NPC Issuance Wiki

NPC Advisory Opinion No. 2025-017 — Right to Access School Records

Issued Advisory Opinion

Official opinion tags

Text

26 December 2025

Re: RIGHT TO ACCESS SCHOOL RECORDS

Dear [Redacted],

We respond to your request for an Advisory Opinion on behalf of your client, [Redacted], mother of a minor learner, [Redacted], a student at [Redacted]. You state that, between February and March 2025, [Redacted] repeatedly requested access to her child’s school records and academic assessments in Christian Living Education (CLED), including grade breakdowns, examinations, quizzes, performance evaluations, rubrics, and teacher comments, to verify compliance with applicable grading guidelines and Department of Education (DepEd) policies. Despite these requests, and a formal demand letter dated 27 March 2025, [Redacted] allegedly did not acknowledge or act on the request.

Thus, you now raise the following issues:

  1. Whether students’ school records are considered personal information.
  2. If so, what are the legal rights of the data subjects.
  3. Whether [Redacted] may be held liable for refusing to release a student’s own school records.
  4. Whether government agencies such as DepEd and the NPC may compel [Redacted] to produce or release school records.

Hence, this request for an Advisory Opinion.

Discussion

Student school records as personal and sensitive personal information under the DPA

Republic Act No. 10173, or the Data Privacy Act of 2012 (DPA) defines personal information as “any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.”1 The DPA further classifies as sensitive personal information, among others, information about an individual’s age and marital status, information about an individual’s education, as well as information classified as confidential under other laws.2

Batas Pambansa Blg. 232 or The Education Act of 1982 recognizes both the right of students to access their own school records and the obligation of schools to maintain and preserve the confidentiality of those records.3

The records you described, such as grade breakdowns, examinations and quizzes, performance evaluations and rubrics, and teacher comments, clearly relate to the academic performance and education of an identifiable learner. They are therefore personal data, more specifically, considered as sensitive personal information within the meaning of the DPA. They are also school records to which students have a statutory right of access, and the confidentiality of which is protected under the Education Act of 1982.

Rights of the learner as a data subject

Section 16 of the DPA enumerates the rights of the data subject, including the rights to be informed, to object, to access, to rectification, to erasure or blocking, to data portability, and to damages. Of particular relevance to this query are the following rights:4

  • Right to be informed — which requires that the learner (or, in the case of a minor, the parent or legal guardian) be informed of the nature, purpose and extent of processing of his or her personal data.
  • Right to access — which entitles the data subject, upon demand, to reasonable access to:
    • the contents of his or her personal data that were processed
    • the sources of the data
    • recipients or classes of recipients
    • the manner and reasons for processing, among others.

The IRR and NPC issuances on data subject rights emphasize that controllers must provide such access in a manner that is reasonable, transparent, and timely, subject only to lawful and clearly justified limitations (i.e. where disclosure would violate the rights of other individuals or contravene another applicable law).

Because the learner in this case is a minor, his rights as a data subject can be exercised through his mother as his parent and legal guardian, consistent with the DPA,5 the Family Code,6 and the Education Act of 1982.7

Obligations of the school as personal information controller

[Redacted], as a basic education institution that determines the purposes and means of processing learners’ personal data, is considered a personal information controller (PIC) under the DPA.8 As such, it must comply with the general privacy principles of transparency, legitimate purpose and proportionality, the criteria for lawful processing of personal and sensitive personal information, and the security requirements set out in the DPA, its Implementing Rules and Regulations, and NPC issuances on the security of personal data.

In relation to access to school records, this means that [Redacted] should, as a rule, maintain and preserve the confidentiality of learners’ records while providing reasonable access to the learner, and in the case of a minor, to the parent or legal guardian, to the learner’s own records and the personal data contained therein, subject to verification of identity and authority and to appropriate safeguards for the privacy of other individuals (e.g. by redacting names or identifiers of other students that appear in the same records).

In NPC Advisory Opinion No. 2018-006, the Commission recognized that schools, as personal information controllers, must carefully manage requests for access to and release of school records in a manner that protects learners’ privacy while respecting their rights as data subjects.9

[Redacted] should also be able to explain any lawful and specific grounds for denying or limiting access to the learner’s records, such as where disclosure would reveal privileged information, confidential notes strictly internal to the academic or disciplinary process, or personal data of third parties that cannot reasonably be segregated. The DPA does not require schools to disclose information beyond what is necessary to give effect to learners’ rights and to comply with applicable education laws and regulations.

On the specific facts you describe, a request for the learner’s grade breakdowns, graded assessments, and evaluation rubrics and comments that relate to his own performance generally falls within the scope of personal and sensitive personal information to which the learner, through his parent, may reasonably seek access, subject to the caveats above.

