Text
09 October 2025
Re: VERIFICATION OF INFORMATION SUBMITTED FOR VISA APPLICATION
Dear [Redacted],
We write in response to your inquiry on the processing of sensitive personal information in the context of international migration requirements considering the provisions of Republic Act No. 10173, also known as the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations (IRR) and relevant issuances of the National Privacy Commission (NPC).
We understand that Dataflow Verification Services Ltd. (Dataflow) is involved in performing Primary Source Verifications. Your concern arose from the requirements for visa applications to the United Arab Emirates (UAE). During the visa application, the Ministry of Human Resources and Emiritisation (MOHRE) in the UAE mandates verification of disclosed information, which often includes sensitive personal information. You mentioned that verification of the disclosed information to MOHRE is an integral part of the visa application process to the UAE. However, prior to processing the disclosed personal data, MOHRE does not secure the consent nor request for a signed Letter of Authorization (LOA) from the data subjects. The LOA is requested at a later stage, usually after the verification process has commenced and when the visa processing is already underway.
You now seek clarification on the following:
-
Whether the mandatory requirement to obtain a visa can be considered a lawful basis for processing the disclosed information, even in the absence of consent or signed LOA from the data subject;
-
Whether the verification process may be based on compliance with a legal obligation, or for the performance of a task carried out in the public interest, or for purposes of legitimate interest; and
-
If the scenario does not fall under any of the above, what alternative options so as to ensure compliance with the DPA, given that no consent is secured by MOHRE prior to the commencement of the verification process by Dataflow.
Hence, this request for an Advisory Opinion.
Discussion
Personal information controller versus Personal information processor; Obligations of PIC and PIP
Based on the facts provided in the verification process, Dataflow is considered a personal information processor (PIP) since it processes personal and sensitive personal information (collectively, personal data) of individuals solely upon the documented instructions of the MOHRE, which is the personal information controller (PIC). Accordingly, it is the PIC who is primarily responsible in establishing the lawful basis for processing. However, the PIP must ensure that the processing strictly aligns with the documented instructions and lawful basis provided by the PIC. The PIP shall not process personal data beyond the scope authorized by the PIC, otherwise the PIP shall be considered a PIC under the DPA.
Verification of information; personal data; Lawful criteria for processing
Notwithstanding the foregoing, we shall address your inquiry as to the proper basis for processing sensitive personal information in the context of international migration requirements. Sections 12 and 13 of the DPA list down the criteria for the lawful processing of personal information and sensitive personal information, respectively. While verification of data submitted by an applicant as part of visa requirements may fall under Sections 12 (c), (e), or (f), said legal bases only apply to personal information and not to sensitive personal information.
Thus, given that the information to be verified also contains sensitive personal information, at least one criterion under Section 13 of the DPA must be satisfied for the verification/processing to be considered lawful.
However, as discussed above, it appears that Dataflow is acting as a PIP for MOHRE. In this capacity, Dataflow may lawfully process the information provided by MOHRE on the basis of the latter’s documented instructions. It is essential, however, for Dataflow to ensure that MOHRE’s lawful basis is in accordance with Section 13 of the DPA. Processing sensitive personal information in the context of visa application may be justified under Section 13 (a) on consent; (b) if provided for by existing laws and regulations; or (f) when provided to government or public authority. If processing is based on consent under Sec. 13(a), we recommend checking NPC Circular No. 2023-04 (Guidelines on Consent) to know more on the requirements on securing a valid and informed consent. If, however, MOHRE’s processing of sensitive personal information is based on Section 13 (b) or (f), then consent of the data subject is not required. As such, the belated acquisition of consent or signed LOA would not be an issue, since consent is not the basis for processing.
General data privacy principles; Security measures
Under the DPA, PIPs are not exempted from complying with the other provisions of the DPA, its IRR and related issuances of the NPC. Thus, in addition to the discussions above, the processing must also strictly adhere to the data privacy principles of transparency, proportionality, and legitimate purpose as well as the implementation of appropriate and reasonable security measures.
Specific to the principle of transparency, Dataflow should ensure that the data subjects involved are informed as to the nature, purpose, and extent of the processing of their personal data, including the risks and safeguards involved, the identity of the PIC, their rights as data subjects and how these can be exercised. This may be achieved through the posting of a privacy notice.
Moreover, in compliance with the proportionality principle, Dataflow must ensure that the processing of personal data shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose. Personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means. It necessitates that only the information requested and necessary for the purpose indicated should be processed.
Most importantly, it is mandatory for all PICs and its PIPs to implement reasonable and appropriate organizational, physical, and technical security measures for the protection of personal data.
NPC Circular No. 2023-06 (Security of Personal Data in the Government and the Private Sector) outlines the minimum standards and requirements for the security of personal data. A PIC and its PIP must conduct, among other requirements, a Privacy Impact Assessment for every processing system that involves personal data of individuals. As mentioned in the said Circular, a PIC and its PIP may implement more detailed or stricter policies and procedures that reflect industry-specific operating requirements. As such, the PIC or PIP is in the best position to determine the reasonable and appropriate organizational, physical, and technical security measures to implement, considering that it has the most knowledge of its own operations and IT infrastructure.
Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note, further, that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.
For your reference.
Very truly yours,
(Sgd.) VIDA ZORA G. BOCAR OIC – Director IV, Privacy Policy Office