Data Processing Agreement (Philippines)
DATA PROCESSING AGREEMENT
Data Privacy Act of 2012 (Republic Act 10173) | Section 14 | NPC Implementing Rules and Regulations
This Data Processing Agreement ("DPA") is entered into as of [Effective Date]
BETWEEN:
[Controller Name], with address at [Controller Address] ("Personal Information Controller" or "PIC"); AND
[Processor Name], with address at [Processor Address] ("Personal Information Processor" or "PIP").
WHEREAS, the PIC has engaged the PIP to provide services that involve the processing of personal data on behalf of the PIC; and WHEREAS, both parties wish to comply with the Data Privacy Act of 2012 (Republic Act 10173) and the implementing rules issued by the National Privacy Commission (NPC).
1. SCOPE AND PURPOSE OF PROCESSING
1.1 The PIP shall process personal data on behalf of the PIC solely for the following purpose: [Processing Purpose]
1.2 The categories of personal data to be processed are: [Data Categories]
1.3 The categories of data subjects whose data will be processed are: [Data Subject Categories]
1.4 The duration of this processing engagement is: [Processing Duration]
2. OBLIGATIONS OF THE PERSONAL INFORMATION CONTROLLER
2.1 The PIC shall: (a) ensure that all instructions given to the PIP comply with RA 10173 and applicable NPC regulations; (b) ensure that there is a valid lawful basis for the processing under Section 12 of RA 10173 prior to instructing the PIP to process; (c) promptly notify the PIP of any data subject rights requests or regulatory inquiries affecting the processing covered by this DPA; and (d) conduct periodic due diligence on the PIP's compliance with this DPA.
3. OBLIGATIONS OF THE PERSONAL INFORMATION PROCESSOR
3.1 The PIP shall process personal data only on documented instructions from the PIC, as set out in this DPA or in written instructions issued by the PIC, and shall immediately inform the PIC if, in the PIP's opinion, any instruction infringes RA 10173 or NPC regulations.
3.2 The PIP shall ensure that all personnel authorized to process personal data under this DPA are subject to confidentiality obligations and have received appropriate data privacy training.
3.3 The PIP shall implement the following security measures: [Security Measures]. The PIP shall maintain documentation of security measures and make such documentation available to the PIC and the NPC upon request.
3.4 Sub-processing rule: [Sub-Processor Rule]. Any authorized sub-processor must be bound by a Data Processing Agreement that imposes obligations equivalent to those in this DPA.
3.5 The PIP shall assist the PIC in fulfilling data subject rights requests under Sections 16 to 20 of RA 10173, including requests for access, rectification, erasure, objection, and portability.
4. DATA BREACH NOTIFICATION
4.1 The PIP shall notify the PIC without undue delay — and no later than seventy-two (72) hours — after becoming aware of a personal data breach, as required under NPC Circular 2016-03. The notification shall include: a description of the breach; the categories and approximate number of data subjects affected; the name and contact details of the DPO; the likely consequences of the breach; and the measures taken or proposed to address the breach.
4.2 The PIP shall cooperate fully with the PIC and the NPC in investigating and remediating any personal data breach.
5. RETURN OR DELETION OF PERSONAL DATA
5.1 Upon termination or expiry of this DPA, the PIP shall, at the PIC's election, either return all personal data to the PIC or securely delete or destroy all personal data (and all copies thereof) in the PIP's possession or control, within thirty (30) days of the termination or expiry date, and provide the PIC with written certification of such return or deletion.
6. GOVERNING LAW
6.1 This DPA is governed by and construed in accordance with the Data Privacy Act of 2012 (Republic Act 10173) and the laws of the Republic of the Philippines. Any dispute shall be resolved before the NPC or the appropriate Philippine court.
Personal Information Controller
________________
Signature
Personal Information Processor
________________
Signature
What Is a Data Processing Agreement (Philippines)?
A Data Processing Agreement in the Philippines defines what each party must do under the deal and the consequences of failing to perform.
The distinction between a personal information controller and a personal information processor is fundamental to Philippine data privacy law. A personal information controller is a natural or juridical person who controls the collection, holding, processing, or use of personal data — including a person who instructs another person to collect, hold, process, use, transfer, or disclose personal data on their behalf. A personal information processor, by contrast, is any natural or juridical person to whom a personal information controller may outsource or instruct the processing of personal data. Common examples in the Philippines include payroll processing companies, cloud service providers, call center operators processing customer data for a client, and BPO companies handling health records or financial data.
