NPC Advisory Opinion No. 2025-015 — Processing of QR Codes for Know-Your-Client Purposes by Third-Party Service Providers

Reference

Advisory Opinion No. 2025-015

Official PDF

Text

26 December 2025

Re: PROCESSING OF QR CODES FOR KNOW-YOUR-CLIENT (KYC) PURPOSES BY THIRD-PARTY SERVICE PROVIDERS

Dear [Redacted],

We respond to your request for an Advisory Opinion on whether your company, outsourced to perform identity authentication and know-your-client (KYC) services for a client bank, should be given access to Philippine Identification System (PhilSys) credentials submitted by individuals, specifically, the QR code appearing on the PhilID card.

You state that your company is a domestic corporation engaged in information technology, computer services and consulting, and general electronic data processing. One of your clients is a bank which engaged your services to process credit card applications and conduct KYC for identity verification.

As part of its customer onboarding process, the bank requires applicants to submit a copy of any valid identification card from its list of acceptable IDs. Your company has been tasked to perform authentication and verification of the client’s identity using the PhilSys ID presented. You note that, regardless of format, the PhilSys ID contains a QR code which is essential for identity authentication and which, to your understanding, contains demographic and biometric data, including the person’s photograph, name, date of birth, address, sex, blood type, marital status, fingerprint and the PhilSys Card Number (PCN).

You further state that, despite consent wording in the bank’s online and paper-based applications authorizing the sharing and dissemination of the customer’s personal information, the bank declines to provide you access to the QR code, citing data privacy concerns. You explain that, as a result, identity authentication and verification, and essentially mandatory KYC, has become either inefficient or incomplete.

Accordingly, you seek guidance on whether or not banks may lawfully share the PhilSys QR code in any of the Philippine National ID formats with third-party KYC service providers such as your company.

Discussion

Personal and Sensitive Personal Information; PhilSys Data; PhilSys QR Codes

The DPA defines personal information as any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual. The DPA further classifies as sensitive personal information, among others: information about an individual’s age and marital status, information issued by government agencies peculiar to an individual (including government-issued numbers and identifiers), and health and other similarly sensitive records.

Under the PhilSys Act, the PhilSys registry contains a set of demographic information (such as the registrant’s full name, sex, date and place of birth, blood type, address, and citizenship or resident status) and biometric information (including, among others, a front-facing photograph, fingerprints, and iris scan), all linked to a randomly generated PhilSys Number (PSN). These data are reflected on or associated with the physical PhilID card, the paper PhilID, and the digital PhilID, and are accompanied by the PhilSys Card Number (PCN).

Publicly available materials from the Philippine Statistics Authority (PSA) describe the PhilID as containing on its front the cardholder’s name, photograph, date of birth, address, and PhilSys Card Number (PCN), while the back carries the date of issuance together with the registrant’s sex, blood type, marital status, place of birth, and a QR code as part of its security features. PSA further explains that the printed ePhilID likewise contains a QR code which serves as its security feature and may be scanned using the PhilSys Check facility via verify.philsys.gov.ph. The QR code also embeds the PSA digital signature associated with the PhilSys record, which can be used to check that the ID has not been altered.

From the perspective of the DPA, the crucial points are that:

1. The PhilSys QR code is a means of accessing or confirming identifiable data about the cardholder which either replicates or is directly linked to the personal information printed on the PhilSys ID; and
2. It is associated with government-issued identifiers and biometric data, which are expressly classified as sensitive personal information under Section 3(l) of the DPA, including “any information that is issued by government agencies peculiar to an individual” and biometric data such as photographs and fingerprints.

Accordingly, the PhilSys QR code, and any data derived from it in the course of KYC authentication, should be treated as personal. As such, it is subject to stricter requirements under the DPA and its IRR.

Personal Information Controller and Processor, Outsourcing; Obligations and Instructions

Section 3 of the DPA distinguishes between a Personal Information Controller (PIC) and a Personal Information Processor (PIP). In your scenario, the bank is considered as the PIC, as it determines the purposes and means of processing its customers’ personal data for KYC, account opening, credit card issuance, and related services. Your company meanwhile, may be considered as the bank’s PIP, processing personal data on behalf of and upon the instructions of the bank.

Your company, as a PIP, is required to process personal data only for the bank’s lawfully specified purposes, under a written outsourcing agreement that sets out your obligations on security, confidentiality, retention, and data subject rights, among others. All processing must be strictly limited to the instructions and purposes defined by the bank as PIC.

Lawful Basis for Processing PhilSys ID and QR Code Data

Processing personal data from the PhilSys ID, including any data accessed through the QR code, must comply with Sections 12 and 13 of the DPA. These provisions govern the lawful criteria for processing personal information and sensitive personal information, respectively.

For the bank, the following legal bases are typically relevant in the KYC context:

1. Compliance with a legal obligation. Banks and other covered institutions are subject to customer due diligence (CDD) and KYC requirements under the Anti-Money Laundering Act (AMLA), as amended, and the regulations of the Bangko Sentral ng Pilipinas (BSP). These frameworks allow or encourage the use of reliable and independent identification documents and systems such as the PhilID and its QR code for verifying the identity of customers and beneficial owners. Processing PhilSys ID data, including authentication via the QR code and official verification services, may therefore be grounded on Section 12(c) of the DPA (processing necessary to comply with a legal obligation of the PIC) and, for sensitive personal information, on Section 13(b) (processing provided for by existing laws and regulations).

