfully be submitted.
Assess whether the proposed AI use is compatible with the purpose for which information was collected and the notice given to the affected people. Where the process or recipients change, review the legal basis and transparency arrangements before the new use begins. Record the reasoning and any limits imposed.
Give staff a practical route for preparing inputs. The policy can identify approved templates, material requiring prior review, and examples that must be excluded. Check the complete attachment, including comments and hidden content, when deciding what the provider will receive.
For confidential commercial material, examine the agreement that governs disclosure. Check permitted recipients, purposes, security conditions, and any approval process. The employee requesting AI assistance should identify the contract owner who can resolve an uncertainty before the material is submitted.
Retention is part of the same AI governance review. Consider prompts, uploaded files, outputs, and copies retained in business systems. Set justified retention periods and deletion arrangements that reflect the purpose, applicable obligations, and any need to preserve records for a legal claim.
Reviewing providers and cross border processing
Before adoption, examine whether prompts, attachments, and outputs are retained, reviewed by people, used for training, or disclosed to subcontractors. Check access controls, deletion arrangements, incident assistance, and the countries involved.
Establish whether the provider processes data on the business’s instructions or also uses it for its own purposes. Product names alone do not establish how a particular account or service is configured.
A personal information controller remains accountable when processing is outsourced. Vendor arrangements must provide appropriate safeguards, including through the processing contract and controls over transfers.[5]
The NPC’s guidance on model contractual clauses identifies options for cross-border transfers. Adoption is voluntary, and the underlying compliance obligations continue to apply.[6]
Review the actual service tier and account configuration intended for deployment. Obtain the applicable terms, processing agreement, security information, and settings. Keep dated copies or an accessible record of the versions assessed, so that later changes can be compared with the basis of approval.
An AI governance provider review should identify which commitments are contractual and which appear only in promotional material. If the business relies on a restriction on training or retention, confirm how it applies to prompts, attachments, outputs, and any connected services used in the proposed workflow.
Where the arrangement is outsourcing, align the processing contract with the applicable requirements. Address documented instructions, confidentiality, security, further processors, assistance with individual requests, deletion or return of data, and information needed to demonstrate compliance. Identify any material gap before sensitive records are made available.
For cross-border processing, establish where data may be processed and which entities receive it. Assess the safeguards in the complete arrangement. Choosing a model clause requires consideration of its parties, scope, and operation; the name of a contractual template does not establish how a specific transfer will be protected.
Plan for the end of the relationship as well as its start. Confirm how administrators can remove access, export necessary records, and request deletion. Identify any retained copies or limitations that affect the business’s ability to fulfill its own commitments to customers, employees, or counterparties.
ATL Law Firm’s corporate practice can assist with provider terms and commercial obligations. An AI governance review should connect the proposed contract with the information flow, approved purpose, and practical controls available to the business.
Reviewing outputs and decisions affecting people
Generative AI can produce convincing errors, disclose information, or generate material that raises intellectual property concerns. The U.S. National Institute of Standards and Technology’s Generative AI Profile identifies these risks and offers voluntary guidance for managing them.[7] Use it alongside applicable Philippine legal requirements.
Require reviewers to verify factual claims, figures, quotations, and legal references against reliable originals. For contract work, compare the summary with the complete agreement, including definitions and exceptions. Review potential bias in outputs that affect people and keep sufficient records to understand the decision.
Images need care too. The NPC’s 11 August 2026 notice explains that generating and sharing AI media using a real person’s likeness involves processing personal data.[8] Assess the applicable lawful basis, privacy rights, and permissions before using such material in a campaign.
Design the review around the intended reliance. A contract summary should identify the source document and relevant provisions so the reviewer can check the conclusion. A marketing draft should be checked against approved product information, while a financial calculation should be independently verified against the underlying figures.
AI governance procedures should explain what counts as sufficient verification. Repeating the question to the same tool may produce another plausible answer without resolving the underlying uncertainty. Give reviewers access to the original records and enough time to examine the points that could affect a decision.
For decisions affecting people, consider the inputs and the consequences of the recommendation. A reviewer should be able to identify missing or inaccurate information, examine a disputed result, and exercise the authority needed to change it. Record the reasons for a material decision at an appropriate level of detail.
AI governance also requires attention to generated images and other media. Before a campaign uses an identifiable person’s likeness, review the proposed depiction, lawful basis, and relevant permissions. A general approval to use an existing photograph may require further assessment before it supports a new synthetic portrayal.
Keep a record of the material approved for publication and the person who authorized it. If a factual or rights issue is later raised, the business should be able to locate the source, review the concern, and decide on correction or removal without reconstructing the entire production process.
Assigning responsibility and maintaining compliance
State who approves tools, authorizes restricted uses, reviews outputs, and responds to complaints or incidents. Include a route to suspend a use when harmful results or unexpected disclosures appear. Train staff with examples from their actual work and review changes in vendor terms and system behavior.
NPC Circular No. 2022-04 requires registration of systems that process personal or sensitive personal information and involve automated decision-making or profiling. The relevant operations must also be identified in the registration record.[9] Check applicable deadlines and update requirements. Incorporate the AI use into the business’s privacy program and processing records.
Assign operational responsibility to the people who control the use. The business owner should understand the task and its consequences; the data protection officer should be involved in the privacy assessment. Legal and technical reviewers can address contractual restrictions, system access, and other questions within their respective roles.
