Advisory Opinion No. 2026-002 — REQUESTS FOR PERSONAL DATA FROM GOVERNMENT AGENCIES

Text

12 May 2026

Re: REQUESTS FOR PERSONAL DATA FROM GOVERNMENT AGENCIES

Dear [Redacted],

This pertains to your request for an advisory opinion on the applicability of Republic Act No. 10173,¹ also known as the Data Privacy Act of 2012 (DPA), to requests of information pertaining to individuals from government agencies in connection with case build-up, court compliance, and for the execution of court decisions, particularly:

a) A request with a court order for information or confirmation of a foreign national’s address and immigration status for purposes of service of summons in a pending civil case, which was denied by the Bureau of Immigration (BI); and

b) A request of information and case records concerning the spouse of the firm’s client in connection with a pending criminal case before the Regional Trial Court and an alleged arrest by the Philippine National Police, which was denied despite the presentation of a duly notarized Special Power of Attorney (SPA).

Discussion

Scope of the DPA; Processing of personal data

The DPA and its Implementing Rules and Regulations (IRR) apply to the processing of personal information and sensitive personal information (collectively, personal data) by any natural and juridical person in the government or private sector.²

Personal information refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.³

On the other hand, sensitive personal information refers to personal information:

About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations;
About an individual’s health, education, genetic or sexual life of a person, or to any processing for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings;
Issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or current health records, licenses, or its denials, suspension or revocation, and tax returns; and
Specifically established by an executive order or an act of Congress to be kept classified.

A foreign national’s address and immigration status constitute personal information and may fall within sensitive personal information if tied to government-issued identifiers or records peculiar to the individual and/or proceedings.

Also, records relating to an alleged arrest and a pending criminal case generally constitute sensitive personal information, as such pertain to proceedings for any offense committed or alleged to have been committed.

Any processing or request of personal data must have legal basis under the DPA and existing applicable laws.

Lawful basis for processing

The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists:⁴

a) The data subject has given his or her consent;

b) The processing of personal information is necessary and is related to the fulfillment of a contract with the data subject or in order to take steps at the request of the data subject prior to entering into a contract;

c) The processing is necessary for compliance with a legal obligation to which the personal information controller is subject;

d) The processing is necessary to protect vitally important interests of the data subject, including life and health;

e) The processing is necessary in order to respond to national emergency, to comply with the requirements of public order and safety, or to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate; or

f) The processing if necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.

Conversely, the processing of sensitive personal information and privileged information shall be prohibited, except in the following cases:⁵

a) The data subject has given his or her consent, specific to the purpose prior to the processing, or in the case of privileged information, all parties to the exchange have given their consent prior to processing;

b) The processing of the same is provided for by existing laws and regulations: Provided, That such regulatory enactments guarantee the protection of the sensitive personal information and the privileged information: Provided, further, That the consent of the data subjects is not required by law or regulation permitting the processing of the sensitive personal information or the privileged information;

c) The processing is necessary to protect the life and health of the data subject or another person, and the data subject is not legally or physically able to express his or her consent prior to the processing;

d) The processing is necessary to achieve the lawful and noncommercial objectives of public organizations and their associations: Provided, That such processing is only confined and related to the bona fide members of these organizations or their associations: Provided, further, That the sensitive personal information are not transferred to third parties: Provided, finally, That consent of the data subject was obtained prior to processing;

e) The processing is necessary for purposes of medical treatment, is carried out by a medical practitioner or a medical treatment institution, and an adequate level of protection of personal information is ensured; or

f) The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.

You mentioned that the requests for personal data from government agencies are for case build-up, court compliance, and for the execution of court decisions.

Based thereon, such may be anchored in Section 12(f) (legitimate interest) and Section 13 (f) regarding the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, defense, or exercise of legal claims.

Processing personal information based on legitimate interest requires the fulfillment of the following conditions:⁶

A. The legitimate interest is established;

B. The means to fulfill the legitimate interest is both necessary and lawful; and

C. The interest is legitimate and lawful, and it does not override fundamental rights and freedoms of data subjects.

On the other hand, the processing of sensitive personal information based on Section 13(f) of the DPA requires that the processing is necessary, and the processing is for the protection of lawful rights and interests or the establishment, exercise, or defense of legal claims.⁷ As discussed in the case of EA and TA vs. EJ, EE, and HC, NPC 17-018,⁸ applying the qualifier “necessary” serves to limit the potentially broad concept of “establishment of legal claims” consistent with the general principles of legitimate purpose and proportionality.

Additionally, processing personal information that is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings or necessary for the establishment, exercise, or defense of legal claims may be considered as legitimate interest under Section 12(f).⁹ Therefore, Section 13(f) in relation to Section 12(f) may also be used as lawful basis not only for sensitive personal information but also for personal information for legitimate interests purposes.

