NPC Issuance Wiki

NPC Advisory Opinion No. 2026-005 — Disclosure of Personal Data in Corporate Compensation Records Subject to Stockholder Inspection

Issued Advisory Opinion

Official opinion tags

Source

Text

PRIVACY POLICY OFFICE

ADVISORY OPINION NO. 2026-0051

25 August 2026

[Redacted]

Attention: [Redacted]

Re: DISCLOSURE OF PERSONAL DATA IN CORPORATE COMPENSATION RECORDS SUBJECT TO STOCKHOLDER INSPECTION

Dear Counsels,

Greetings from the National Privacy Commission!

This pertains to your request, on behalf of First Gen Corporation (FGen), for an Advisory Opinion in relation to a request from certain stockholders to inspect and obtain copies or excerpts of corporate records concerning the compensation and benefits of the top seven most highly compensated directors or officers of FGen for 2024 and 2025.

Based on your letter, the requested corporate records include:

  1. policies, guidelines, committee charters, internal documents, and board or board committee approvals governing the determination of salaries, bonuses, incentives, and benefits of the covered senior officers, including the bases, criteria, or formulae used;

  2. benchmarking or comparative analysis relating to the compensation and bonuses of FGen top directors or officers against similarly situated companies; and

  3. job descriptions, authority and reporting lines, and relevant minutes of the Compensation Committee or Board of Directors approving the compensation packages of the covered officers.

You state that the stockholders identified the purposes of the request as assessing the reasonableness and transparency of compensation, evaluating compliance with corporate governance policies and applicable disclosure requirements, and exercising stockholder rights in relation to corporate oversight and future stockholders’ meetings.

For purposes of this Advisory Opinion, the Commission proceeds from the facts stated in your letter and treats FGen as the personal information controller (PIC) with respect to the personal data contained in the requested corporate records. The discussion below is limited to the requirements of the Data Privacy Act of 2012 (DPA) and does not determine whether the requesting persons are stockholders of record or duly authorized representatives, whether the requested materials are corporate records properly subject to inspection, or whether the Revised Corporation Code or any other law permits, requires, or limits disclosure. Because the records were not submitted with the request, the Commission cannot classify each data field or determine its necessity in the abstract.

You ask whether FGen may disclose the benchmarking or comparative analysis and the relevant committee or board minutes, whether FGen may adopt anonymization, pseudonymization, or selective redaction, and whether a confidentiality and non-disclosure undertaking is sufficient to allow complete, unlimited, and unconditional inspection of the requested records.

Corporate inspection rights and privacy obligations

Compensation and benefits information linked to identifiable directors or officers is personal information. It is not, by that fact alone, sensitive personal information. Whether a record contains sensitive personal information or privileged information depends on its actual contents. For the contemplated disclosure, FGen acts as a PIC because it determines whether and how personal data in its records will be disclosed. A personal information processor, by contrast, processes personal data on the instructions of a PIC.2

Section 73 of the Revised Corporation Code recognizes the right of a director, trustee, stockholder, or member to inspect corporate records, and allows a director, trustee, or stockholder to make a written demand, at their expense, for copies of such records or excerpts therefrom, subject to confidentiality rules under prevailing laws, including the DPA.3

The DPA neither creates a blanket prohibition against stockholder inspection nor independently authorizes access to corporate records. Where FGen determines that disclosure may or must be made, the applicable lawful-processing standard depends on the nature of the data involved. Personal information may be processed only if the processing is not otherwise prohibited by law and at least one of the criteria under Section 12 of the DPA applies. The processing must also comply with the principles of transparency, legitimate purpose, and proportionality under Section 11.4

The Commission has recognized that the DPA cannot be invoked to curtail existing stockholder inspection rights when the inspection complies with prevailing laws and regulations, and that a corporation may limit the scope of inspection or redact information that is not relevant to the request.5 Where FGen determines under applicable corporate law that a particular disclosure is required, Section 12(c) may support the processing of personal information. Section 12(f) may also be considered where the processing is necessary for a legitimate interest and that interest is not overridden by the data subject’s fundamental rights and freedoms. Consent is not required when another criterion under Section 12 applies.6

