Philippine requirements before customer data collection
Startup data privacy begins with the customer journey. Before launching a form or service, identify what information the business needs, the lawful basis for processing it, and how the records will be protected. The resulting arrangements should work in the product, the provider contracts, and the team’s daily routines.
A startup should prepare its privacy arrangements before its first customer completes a form, creates an account, or uploads an identification document. The Data Privacy Act of 2012 governs personal data processing within its scope. Business size alone does not exempt a startup from its duties.[1]
Map the data, its purposes, where it goes, and who is responsible. Use that map to design the product, notices, vendor terms, and security measures.
Mapping customer data and business roles
Record the data collected through your website, app, sales process, support channels, and marketing tools. Include information generated by analytics and received from other businesses. Identify sensitive personal information, such as health information and government-issued identifiers, for assessment under the stricter processing conditions.[2]
A business that determines how and why personal data is processed generally acts as a personal information controller. A provider processing data on the controller’s instructions may act as a personal information processor. Assess the actual arrangement; a contractual label does not settle the role.[3]
For an online booking service, contact details and appointment preferences may suffice. Before requiring identification documents for an inquiry, establish the need and consider a less intrusive process.
Follow a customer’s information from the initial inquiry through payment, service delivery, support, and account closure. Include copies held in email, spreadsheets, exported reports, and test environments. The map should show which system holds each record and which people or providers can obtain it.
A startup data privacy review should distinguish an essential field from information collected for possible future use. Ask the product owner to explain why each field is required at that stage. Where the purpose can be achieved with less information, revise the form and the associated workflow.
Record the actual information flows between the startup and its providers. A payment page, customer support platform, and analytics service may receive different data under different arrangements. Review the relevant functions and terms before assuming that every provider has the same role or receives the same information.
The following questions help translate startup data privacy into a launch review. Prepare records that reflect the working service and update them when a new feature, provider, or customer process changes the information involved.
| Area | Question before launch | Record to prepare |
| Collection | Why is each field necessary? | Data inventory and purpose map |
| Vendors | Who can use or retain the information? | Reviewed processing terms |
| Access | Who needs each category of data? | Access permissions |
| Retention | When can records be removed? | Retention and deletion schedule |
Choosing the lawful basis and explaining the processing
Determine the appropriate lawful basis for each purpose. Ordinary personal information may be processed on grounds such as consent, contractual necessity, a legal obligation, or a legitimate interest supported by a documented assessment. Sensitive personal information and privileged information are subject to the separate conditions in Section 13.[4]
Use a clear privacy notice describing the information, purposes, recipients, retention arrangements, relevant rights, and how to contact the business. Where consent is the lawful basis, obtain a freely given, specific, informed indication of agreement and retain evidence of it.[5]
Collect only necessary data, separate optional marketing, and reassess new uses before launch.
Prepare a purpose record that connects each activity with the data needed, the people concerned, and the proposed lawful basis. Explain the factual circumstances supporting that basis. A general reference to customer service or business operations may leave important questions about a particular use unanswered.
Where legitimate interest is proposed, assess the identified interest, whether the processing is necessary, and its effect on the individual’s rights and freedoms. Record the reasoning and safeguards. A startup data privacy assessment should explain why the basis fits the activity and the information involved.
Place the privacy notice where customers can find it when information is collected. Check that the published wording matches the actual fields, recipients, and retention arrangements. A notice copied from another business may describe processing that the startup does not perform or omit an important part of its service.
Where consent is relied upon, design the request and its record together. Staff should be able to establish what the person agreed to and which wording was presented. Keep optional marketing choices distinct from the information and permissions needed for the service, and provide a workable route to change those choices.
Read the Data Privacy Act alongside the implementing rules and applicable NPC guidance. Startup data privacy requires the legal basis, product behavior, and customer explanation to be assessed together before a new collection or use begins.
Assigning responsibility and assessing NPC registration
Designate a data protection officer (DPO) and provide the authority and resources needed for the role. Assess registration of the DPO and data processing systems under National Privacy Commission (NPC) Circular No. 2022-04.
Mandatory registration covers businesses employing at least 250 persons, processing sensitive personal information of at least 1,000 individuals, or processing data likely to pose a risk to rights and freedoms. Systems involving personal data and automated decision-making or profiling must also be registered.[6]
The risk criterion can capture a smaller startup. A business outside mandatory registration that chooses not to register voluntarily must submit the prescribed sworn declaration and undertaking for exemption. Check current NPC filing advisories when preparing a registration or exemption submission. Exemption from system registration leaves the underlying privacy obligations in place.[7]
Give the DPO access to the information needed to assess proposed processing and raise concerns with management. Assign product, operations, and technical owners to implement the agreed measures. A startup data privacy policy should explain how those responsibilities work when a feature is proposed or a problem is reported.
Record the basis for the registration assessment, including the systems, data categories, people concerned, and relevant risks. Review that assessment when operations change. A small initial customer base should not be treated as a standing conclusion that the business will remain outside mandatory registration.