The NPC has emphasized through multiple advisory opinions — including NPC Advisory Opinion 2018-042 and the NPC's Handbook on Data Sharing Agreements — that a written Data Processing Agreement is not merely a best practice but a legal requirement under Section 14 of RA 10173. Where a processor subcontracts processing to a sub-processor, the DPA must either authorize such sub-processing in advance or require the processor to obtain prior written consent from the controller. The processor may not engage a sub-processor that offers fewer data protection guarantees than those required by RA 10173.
A Philippine Data Processing Agreement differs from a Data Sharing Agreement (DSA), which is used when two personal information controllers share personal data with each other for separate, independent purposes. The NPC's Guidelines on Data Sharing Agreements (NPC Circular 2019-01) impose additional requirements on DSAs, including a Data Sharing Assessment and registration of certain DSAs with the NPC.
The legal framework governing the Data Processing Agreement (Philippines) in Philippines draws on several key statutes and regulatory bodies. Under Philippine law, the Civil Code of the Philippines (Republic Act No. 386) governs contractual obligations. The Revised Corporation Code (Republic Act No. 11232) regulates corporate entities through the Securities and Exchange Commission (SEC). The Labor Code of the Philippines (Presidential Decree No. 442) and Department of Labor and Employment (DOLE) govern employment matters. The Data Privacy Act of 2012 (Republic Act No. 10173) and the National Privacy Commission (NPC) protect personal data. The Bureau of Internal Revenue (BIR) administers tax obligations under the National Internal Revenue Code. Parties executing a Data Processing Agreement (Philippines) in Philippines should confirm the document reflects current law, including any amendments enacted since the original drafting date. The Data Privacy Act (RA 10173) sets the foundational requirements.
When Do You Need a Data Processing Agreement (Philippines)?
A Data Processing Agreement is required in the Philippines whenever a personal information controller outsources or delegates the processing of personal data to a third-party personal information processor.
A Philippine corporation (SEC-registered) or sole proprietor (DTI-registered) that engages a cloud computing provider — such as an Amazon Web Services (AWS) reseller, a Microsoft Azure partner, or a Google Cloud Platform distributor — to host systems containing personal data of Philippine customers or employees must execute a DPA with that provider under Section 14 of RA 10173.
A BPO company or call center engaged by a foreign principal to process personal data of the principal's customers on behalf of the principal requires a DPA that complies with both Philippine RA 10173 and the data protection law of the principal's jurisdiction, given the extraterritorial scope of RA 10173 and equivalent laws such as the EU General Data Protection Regulation (GDPR).
A Philippine employer that engages a third-party payroll processing company — which accesses employee TINs, SSS numbers, PhilHealth IDs, Pag-IBIG/HDMF numbers, and salary information — must have a DPA with the payroll processor to confirm that sensitive employee data is processed only on the employer's instructions and with equivalent security standards.
A hospital or healthcare provider that shares patient records with a laboratory, diagnostic center, or telemedicine platform for processing requires a DPA because health data constitutes sensitive personal information under Section 3(l) of RA 10173, which is subject to stricter processing requirements under Section 13 of the Act.
Any Philippine organization that engages a marketing analytics, CRM, or digital advertising platform that processes customer personal data — including behavioral data, purchase histories, and device identifiers — must have a DPA in place before commencing such data sharing.
What to Include in Your Data Processing Agreement (Philippines)
A valid Philippine Data Processing Agreement under RA 10173 must contain the following essential elements.
Identification of Parties: Full legal names, addresses, and registration numbers (SEC or DTI) of the personal information controller and the personal information processor. The DPA must clearly define which party is the controller and which is the processor.
Scope and Purpose of Processing: Precise description of the personal data to be processed, the categories of data subjects, the nature and purpose of the processing, and the duration of the processing engagement.
Processing Instructions: A requirement that the processor processes personal data only on documented instructions from the controller, including with regard to cross-border transfers, and must immediately inform the controller if an instruction infringes RA 10173 or other applicable Philippine law.