Possible liability for failure to act on reasonable access requests

We wish to remind you that an Advisory Opinion does not adjudicate specific disputes or make factual findings on whether a particular school has committed a violation. Whether [Redacted] may be held liable in this case would depend on a number of factual and legal considerations, including:

  • whether [Redacted] has an established and reasonable process for handling requests for access to records;
  • whether the requests and the demand letter were properly received and documented;
  • whether [Redacted] provided any response, explanation, or alternative means of access;
  • whether there are specific legal or regulatory grounds, beyond general “confidentiality” concerns, that would justify limiting or delaying access to particular documents (for example, ongoing investigations, protection of third-party data, or other applicable restrictions under education law).

If [Redacted] believes that [Redacted] has unjustifiably denied or ignored her access requests, she may consider filing a complaint with the NPC. In that context, the Commission may evaluate the school’s compliance with the DPA, including its handling of data subject requests, through appropriate proceedings.

Role of the Department of Education and the NPC in compelling production or release of school records

The DepEd is the primary regulator for basic education and has authority to issue policies and regulations governing the management and release of learners’ records in both public and private schools. The Education Act of 1982 expressly grants learners the right to access their own school records and to the issuance of official certificates, diplomas, transcripts and grades within a reasonable time, subject to reasonable regulation.10

DepEd has also issued regulations and guidance on the handling and release of learner records, including permanent records and report cards, which generally discourage practices that unduly impede learners’ access to their credentials.

While the NPC cannot speak authoritatively on the application of DepEd’s regulations in a particular case, nothing in the DPA prevents DepEd from exercising its supervisory and regulatory functions to ensure that schools comply with learners’ statutory rights to access their records, provided that any directives are implemented in a manner consistent with data protection principles.

As for the NPC, under Section 7 of the DPA and Rule III of its IRR, the NPC is mandated to administer and implement the Act and to monitor and ensure compliance with data protection standards.11 Among other functions, the Commission may:

  • ensure compliance of personal information controllers with the provisions of this Act;
  • receive complaints and institute investigations regarding violations of the DPA, the IRR, and NPC issuances, including violations of the rights of data subjects;
  • compel or petition any entity, government agency or instrumentality to abide by its orders or take action on a matter affecting data privacy.

We remind you that the Commission can only act upon resolution of a matter subject of a complaint filed by a data subject, or a concern subject to a compliance check and recommended for investigation. An advisory opinion does not authorize nor serve to adjudicate any rights to the requesting party, nor does it have any force and effect of a judgment to compel any entity or organization subject of this opinion.

In summary, our general views on your subject inquiry are as follows:

  1. School records, including grade breakdowns, assessments, rubrics and teacher comments relating to an identifiable learner, constitute personal data and, in substance, sensitive personal information under the DPA. They are also protected school records whose confidentiality must be maintained under the Education Act of 1982.
  2. Learners have data privacy rights under the DPA, which may be exercised by their parents or legal guardians in the case of minors. These rights complement, and do not diminish, the rights of students and parents under education law to access school records.
  3. Schools, as personal information controllers, are obliged to act on reasonable requests for access to a learner’s own personal data, subject to verification of identity and to appropriate safeguards for the privacy of other individuals and compliance with other applicable laws. Unjustified refusal or failure to do so may, in appropriate circumstances, constitute a violation of the DPA and may be the subject of a complaint before the NPC.
  4. DepEd may, under its education mandate, issue and enforce policies on the management and release of school records, and nothing in the DPA prevents it from doing so in a manner consistent with data protection principles.
  5. The NPC may, upon the filing of a proper complaint, investigate and, when warranted, order corrective measures, which may include requiring a school to give effect to data subject rights such as access and rectification.

Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.

For your reference.

Sincerely,

(Sgd.) VIDA ZORA G. BOCAR OIC-Director IV, Privacy Policy Office

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, § 3, ¶ g (2012). ↩

  2. Id. § 3, ¶ l(2). ↩

  3. An Act Providing for the Establishment and Maintenance of An Integrated System of Education [Education Act of 1982] Batas Pambansa Blg. 232, § 9, ¶ 4 (1982). ↩

  4. Data Privacy Act of 2012, § 16, ¶ b, c, d. ↩

  5. Id. § 17. ↩

  6. The Family Code of the Philippines [Family Code], Executive Order No. 209, §§ 209-233 (1987). ↩

  7. Education Act of 1982, §§ 14, 16, 17. ↩

  8. Data Privacy Act of 2012, § 3, ¶ g. ↩

  9. National Privacy Commission, Consent of Data Subject Prior to Release of School Records by the Lyceum of the Philippines University (LPU), NPC Advisory Opinion No. 2018-006 (Feb. 6, 2018). ↩

  10. Education Act of 1982, § 54, § 57. ↩

  11. Data Privacy Act of 2012, § 7, ¶ a, b, d. ↩

Backlinks

  • No backlinks found