Text
06 November 2025
Re: VERIFICATION OF CREDENTIALS SUBMITTED FOR VISA APPLICATION
Dear [Redacted],
We write in response to your inquiry on the processing of personal information and sensitive personal information (collectively, personal data) of individuals applying for visa, taking into account the provisions of Republic Act No. 10173, also known as the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations (IRR), and relevant issuances of the National Privacy Commission (NPC).
We understand that Dataflow Verification Services Ltd. (Dataflow) specializes in the verification of credentials of individuals applying for employment in the United Arab Emirates. Dataflow receives documentary requirements, which includes personal data of individuals, from various visa processing centers and government agencies, such as the Ministry of Human Resources and Emiratisation (MOHRE) for verification purposes.
You now seek clarification whether legitimate interest is sufficient to justify the processing of applicants’ personal data in the context of verification processes. Hence, this request for an Advisory Opinion.
Discussion
Personal information controller; Personal information processor
Under the DPA, a personal information controller (PIC) refers to a person or organization who controls the collection, holding, processing, or use of personal information, including a person or organization who instructs another person or organization to collect, hold, process, use, transfer, or disclose personal information on his or her behalf. There is control if the natural or juridical person or any other body decides on what information is collected, or the purpose or extent of its processing.
On the other hand, a personal information processor (PIP) is any natural or juridical person to whom a PIC may outsource the processing of personal data pertaining to a data subject.
From the facts provided, Dataflow may be considered a PIP as it processes personal data upon the documented instructions of visa processing centers and government agencies, such as the MOHRE. Accordingly, the PIC in this case would be the visa processing center or the government, which is primarily responsible for establishing the lawful basis for processing personal data.
Sections 12 and 13 of the DPA provide for the conditions to justify the processing of personal information and sensitive personal information, respectively. Thus, given that the data to be processed includes sensitive personal information, Section 12 (f) on legitimate interest may not be the proper basis to justify the processing of sensitive personal information. The PIC would have to assess the various criteria under Section 13 to determine which among the criterion is the most appropriate basis.
In connection therewith, you mentioned that you will include in your procedure a process where, prior to the commencement of the verification process, the data subject or the visa applicant will be given a 48-hour window to oppose the processing of his or her personal data. This procedure may not be necessary because the right to object is possible only if the processing is based on consent or legitimate interest. In the context of visa applications, the most appropriate basis of processing may be Section 13 (b) if provided for by existing laws and regulations; or (f) when provided to government or public authority. The text of Section 13 (b) does not expressly limit “existing laws and regulations” to Philippine statutes and issuances. Section 13 (f) likewise allows processing of sensitive personal information when provided to government or public authority. This provision is not strictly limited to the Philippine government; thus, it can be reasonably interpreted to include foreign government or authority.
As such, given the distinctions between a PIC and PIP, the basis for lawful processing is typically established by the PIC. The PIP, however, must ensure that the processing strictly aligns with the documented instructions of the PIC. The PIP shall not process personal data beyond the scope and purpose authorized by the PIC, otherwise the PIP will be considered a PIC.
Additionally, we emphasize that PIPs are not exempted from complying with the requirements under the DPA, specifically adherence to the general data privacy principles of transparency, legitimate purpose, and proportionality; implementation of security measures; and to uphold the rights of the data subjects.
General data privacy principles; Security measures
The transparency principle necessitates that the PIC and its PIP shall ensure that the data subjects involved are informed about the details of the processing of their personal data. This may be operationalized through the posting of a privacy notice. This is consistent with the right of the data subject to be informed, thus, the need to apprise the latter of the following:
- Description of the personal data to be processed;
- Purposes for processing, including: direct marketing, profiling, or historical, statistical or scientific purpose;
- Basis of processing, when processing is not based on consent;
- Scope and method of processing;
- Recipient/classes of recipients to whom the personal data are or may be disclosed;
- Methods utilized for automated access, if the same is allowed by the data subject, and the extent to which such access is authorized;
- Identity and contact details of the PIC or its representative;
- Retention period; and
- Existence of rights as data subjects, the right to lodge a complaint before the NPC.
As can be gleaned therefrom, in processing personal data further, it is required that the data subjects affected be informed of the recipient to whom the personal data will be disclosed. As such, at the outset of the processing of personal data of individuals applying for visa, they must be informed, through the posting of appropriate privacy notices, that their documents will be disclosed to Dataflow for verification purposes. Dataflow must ensure compliance by the PIC of this requirement so that further processing of personal data is in accordance and consistent with the provisions under the DPA.
Moreover, it is crucial for PICs and its PIPs to comply with the proportionality principle. This requires that the processing of personal data shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose. Personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means. It necessitates that only the information requested and necessary for the purpose indicated should be processed.
Most importantly, it is also mandatory for all PICs and its PIPs to implement reasonable and appropriate organizational, physical, and technical security measures for the protection of personal data. We refer you to NPC Circular No. 2023-06 (Security of Personal Data in the Government and the Private Sector) to know more on what security measures may be deemed appropriate and applicable to the processing conducted on the part of both the PIC and PIP.
Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note, further, that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.
For your reference.
Very truly yours,
(Sgd.) VIDA ZORA G. BOCAR OIC – Director IV, Privacy Policy Office