Confidentiality: An obligation on the processor to confirm that all persons authorized to process personal data are committed to confidentiality and have received appropriate data privacy training.
Security Measures: Requirements for the processor to implement appropriate technical and organizational security measures under Section 20 of RA 10173 — including access controls, encryption, pseudonymization, and regular security testing — sufficient to protect against unauthorized or unlawful processing and against accidental loss, destruction, or damage.
Sub-processor Restrictions: Conditions under which the processor may engage sub-processors, including prior written authorization from the controller and a requirement to impose equivalent data protection obligations on sub-processors.
Data Breach Notification: Obligation on the processor to notify the controller without undue delay — and no later than 72 hours — upon becoming aware of a personal data breach, as required under NPC Circular 2016-03.
Data Subject Rights Assistance: Obligation on the processor to assist the controller in fulfilling its obligations to respond to data subject rights requests under Sections 16 to 20 of RA 10173.
Return or Deletion of Data: Obligation on the processor to return or delete all personal data upon termination of the processing engagement, in accordance with the controller's retention schedule.
Additional compliance elements for a Data Processing Agreement (Philippines) used in Philippines include: Under Philippine law, the Civil Code of the Philippines (Republic Act No. 386) governs contractual obligations. The Revised Corporation Code (Republic Act No. 11232) regulates corporate entities through the Securities and Exchange Commission (SEC). The Labor Code of the Philippines (Presidential Decree No. 442) and Department of Labor and Employment (DOLE) govern employment matters. The Data Privacy Act of 2012 (Republic Act No. 10173) and the National Privacy Commission (NPC) protect personal data. The Bureau of Internal Revenue (BIR) administers tax obligations under the National Internal Revenue Code. Forms-legal.com provides this template as a starting point for Philippines-compliant documentation.
Sources & Citations
Statutory citations link to official government sources.
- DSAEU official
Cite this page
Reference this free template in an article, syllabus, or research note:
Forms Legal. (2026). Data Processing Agreement (Philippines) (Philippines) [Legal document template]. Forms Legal. https://forms-legal.com/philippines/business/contracts/data-processing-agreement-philippines
"Data Processing Agreement (Philippines) (Philippines)." Forms Legal, 2026, https://forms-legal.com/philippines/business/contracts/data-processing-agreement-philippines.
@misc{formslegal-data-processing-agreement-philippines,
author = {{Forms Legal}},
title = {Data Processing Agreement (Philippines) (Philippines)},
year = {2026},
howpublished = {\url{https://forms-legal.com/philippines/business/contracts/data-processing-agreement-philippines}},
note = {Free legal document template. Based on Data Privacy Act (RA 10173)}
}
Frequently Asked Questions
In the Philippines, a Data Processing Agreement (DPA) and a Data Sharing Agreement (DSA) serve fundamentally different purposes under the Data Privacy Act of 2012 (RA 10173). A Data Processing Agreement governs the relationship between a personal information controller (PIC) and a personal information processor (PIP) under Section 14 of RA 10173 — the processor processes data solely on behalf of and under the instructions of the controller, and does not use the data for its own independent purposes. A Data Sharing Agreement, by contrast, governs the transfer of personal data between two or more personal information controllers who each process the shared data for their own purposes. NPC Circular 2019-01 (Guidelines on Data Sharing Agreements) imposes specific requirements on DSAs that go beyond DPA requirements, including a mandatory Data Sharing Assessment to identify risks, and registration of certain DSAs with the NPC where the sharing involves sensitive personal information or privileged information. A common example: when a Philippine bank shares customer financial data with a credit bureau for credit scoring purposes, a DSA is required (both are independent controllers). When the same bank outsources data processing to a cloud provider, a DPA is required (the provider is a processor acting on the bank's instructions).
Yes, a Data Processing Agreement must be in writing in the Philippines. Section 14 of the Data Privacy Act of 2012 (RA 10173) explicitly states that the processing performed by a personal information processor shall be governed by a contract or other legal act that is binding on the processor with regard to the personal information controller. The National Privacy Commission (NPC) has confirmed through advisory opinions — including NPC Advisory Opinion 2018-042 — that this contract must be in documented, written form. The NPC's Handbook on Data Sharing Agreements and the NPC's standard DPA clauses further require that the agreement specifically address security measures, sub-processor conditions, breach notification timelines, and data subject rights assistance. While the Electronic Commerce Act (RA 8792, 2000) permits electronic contracts, organizations processing sensitive personal information or government-identified information are advised by the NPC to maintain physically signed agreements for evidentiary purposes in any NPC enforcement proceeding.