Keep filing responsibilities and evidence accessible to the business. Identify the person who monitors the registration record, applicable updates, and regulator correspondence. A startup data privacy record should distinguish a submitted application, an issued certificate, and an exemption submission so that their status is accurately understood.
Check the NPC’s registration exemption guidance against the startup’s actual circumstances and current filing instructions. An exemption assessment concerns registration; the business still needs lawful processing, appropriate safeguards, and procedures for exercising applicable privacy rights.
Putting safeguards and provider terms in place
Use a privacy impact assessment to identify risks before deployment and revisit it when the processing changes. NPC security rules require appropriate organizational, physical, and technical safeguards. Assign access by role, use secure authentication, train staff, and plan backup and recovery arrangements.[8]
Review cloud, messaging, payment, and support providers. Address instructions, confidentiality, security, subcontractors, incident assistance, and return or deletion of data. Distinguish outsourced processing from sharing between independent controllers. For overseas transfers, assess the safeguards and contractual arrangements; outsourcing does not end the controller’s accountability.[9]
Use the assessment to identify controls for the records and systems the startup actually operates. Determine which staff need access and how access is removed when duties change or a person leaves. Review administrative accounts, shared credentials, downloaded records, and access held by external service personnel.
Startup data privacy should be considered during testing as well as customer operations. Use synthetic or appropriately anonymized examples where suitable. If real customer information is needed for testing or troubleshooting, assess the purpose, permissions, access, and retention before copying it into another environment.
Read the provider’s contractual commitments alongside the service configuration. Confirm who may use the information, the permitted purposes, and the support available when a customer request or incident arises. Where the service relies on further providers, identify the relevant arrangements and restrictions.
For overseas processing, establish the recipients and locations involved and assess the applicable safeguards. Review how the agreement governs instructions and further transfers. A startup data privacy review should also consider what happens to retained information when the provider relationship ends or the business changes services.
Set a retention schedule that staff can apply by record category. Identify the purpose, applicable obligation, retention period or review trigger, and responsible owner. Check how deletion works across the main system and other retained copies, including records subject to a justified legal hold.
Test restoration arrangements with the technical team and record the result. A backup is useful only if authorized staff can recover the required records when needed. Address access during recovery and ensure that the process remains consistent with the startup’s security and retention arrangements.
ATL Law Firm’s corporate practice can assist with commercial provider terms. The startup data privacy assessment should connect contractual commitments with the processing arrangement and the controls the business can actually use.
Responding to customer privacy requests
Provide a workable route for access, correction, objections, and other applicable rights. Verify requesters proportionately and assess the legal conditions, including legitimate retention requirements, before deleting records.[10]
Identify the contact channel, person responsible for reviewing requests, and route for obtaining relevant records from each system. Customer support staff should recognize a privacy request even where the customer uses ordinary language or sends it through a general support channel.
Startup data privacy procedures should explain how identity will be checked without demanding unnecessary additional information. Consider the request and the risk of disclosing records to the wrong person. Record the assessment and obtain assistance where authority to act for someone else needs clarification.
Before responding, locate the relevant records and assess the right being exercised. Explain any lawful limitation and the steps taken. If information must be retained for an applicable obligation or claim, identify the basis and consider restrictions on its further use rather than promising immediate deletion.
Keep a request register with appropriate access limits. It should identify the issue, relevant dates, decision, and response without unnecessarily duplicating the customer’s full records. Use recurring requests to identify unclear notices, inaccurate data, or product settings that require attention.
Preparing for incidents and breach notification
Document all security incidents for assessment and annual reporting. Mandatory breach notification depends on the data involved, reasonable belief of unauthorized acquisition, and a real risk of serious harm. The data must involve sensitive personal information or information that could enable identity fraud.
Where all criteria are met, the NPC and affected individuals must generally be notified within seventy-two hours of knowledge or reasonable belief by the controller or processor that the notifiable breach occurred.[11]
Use the NPC’s prescribed reporting channel. The normal route is its Data Breach Notification Management System (DBNMS), subject to any alternative procedure prescribed during an outage.[12]
A request for extension, exemption, or postponement does not suspend compliance without written NPC action. Where a request remains unresolved, Advisory No. 2026-02 directs submission of the full breach report within five days from discovery, together with other required submissions.[13]
Prepare the reporting arrangements before an incident. Identify who receives internal reports, who assesses the information and consequences, and who can authorize containment and notification. Ensure that provider contacts and the business’s own reporting account remain accessible when the usual personnel are unavailable.
For startup data privacy, a practical incident record should distinguish the event, its discovery, the information available, and the decisions made. Preserve relevant evidence with controlled access. Record what is confirmed, what remains uncertain, and when further information is expected from a provider or technical reviewer.
The five-day full-report provision should be considered alongside the initial notification obligation. A pending request to the NPC does not by itself authorize the business to wait. Assess the applicable requirements promptly and document the grounds for any request, together with the Commission’s written action.
Where a request remains unresolved, Advisory No. 2026-02 directs the full breach report to the specified NPC email address. Check its prescribed subject line and other submissions alongside the initial DBNMS notification requirement and any later written direction.