The following examples show how an AI governance policy can connect a task with a review responsibility. They are suggested internal controls. The business should adapt them to its actual organization, information, and applicable obligations.
| Use | Suggested internal control | Responsible reviewer |
| Public marketing draft | Verify facts and review rights in images and text | Marketing approver |
| Customer record summary | Approve the tool and minimize input data | Process owner and data protection officer |
| Applicant assessment | Assess fairness and enable meaningful intervention | Qualified hiring decision maker |
| Contract summary | Protect confidential terms and check the original | Authorized legal reviewer |
Give employees a prompt reporting route when information is uploaded in error, a connected tool reaches unexpected records, or a harmful output is discovered. The designated team should assess containment, affected information, and the applicable incident response and notification requirements. Preserve necessary evidence with appropriate access restrictions.
Maintain AI governance after deployment through review of actual use. Reassess changes in model capabilities, connected data sources, provider terms, and the business purpose. A tool approved for preparing an internal draft may require a different assessment before it sends customer communications or influences a hiring decision.
A recruitment tool considered in practice
Consider a business that wants an AI service to summarize applications and recommend candidates for interview. Before deployment, it should identify the applicant records involved, the proposed criteria, and the role the recommendation will play in the hiring process. The provider’s access and data uses also require examination.
The AI governance assessment should test the tool against the proposed role and review process. A hiring decision maker needs enough information to identify an inaccurate summary or an unsuitable recommendation. Relevant concerns should be capable of being investigated rather than dismissed because the result came from an automated system.
If the effects of automated decisions pose significant risks to applicants’ rights and freedoms, the NPC safeguards for meaningful intervention and contesting decisions apply. Assess system registration and transparency arrangements as well. The approval record should state the authorized use and the changes that require a renewed assessment.
Preparing an AI governance record
A concise record allows management to see what was approved and why. The supporting documents should be available to those responsible for operating and reviewing the use. Keep the following items together, with versions and unresolved questions identified.
- The proposed task, business purpose, tool and service tier, responsible owner, and permitted users.
- The information categories, sources, connected systems, lawful basis assessment, and relevant privacy notices.
- The privacy impact assessment and testing results, including significant limitations and required safeguards.
- The provider terms, processing agreement, security assessment, transfer arrangements, and approved settings.
- The review procedure, authority to intervene, and route for responding to individual requests or complaints.
- The approval decision, retention arrangements, registration assessment, incident contacts, and review triggers.
Questions on AI governance in the Philippines
Does the Data Privacy Act apply to AI tools
It applies where the AI activity involves processing personal data within the law’s scope. NPC guidance addresses development, deployment, training, and testing. AI governance should examine the actual information and activity, including connected systems, rather than relying on the label attached to the product.
Can employees upload customer files to an AI service
Assess the lawful basis, necessity, confidentiality restrictions, provider arrangement, and security before allowing that use. An internal approval procedure can limit access to assessed services and tasks. Removing a customer’s name may leave the person identifiable from the remaining information.
Does a provider’s privacy statement complete the review
A statement is one part of the evidence. Review the applicable contract, actual account settings, data flows, and further processors. The business remains accountable for outsourced personal data processing and should confirm the safeguards on which the proposed use depends.
When is meaningful human intervention required
NPC guidance requires it where automated decisions pose significant risks to people’s rights and freedoms. Reviewers must have the necessary competence and authority. Affected people must also have a way to question and contest such decisions. The procedure should explain how those safeguards operate.
Does every business use of AI require system registration
The registration assessment turns on the applicable criteria. NPC Circular No. 2022-04 requires registration where a system processes personal or sensitive personal information and involves automated decision-making or profiling. AI governance should examine that rule alongside the other registration criteria and the system’s actual operation.
Can a business use AI images of a real person
Review the proposed depiction and use under the applicable privacy rules and other relevant rights or permissions. The NPC’s August 2026 notice treats generating and sharing AI media using a real person’s likeness as personal data processing. Consent is one possible lawful basis; the appropriate basis depends on the circumstances.
Legal assistance with business AI use
ATL Law Firm can help review AI policies, provider terms, confidentiality obligations, and the privacy arrangements for a proposed business use.
Contact ATL Law Firm for an AI governance review of the proposed task, information, and provider terms, supported by its data privacy practice.
[1] Data Privacy Act of 2012, Republic Act No. 10173, §§ 11–13, 20–21 (2012) (Phil.); National Privacy Commission, Advisory No. 2024-04, §§ 1–2 (Dec. 19, 2024) (Phil.).
[2] NPC Advisory No. 2024-04, § 2(B)(2), (C) (2024) (Phil.).
[3] Republic Act No. 10173, §§ 12–13, 16 (2012) (Phil.); NPC Advisory No. 2024-04, § 2(A), (F) (2024) (Phil.).
[4] Republic Act No. 10173, § 3(g) (2012) (Phil.); NPC Advisory No. 2024-04, § 2(E) (2024) (Phil.).
[5] Implementing Rules and Regulations of the Data Privacy Act of 2012, rule X, §§ 43–44 & rule XII, § 50 (2016) (Phil.).
[6] National Privacy Commission, Advisory No. 2024-01, Model Contractual Clauses for Cross-Border Transfers of Personal Data, §§ 3, 6 (May 30, 2024) (Phil.).
[7] National Institute of Standards and Technology, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, NIST AI 600-1, §§ 1, 2.2, 2.4, 2.10 (July 2024) (U.S.).
[8] National Privacy Commission, Notice to the Public: Use of Real Persons’ Likenesses in AI-Generated Images, paras. 1–3 (Aug. 11, 2026).
[9] National Privacy Commission, Circular No. 2022-04, §§ 5(A), 7, 16, 26–27 (Dec. 5, 2022) (Phil.).
Comments are closed