The Data Privacy Act: What Every Philippine Business Owner Needs to Know

If you collect customer names, numbers, emails or addresses, through a website form, a Messenger chat, a booking sheet or a raffle entry, the Data Privacy Act applies to you. Most small business owners assume the law is for banks and telcos. It is not. The good news: complying at small-business scale is mostly a matter of doing a few sensible things deliberately.

What is the Data Privacy Act?

The Data Privacy Act of 2012 (Republic Act 10173) is the Philippine law that governs how organizations collect, store, use and share personal data. It is enforced by the National Privacy Commission, and it applies to businesses of every size, not just large enterprises. Penalties for serious violations include fines and imprisonment, but for small businesses the bigger everyday risk is simpler: losing customer trust after a preventable leak.

What does the law expect from a small business?

1. Collect only what you need. A booking needs a name and contact number, not a birthday and mother's maiden name. Every extra field is extra liability.
2. Tell people what you collect and why. That is your privacy policy, written in plain language and linked where data is collected, like the one on this site.
3. Get consent for marketing. Sending promos requires permission. A simple checkbox at signup covers you; a purchased contact list never does, which is one more reason never to buy lists.
4. Protect what you store. Strong passwords, HTTPS on your website, access limited to staff who need it, and real backups. Most small-business leaks are a shared password or a stolen laptop, not a movie-style hack.
5. Know what to do if data leaks. Serious breaches must be reported to the NPC and affected customers within 72 hours. Have a simple plan before you need one.

Quick self-check: if a customer asked 'what information do you keep about me, and who can see it?', could you answer in one minute? If not, start there. That single question is most of the law in miniature.

What does this mean for your website?

Your website is usually where collection starts, so it is where compliance starts: HTTPS everywhere, forms that collect the minimum, a clear privacy policy, and payment details handled by proper payment gateways rather than your own inbox. These overlap almost completely with basic website security, so one round of good engineering covers both.

Do you need a lawyer to comply?

For a typical small business, you need sensible practices more than a retainer: minimal collection, honest notices, secured storage and a breach plan. If you process sensitive data at scale, health records, financial data, thousands of customers, then yes, get proper legal advice and register with the NPC as required. For everyone else, the checklist above covers the ground the law actually inspects.

Make compliance part of the build

Every website we ship includes HTTPS, minimal-collection forms, a privacy policy page and secure payment handling by default, because retrofitting privacy is always more expensive than building with it. Book a free discovery call and we will review how your current setup handles customer data.