2. Performance of a contract with the data subject. For many banking services, processing the customer’s identification documents is necessary for entering into and performing a contract with the data subject (for example, opening and maintaining an account, issuing a credit card, or granting a loan). This may be relied upon under Section 12(b) of the DPA as an additional or complementary basis.

3. Legitimate interests. Processing may also be justified under Section 12(f), where it is necessary for the legitimate interests of the bank or a third-party (such as fraud prevention, risk management, and the integrity of financial transactions), provided that such interests are not overridden by the fundamental rights and freedoms of the data subject. NPC Circular No. 2023-07 (Guidelines on Legitimate Interest) clarifies how PICs may rely on legitimate interest as a lawful basis, subject to a three-part assessment of purpose, necessity and balancing tests. For sensitive personal information accessed via the PhilSys QR code, the primary lawful basis remains Section 13(b) of the DPA, that is, processing provided for by existing laws and regulations such as AMLA and its implementing rules.

While you mention that the bank’s application forms contain broad consent wording authorizing the sharing and dissemination of personal data, the Commission has repeatedly reminded PICs that consent is not the only lawful criterion for processing, and that they should identify and rely on the basis that is most appropriate for the particular processing, especially where processing is required by law or necessary to provide a service. In such cases, consent should not be used as the primary basis, to avoid giving a false impression that data subjects may refuse processing that is in fact mandated or essential.

For your company, as a PIP, there may be no need to obtain separate or independent consent from the bank’s customers for the same processing. NPC Advisory Opinion No. 2018-015 explains that where a PIC enters into an outsourcing arrangement for the processing of personal data, it is not required to obtain a separate consent from the data subjects, as the purpose of the processing and the PIC remain the same. NPC Advisory Opinion No. 2020-018 similarly clarifies that a PIP processes personal data only on behalf of and under the instructions of the PIC, with no independent authority to determine the purpose of processing. Accordingly, your processing activities must be clearly covered by the bank’s identified lawful bases and privacy notices, and must remain limited to what is necessary and proportionate for the performance of KYC and identity verification services.

Sharing of PhilSys QR Codes with Third-Party Service Providers for KYC purposes

You essentially ask whether data privacy law prohibits banks from sharing the PhilSys QR code with a third-party KYC provider. Neither the DPA nor the PhilSys Act categorically prohibits a relying party such as a bank from allowing its duly contracted processor to access and process the PhilSys QR code, provided that the following conditions are satisfied:

1. Existence of a valid lawful basis. The bank must have a lawful basis under Sections 12 and 13 of the DPA to process the PhilSys data for KYC and identity verification (such as compliance with AMLA and BSP regulations, performance of a contract, and/or legitimate interests), and this basis must extend to processing carried out on its behalf by your company.

2. Necessity and proportionality. Access to the QR code and any data derived from it must be demonstrably necessary and not excessive for the KYC purpose. In particular, the bank and your company should assess whether you need to retain an image of the QR code or only to scan it transiently for authentication; it is sufficient for you to receive a verification result and a limited subset of fields, rather than the full QR payload; and there are ways to minimize the number of copies and locations where PhilSys data are stored.

3. Adequate contractual and security safeguards. Considering that we have not seen nor have access to any specific data processing or outsourcing agreement executed between your company and the bank, we can offer the following general guidance: A written data processing or outsourcing agreement should clearly identify your role as a processor acting only on the bank’s documented instructions; indicate that your use of PhilSys data should be limited strictly to KYC and related fraud-prevention purposes; prohibit the use of the PSN, PCN, or other PhilSys identifiers as general identifiers beyond what is allowed by law; require appropriate organizational, physical, and technical security measures in processing personal data including PhilSys data (including encryption in transit and at rest, access controls, logging, and retention/deletion schedules); address audit rights, sub-processing arrangements (if any), and the handling of data subject rights (access, correction, erasure, data portability, and objection).

4. Transparency to data subjects. The bank’s privacy notices and account opening documents should clearly inform customers that their PhilSys credentials, including the QR code, may be processed either by the bank directly or through third-party providers for identity verification, fraud prevention, and compliance with legal and regulatory requirements. The notice should identify or describe the categories of third-parties with whom data may be shared and the purposes of such sharing.

Accordingly, a bank may, as a matter of data protection law, permit a duly contracted third-party KYC provider to access and process the PhilSys QR code, subject to the foregoing qualifications. At the same time, the DPA and the PhilSys Act do not compel a bank to share the QR code with any particular service provider. The allocation of authentication functions, whether QR scanning is done solely by the bank, solely by the processor, or jointly, is a matter of business judgment and risk management, provided that whichever arrangement is chosen remains compliant with the principles of transparency, legitimate purpose, proportionality, and security.

Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.

For your reference.

Sincerely,

(Sgd.) VIDA ZORA G. BOCAR OIC-Director IV, Privacy Policy Office