Moreover, processing of personal data on the basis of Section 13(f) of the DPA may be conducted during stages preparatory to a case and need not result in the filing of an actual case.¹⁰

General data privacy principle; proportionality; legitimate purpose; accountability

We emphasize, however, that even where a lawful basis exists, the processing or disclosure must still be proportional to the stated purpose. The principle of proportionality provides that the processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose. Personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.¹¹ It necessitates that only the information requested and necessary for the purpose indicated should be processed.

Further, the legitimate purpose principle requires that the processing of information shall be compatible with a declared and specified purpose which must not be contrary to law, morals, or public policy.¹² This means that the processing done for the establishment of a legal claim should not in any manner be outside the limitations provided by law.¹³

Given the foregoing, it is crucial that any request of personal data precisely identifies the particular data sought, states the specific purpose for the request, and explains the relevance of the requested data to the declared and specified purpose.

Accordingly, the government agency processing the personal data, as personal information controller (PIC), must determine whether it will disclose all, some, or none of the requested personal data based on the stated purpose and the necessity of the specific personal data sought.

As discussed in NPC Advisory Opinion No. 2019-017:

“NPC is not mandated to grant permission, nor compel any institution to allow any request of personal data for research purposes. Such requests should be coursed through the agency concerned. National government agencies, as PICs, are the ones who will determine whether data may be disclosed, keeping in mind their specific mandates, their charter or governing law, applicable rules and regulations, and data privacy principles enunciated in the DPA.”

Accordingly, it is outside the NPC’s mandate to determine which specific personal data, or to what extent, should be disclosed to a requesting party; neither may the NPC compel a PIC to disclose personal data as a matter of course. The PIC remains primarily responsible for determining what personal data to release or disclose, guided by its specific mandate, charter, or governing law, and applicable laws, rules and regulations. The PIC must independently evaluate the request taking into consideration the applicable basis to process the personal data, ensuring that only data that is relevant and reasonably necessary for the specified and declared purpose is disclosed with appropriate and reasonable security measures.

In Advisory Opinion No. 2022-003, we opined that additional information may be required from the requesting party to ascertain the validity of the purpose for the request:

“To satisfy the DOH on the legitimacy of the purpose of the request, it may opt to require the requestor to provide additional information on the case. But this requirement shall still adhere to the principle of proportionality, and whatever additional information received shall be used solely for the purpose of aiding the DOH in deciding whether to release the requested documents.”

Further, in Advisory Opinion No. 2021-044, it was recommended that in case a request for personal information is granted, the requesting party should be required to sign an undertaking that the information will only be used for the purpose that was declared:

“Should the CHMSC grant the request, it is suggested that the Requesting Party be required to sign an undertaking that the use of the documents will only be for the purpose of filing a complaint with the Ombudsman and that the proper disposal thereof is ensured if he does not push through with the filing of the complaint. Further, the undertaking must include a clause to the effect that the requestor acknowledges that he becomes a PIC by his receipt of the requested documents and therefore has the obligations of a PIC as prescribed under the DPA.”

We emphasize that persons exercising legal claims are not given blanket authority to collect and process personal data. The processing must still be in accordance with the foregoing requirements of the DPA to ensure protection of personal data.¹⁴ Such requests should be evaluated on a case-to-case basis and must always be subject to the PIC’s guidelines for the release of such information.¹⁵

Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.

For your reference.

Very truly yours,

(Sgd.)

ATTY. VIDA ZORA G. BOCAR

OIC-Director IV, Privacy Policy Office¹⁶

Footnotes

An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes. ↩
§ 4, IRR of Republic Act No. 10173. ↩
§ 3(g), Republic Act No. 10173. ↩
Id. § 12. ↩
Id. § 13. ↩
NPC Circular No. 2023-07 (Guidelines on Legitimate Interest). ↩
NPC Advisory No. 2024-02, § 2. ↩
EA and TA vs. EJ, EE, and HC, NPC 17-018, 15 July 2019. ↩
§ 3(A), NPC Advisory No. 2024-02 (Guidelines on Personal Data Processing based on Section 13(f) of the Data Privacy Act of 2012). ↩
Id. § 5 (A&B). ↩
§ 18(c), Implementing Rules and Regulations of R.A. No. 10173. ↩
§ 18(b), IRR of R.A. No. 10173. ↩
EA and TA vs. EJ, EE, and HC, NPC 17-018, 15 July 2019. ↩
NPC Advisory Opinion No. 2019-047. ↩
BGM vs. IPP, NPC 19-653, 17 December 2020. ↩
PCSO No. 095, series of 2025. ↩

NPC Issuance Wiki

Corpus