Personal Data Consent Form (Philippines)

A Personal Data Consent Form in the Philippines evidences that consent has been freely given, identifying exactly what has been agreed to and by whom.

The NPC's Privacy Policy Office has issued a series of circulars, advisories, and decisions that flesh out the consent requirements of RA 10173: NPC Circular 16-01 (Security of Personal Data in Government Agencies), NPC Advisory Opinion 2017-013 (on consent for employment records), NPC Advisory Opinion 2021-007 (on electronic consent), and NPC Decision No. 2021-081 in the Lazada Philippines case, among others. Under Section 12 of RA 10173, processing of ordinary personal information is lawful if the data subject has given consent, or if processing is necessary for compliance with a legal obligation, for the fulfilment of a contract, for the protection of vitally important interests, or for the legitimate interests of the PIC — following the proportionality principle under Section 11(c).

For sensitive personal information under Section 13 of RA 10173, explicit consent is the primary legal basis outside of narrowly defined statutory exceptions: health research approved by a PHREB-accredited Ethics Review Committee (ERC), journalism and publication in the public interest, legal proceedings before Philippine courts, and certain government functions. The Personal Data Consent Form documents this consent in writing, creating a clear audit trail for NPC compliance and for demonstrating the accountability principle — a core obligation under Section 11(f) of RA 10173.

Philippine organizations required to appoint a Data Protection Officer (DPO) under NPC Circular 16-01 include those employing at least 250 persons or those processing sensitive personal information of at least 1,000 data subjects. The DPO must be registered with the NPC through the NPC's DPO Registry and is responsible for overseeing compliance with RA 10173, including ensuring consent forms are properly collected, stored, and honored. Non-compliance with the consent requirements of RA 10173 exposes PICs to criminal penalties under Sections 25-33 — including up to six years imprisonment and fines of up to PHP 5,000,000 for unauthorized processing of sensitive personal information — and administrative fines imposed by the NPC under NPC Circular 22-01 of up to PHP 5,000,000 per violation.

A Personal Data Consent Form in the Philippines is needed whenever an organization or individual — whether a government agency, private corporation registered with the SEC under RA 11232, partnership, sole proprietorship registered with DTI, NGO, educational institution accredited by CHED or DepEd, healthcare provider, or individual professional — proposes to collect and process personal data of Filipino citizens or residents and consent is the chosen legal basis for processing.

Employee recruitment and onboarding: Philippine HR departments collecting application data, employment records, government ID numbers (PhilSys National ID, SSS, TIN, PhilHealth, Pag-IBIG), and beneficiary designations must obtain a signed data consent form from each applicant and new hire, as required by NPC Advisory Opinion 2017-013 and the General Data Privacy Principles under Section 11 of RA 10173.

Customer registration and loyalty programs: Philippine retail chains, e-commerce platforms (subject to DTI Department Administrative Order No. 22-08 on e-commerce), and BSP-supervised financial institutions opening deposit or loan accounts under BSP Manual of Regulations must obtain consent for marketing communications, credit scoring, and data sharing with third parties.

Healthcare service provision: Private hospitals, clinics, and diagnostic centers accredited by PhilHealth under RA 11223 process sensitive personal health information under Section 13 of RA 10173, requiring explicit consent before any data collection, storage, or disclosure — including disclosure to HMO providers and insurance companies.

Digital services and mobile applications: Philippine app developers and website operators must comply with NPC Advisory Opinion 2021-007 on electronic consent and NPC guidelines on cookie consent — collecting affirmative opt-in consent from users before processing location data, biometric identifiers, or behavioral data.

Research and clinical trials: Organizations conducting health research reviewed by PHREB-accredited Ethics Review Committees (ERCs) and clinical trials regulated by the Food and Drug Administration (FDA) under RA 9711 must obtain PHREB/ICH GCP-compliant informed consent alongside a data privacy consent covering RA 10173 requirements.

Data sharing with third parties: Under Section 12(e) and Section 20 of RA 10173, organizations proposing to share personal data with processors, sub-contractors, or affiliates — including cross-border transfers to parent companies abroad — must document consent and execute a written data sharing agreement or data processing agreement. NPC registration under Section 46 of the RA 10173 IRR is required for organizations processing personal data of at least 1,000 data subjects, and the consent form is part of the NPC registration documentation package.

A Philippine Personal Data Consent Form compliant with RA 10173 and NPC guidelines must contain several mandatory elements for consent to be legally valid.

Identity of the Personal Information Controller: The full legal name of the PIC (the entity deciding the purpose and means of processing), its principal office address, its NPC Certificate of Registration number (if applicable), and the name and contact details of its registered Data Protection Officer (DPO) — required to be appointed and registered with the NPC under NPC Circular 16-01. The DPO's name and contact information must be readily accessible to data subjects under Section 21 of RA 10173.

Description of Personal Data: A specific list of the categories of personal data to be collected — names, contact details, government IDs (PhilSys National ID, Passport, UMID, SSS, GSIS, TIN, PhilHealth, Pag-IBIG numbers), financial information, health records, biometric data — using clear and plain language understandable to the average Filipino data subject, not legal jargon.

Purpose of Processing: The specific, legitimate purpose for which data will be processed — NPC Advisory Opinion 2017-006 emphasizes that RA 10173 requires a specific stated purpose, not a blanket authorization such as 'for business purposes.' Each distinct processing purpose should be separately listed.

Legal Basis: Citation of the applicable provision of RA 10173 (Section 12 for ordinary personal information; Section 13 for sensitive personal information) confirming that consent is the legal basis. For sensitive personal information, the form must explicitly state this and confirm consent is clearly distinguishable from other matters — following the granularity principle.

Data Retention Period: The period for which personal data will be retained, or the criteria used to determine that period — required by Section 11(e) of RA 10173 (data retention limitation principle). Organizations must delete or anonymize data when it is no longer necessary for the stated purpose.

Data Sharing and Third-Party Disclosure: Identification of any third parties to whom data will be disclosed, the countries to which data may be transferred (cross-border transfer disclosure required by Section 21 of RA 10173), and the safeguards in place — including NPC-required contractual clauses for international transfers.

Data Subject Rights: A summary of the data subject's rights under Sections 16-18 of RA 10173 — right to access, right to correct, right to object, right to erasure or blocking, right to data portability, and right to file a complaint with the NPC at [email protected] or call the NPC hotline.

Withdrawal of Consent: A clear statement that consent is voluntary and may be withdrawn at any time by contacting the DPO, and that withdrawal does not affect the lawfulness of processing based on consent before withdrawal.

Signature Block: The data subject's full name, signature or valid electronic signature under the E-Commerce Act (RA 8792), date of consent, and — where the data subject is a minor below 18 years — the parent or guardian's name, relationship, and signature as required by the Family Code (EO 209). The forms-legal.com Personal Data Consent Form (Philippines) template incorporates all mandatory NPC compliance elements for lawful personal data processing under RA 10173.