After containment, examine why the incident occurred and whether similar access or disclosure remains possible. Update the relevant controls, provider arrangements, and staff instructions. Keep the incident record available for the required assessment and reporting, including incidents that do not meet mandatory notification criteria.
Consult the NPC’s breach reporting guidance and current advisories when preparing the response. Startup data privacy procedures should identify who checks those instructions and how the business retains evidence of completed submissions and communications.
A booking service preparing for launch
Consider a startup launching an online appointment service. Its initial form requests a customer’s name, contact details, preferred appointment, birth date, and an identification upload. The product team should explain the purpose of each field and assess whether it is needed at the inquiry stage.
The startup data privacy review should then follow the information into the booking platform, messaging service, payment process, and support records. The team can assess the relevant roles and terms, revise the privacy notice, and set access and retention arrangements against that actual process.
Before opening registration to customers, test the process for a privacy request and an incident report. Confirm that staff can find the relevant record, contact the responsible reviewer, and take the agreed next step. Resolve material gaps before relying on the process during live operations.
Questions on startup data privacy
Does a small startup have to comply with the Data Privacy Act
Yes, where its processing falls within the law’s scope. Business size alone does not remove the obligations. The startup data privacy review should identify the activities, information, and risks involved and assess registration separately from the underlying requirements for lawful and secure processing.
Is customer consent always the required lawful basis
The appropriate basis depends on the purpose and data category. Section 12 provides several grounds for ordinary personal information. Sensitive personal information and privileged information require assessment under Section 13. Where consent is relied upon, the business must meet the applicable consent requirements and retain evidence.
Does having fewer than 250 employees avoid mandatory registration
Employee count is only one criterion. Sensitive information volumes, risks to rights and freedoms, and systems involving personal data with automated decision-making or profiling also matter. A startup data privacy assessment should consider all applicable criteria and the prescribed exemption process where relevant.
Can the startup rely on its cloud provider to handle compliance
The controller remains accountable when processing is outsourced. Review the provider’s terms, security, access, further processing, and assistance with requests and incidents. Startup data privacy arrangements should assign clear responsibilities while allowing the business to demonstrate how the relevant safeguards operate.
Must every security incident be notified within seventy two hours
Mandatory breach notification depends on the applicable criteria. Assess the information involved, possible unauthorized acquisition, and the risk of serious harm. Document incidents that do not meet those criteria as well. The initial notification obligation and later full-report requirements must be assessed separately.
When should the privacy arrangements be reviewed again
Reassess material changes in collection, purposes, systems, recipients, or risks. A new feature or provider can affect the lawful basis, notice, safeguards, and registration assessment. Startup data privacy records should show the change, its implications, and the actions required before the revised process is used.
Legal assistance before customer data collection
ATL Law Firm can help review your startup’s collection process, privacy notices, vendor contracts, and incident response arrangements before launch.
[1] Data Privacy Act of 2012, Republic Act No. 10173, §§ 4, 11, 20–21 (2012) (Phil.).
[2] Republic Act No. 10173, §§ 3(l), 13 (2012) (Phil.).
[3] Republic Act No. 10173, § 3(h)–(i) (2012) (Phil.); Implementing Rules and Regulations of the Data Privacy Act of 2012, § 3(m)–(n) (2016) (Phil.).
[4] Republic Act No. 10173, §§ 12–13 (2012) (Phil.); National Privacy Commission, Circular No. 2023-07, Guidelines on Legitimate Interest, §§ 3–8 (Dec. 13, 2023) (Phil.).
[5] Republic Act No. 10173, §§ 3(b), 16(b) (2012) (Phil.); Data Privacy Act IRR, § 34(a) (2016) (Phil.).
[6] Data Privacy Act IRR, § 26(a) (2016) (Phil.); National Privacy Commission, Circular No. 2022-04, §§ 5, 7 (Dec. 5, 2022) (Phil.).
[7] NPC Circular No. 2022-04, §§ 5–6 (2022) (Phil.); National Privacy Commission, Exemption; Announcements, Advisory on NPCRS Unavailability.
[8] Republic Act No. 10173, § 20 (2012) (Phil.); National Privacy Commission, Circular No. 2023-06, Security of Personal Data in the Government and the Private Sector, §§ 4–7, 13, 16, 21 (Dec. 1, 2023) (Phil.).
[9] Data Privacy Act IRR, §§ 43–44, 50 (2016) (Phil.); Republic Act No. 10173, §§ 14, 21 (2012) (Phil.).
[10] Republic Act No. 10173, §§ 11(e)–(f), 16–18 (2012) (Phil.); Data Privacy Act IRR, §§ 34–37 (2016) (Phil.).
[11] Data Privacy Act IRR, §§ 38–41 (2016) (Phil.); National Privacy Commission, Breach Reporting, Mandatory Notification.
[12] National Privacy Commission, Breach Reporting, Mandatory Notification; Announcements, Advisory on DBNMS Unavailability.
[13] National Privacy Commission, Advisory No. 2026-02, § 2(C)–(D) (May 11, 2026) (Phil.).
Comments are closed