NPC Issuance Wiki

NPC Advisory Opinion No. 2025-016 — Installation of Closed-Circuit Television (CCTV) in Local Government Unit Offices

Issued Advisory Opinion

Official opinion tags

Text

26 December 2025

Re: INSTALLATION OF CLOSED-CIRCUIT TELEVISION (CCTV) IN LOCAL GOVERNMENT UNIT OFFICES

Dear [Redacted],

We write in response to your inquiries on the applicability of Republic Act No. 10173, also known as the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations (IRR), and relevant issuances of the National Privacy Commission (NPC) on the following concerns:

  1. Installation and use of CCTV with audio recording inside the Office of the Municipal Treasurer, particularly facing her desk and vault;
  2. An order to transfer the monitoring and control to the Office of the Mayor with access through a personal laptop;
  3. The implications of the CCTV installation and monitoring vis-à-vis data subject rights; and
  4. The measures that the local government unit may adopt to balance legitimate security concerns with the right to privacy.

Hence, this request for an Advisory Opinion.

Discussion

Personal information; Processing; CCTV

Under the DPA, personal information refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.1 The footage and images captured in a CCTV are considered personal information when the footage contains individuals that can be reasonably identified by the entity holding the information, in this case, the local government unit (LGU), particularly the Office of the Mayor.

Meanwhile, processing is defined as any operation or any set of operations performed upon personal information and sensitive personal information (collectively, personal data) including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure, or destruction of data.2 Simply put, processing covers the whole lifecycle of personal data, that is from collection to disposal.

The DPA applies to the processing of all types of personal information and to any natural and juridical person involved in the processing of personal information. A local government unit such as the Municipality of San Ricardo is considered a personal information controller (PIC) required to comply with the provisions of the DPA. As a PIC, the municipality must have a designated Data Protection Officer (DPO) who shall be responsible for ensuring compliance of the LGU with the requirements under the DPA, its IRR and relevant issuances of the NPC. Its DPO and data processing systems must be registered with the NPC.

Lawful processing; Functions of public authority; Mandate; Privacy Impact Assessment

The processing of CCTV footage in a government office is allowed on account of fulfillment of functions of public authority3 which necessarily includes the processing of personal data for the fulfillment of mandate4 or for legitimate purposes.5

In addition, any of the criterion under Section 13 of the DPA may likewise apply in cases where CCTV footages or images would reveal sensitive personal information.

Security measures; General data privacy principles

We must emphasize that even if there is lawful basis to process personal data, the PIC, in this case the LGU, is required to comply with the implementation of reasonable and appropriate organizational, physical, and technical security measures;6 adherence to the general data privacy principles of transparency, legitimate purpose, and proportionality; and to uphold the rights of the data subjects in processing their personal data.

Your letter request mentioned that the municipal mayor issued Executive Order (EO) No. 30, series of 2025, prescribing guidelines on the installation, access, and use of CCTVs within the municipal building. Under the said EO, the access to the CCTV footage is limited to the local chief executive as the head of agency and the data privacy officer, with provision for third-party access only upon submission of an approved access request form. This procedure is generally aligned with the requirement to implement access controls as a form of security measure. Access may likewise be granted to other authorized personnel who shall be responsible for handling access requests, monitoring live feeds, and the day-to-day operation of the CCTV systems.7

You further mentioned that the access to the CCTV footage was extended to the personal laptop of the local chief executive. It is required that the footage recorded by CCTV systems be encrypted, and stored in a secure manner, whereby its confidentiality, integrity, and availability are ensured.8 Further, PICs shall implement reasonable and appropriate security measures, including privacy by design principles, to protect personal data processed against accidental, unlawful, or unauthorized use.9

In practice, a personal device may not fully meet all these requirements, unless the same is configured or onboarded into the LGU’s IT or security framework. As such, extending remote access from a personal device of CCTV footages, even if it belongs to the local chief executive may not be compliant with the requirements under the law. We suggest raising these concerns with your local chief executive so that they may be addressed at the earliest opportunity and ensure that the monitoring system is compliant with all statutory requirements.

Moreover, you stated that the CCTV with audio recording is positioned focusing on the municipal treasurer’s desk and vault. To ensure that CCTV systems capture footage in a manner consistent with the DPA and to avoid unreasonable intrusions on the data subjects’ privacy, the PIC and its PIPs should thoroughly consider the location and angles of the cameras. CCTVs shall only be used to monitor the intended spaces, taking into consideration the purpose for such monitoring.10

In connection with the immediately preceding paragraph, it is required that a privacy impact assessment (PIA) be conducted on the system used to process the footages and to other data processing systems used by the LGU to process personal data. A PIA includes the holistic assessment of the risks to the rights and freedoms of a data subject. An audio-enabled CCTV directly focused on an employee’s desk and vault may be disproportionate and intrusive on the rights of data subjects. Appropriately, the LGU should only store and collect footage that are adequate, relevant, suitable, necessary, and not excessive in relation to the declared, specified, and legitimate purpose which warranted the installation of CCTVs.

For additional information and guidance, you may refer to NPC Advisory No. 2017-03 (Guidelines on Privacy Impact Assessments) to know more about the conduct of a PIA, who should take part and what steps should be taken to ensure that the processing of CCTV footage, as well as its placement and monitoring, are compliant with the provisions of the DPA and its related issuances.

In addition to the foregoing, the LGU shall ensure that the data subjects involved in the processing of personal data are informed about the details of the processing of their personal data. This may be operationalized through the posting of a privacy notice. This is consistent with the right of the data subject to be informed, thus, there is need to apprise data subjects of the following:11

  1. Description of the personal data to be processed;
  2. Purposes for processing, including: direct marketing, profiling, or historical, statistical or scientific purpose;
  3. Basis of processing, when processing is not based on consent;
  4. Scope and method of processing;
  5. Recipient/classes of recipients to whom the personal data are or may be disclosed;
  6. Methods utilized for automated access, if the same is allowed by the data subject, and the extent to which such access is authorized;
  7. Identity and contact details of the PIC or its representative;
  8. Retention period; and
  9. Existence of rights as data subjects, the right to lodge a complaint before the NPC.

In summary, we affirm that installation of CCTV cameras may be considered lawful processing under the DPA under Sections 12 and 13. However, the LGU as a PIC should observe compliance with NPC’s relevant issuances in processing personal data, which include the conduct of a PIA, and adherence to data privacy principles such as transparency, legitimate purpose and proportionality.

Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.

For your reference.

Very truly yours,

(Sgd.) VIDA ZORA G. BOCAR OIC – Director IV, Privacy Policy Office

Footnotes

  1. §3(g); RA 10173. ↩

  2. Id., §3(j). ↩

  3. Id., §12(e). ↩

  4. Id., §4(e). ↩

  5. Id., §12(f). ↩

  6. NPC Circular No. 2023-06 (Security of Personal Data in the Government and the Private Sector). ↩

  7. §5(A.6), NPC Circular No. 2024-02 (Closed-Circuit Television {CCTV} Systems). ↩

  8. Id., §5(B.3). ↩

  9. Id., §5. ↩

  10. Id., §5(B). ↩

  11. NPC Advisory Opinion No. 2018-031. ↩

Backlinks