Under Section 20 of the Data Privacy Act of 2012 (RA 10173) and the NPC's implementing rules, personal information processors must implement appropriate organizational, physical, and technical security measures to protect personal data against natural dangers (such as accidents, natural disasters) and human dangers (such as unlawful access, fraudulent misuse, alteration, disclosure, or destruction). The NPC's Data Privacy by Design Framework and the NPC's Security Incident Management Policy (NPC Circular 2016-03) provide guidance on acceptable security measures. Required technical measures include: encryption of personal data in transit and at rest; pseudonymization where applicable; access controls and user authentication; regular security testing and vulnerability assessments; and logging and monitoring of access to personal data. Organizational measures include: data privacy training for all personnel with access to personal data; a documented security incident response procedure; appointment of a Data Protection Officer (DPO) for qualifying organizations under NPC Circular 2017-01; and maintenance of a data processing inventory. The NPC may inspect and audit a processor's security measures during an investigation and may issue a compliance order requiring remediation of identified security gaps.
No. Under Section 14 of the Data Privacy Act of 2012 (RA 10173) and the NPC's guidelines, a personal information processor may not engage a sub-processor to carry out specific processing activities on behalf of the controller without prior specific or general written authorization from the personal information controller. Where the controller grants general authorization for sub-processing, the processor must inform the controller of any intended changes concerning the addition or replacement of sub-processors, giving the controller the opportunity to object to such changes. The processor remains fully liable to the controller for the performance of the sub-processor's obligations under RA 10173. The sub-processor must be bound by a Data Processing Agreement that imposes the same data protection obligations as those set out in the main DPA between the controller and the processor, including equivalent security measures, breach notification timelines, and data subject rights assistance obligations. If a sub-processor fails to fulfil its data protection obligations, the processor remains fully responsible to the controller for the sub-processor's non-compliance.
If a personal information processor discovers or becomes aware of a personal data breach — defined under Section 3(b) of the Data Privacy Act of 2012 (RA 10173) as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data — the processor must notify the personal information controller without undue delay and no later than 72 hours after becoming aware of the breach, under NPC Circular 2016-03 (Security Incident Management Policy). The controller then has the obligation to notify the NPC and affected data subjects within 72 hours of being notified by the processor, where the breach is likely to give rise to a real risk of serious harm to the data subjects. The NPC's breach notification form requires: a description of the nature of the breach; the categories and approximate number of data subjects affected; the name and contact details of the DPO; the likely consequences of the breach; and the measures taken or proposed to address the breach. Failure to notify the NPC of a data breach within the prescribed period is a violation of RA 10173 and may result in administrative penalties of up to PHP 2,000,000 per violation under Section 25 of RA 10173, in addition to potential criminal liability.
This template is provided for informational purposes only and does not constitute legal advice. Laws vary by jurisdiction and change over time. Consult a qualified attorney for advice specific to your situation.Full disclaimer
Found an error? Let us knowRelated Documents
You may also find these documents useful:
Privacy Policy (Philippines)
A compliant Privacy Policy for Philippine businesses under the Data Privacy Act of 2012 (RA 10173), National Privacy Commission (NPC) regulations, and the implementing rules. Covers lawful basis for processing, data subject rights, retention periods, cross-border transfers, and NPC complaint procedures.
Terms and Conditions (Philippines)
A comprehensive Terms and Conditions agreement for Philippine businesses and websites, compliant with the Electronic Commerce Act (RA 8792), Consumer Act of the Philippines (RA 7394), and Data Privacy Act (RA 10173). Covers user obligations, intellectual property, limitation of liability, governing law, and dispute resolution under Philippine law.
Acceptable Use Policy (Philippines)
An Acceptable Use Policy (AUP) for Philippine businesses and platforms, aligned with the Cybercrime Prevention Act (RA 10175), Data Privacy Act (RA 10173), and Electronic Commerce Act (RA 8792). Defines permitted and prohibited uses, enforcement actions, and user accountability under Philippine law.