Sensitive personal information and privileged information are subject to a different rule. Their processing is generally prohibited unless one of the exceptions under Section 13 applies.7 A lawful basis under Section 12 alone is therefore insufficient. FGen must separately determine whether an applicable Section 13 exception exists. Section 13(b), for example, applies only when an existing law or regulation provides for the particular processing, guarantees the protection of the sensitive personal information or privileged information, and does not require consent of the data subject.8 In Advisory Opinion No. 2024-012, the Commission recognized that Section 73 of the Revised Corporation Code of the Philippines (RCC) may serve as the existing law contemplated by Sections 12(c) and 13(b).9 In particular, the second paragraph of Section 7310 supplies the required protection by binding the inspecting or reproducing party to confidentiality rules under prevailing laws, including the DPA, and not requiring the consent of the affected data subjects. In all cases, the processing must remain necessary and proportionate. A confidentiality undertaking does not by itself establish a lawful basis or permit excessive disclosure.

Disclosure of benchmarking or comparative analysis

Disclosure of benchmarking or comparative analysis may proceed under the DPA where FGen has first determined under applicable law that the material may or must be disclosed, the processing is supported by a lawful basis, and the personal data disclosed is necessary and proportionate to the stated stockholder purpose. Company-level data, compensation ranges, methodology, and aggregated results should be used where they are sufficient for that purpose.

Names, position-specific identifiers, individualized compensation, and other personal data of comparator-company officers should not form part of the disclosure when they are unnecessary for the stated purpose and may instead be redacted or otherwise excluded from the personal data disclosed. The same approach applies to personal data of FGen directors or officers. Replacing names with initials or codes is only pseudonymization when the person remains identifiable from position, compensation, or other context. Such data remains subject to the DPA.

Disclosure of committee or board minutes

FGen may disclose personal data in the portions of committee or board minutes that are responsive to the request. It may provide excerpts and redact nonresponsive portions and personal data that is not necessary for the stated purpose. Names, positions, votes, or other identifiers may be retained when necessary to understand the corporate action, quorum, approval, or accountability.

The affected data subjects’ consent is not necessarily required where another lawful basis for personal information or an applicable Section 13 exception for sensitive personal information or privileged information applies. FGen should nevertheless observe applicable data subject rights, including the right to be informed, subject to statutory exceptions, and should document the request, its validation of the requesting persons and the documents covered, the lawful basis relied upon, the necessity and proportionality assessment, the redactions made, the persons given access, and the conditions imposed.

Anonymization, pseudonymization, redaction, and confidentiality undertakings

FGen may use anonymization, pseudonymization, selective redaction, disclosure by excerpt, and access controls to limit the processing to personal data necessary for the lawful purpose. The DPA does not prescribe one fixed or identical set of safeguards for every processing activity. Rather, FGen, as the PIC, must determine and implement the combination of organizational, physical, and technical measures that is reasonable and appropriate under the circumstances.

In determining the appropriate measures, FGen should consider the nature of the personal data, the risks represented by the processing, the size and complexity of its operations, current data privacy best practices, and the cost of implementation. The safeguards selected should be appropriate to the records involved, the manner of inspection, the persons granted access, and the reasonably foreseeable risks, subject to the minimum requirements of the DPA and applicable NPC issuances.11

True anonymization requires that an individual can no longer be identified directly or by combining the information with other data reasonably available. Pseudonymized information remains personal data when reidentification remains possible.

A confidentiality and non-disclosure undertaking is a useful security and organizational safeguard, but it is not sufficient by itself. It does not establish a lawful basis, cure an excessive disclosure, or replace compliance with the general data privacy principles and applicable security requirements. FGen should combine it with reasonable access limits, supervised inspection, restrictions on copying and onward disclosure, inspection logs, secure handling, and appropriate organizational, physical, and technical measures.12

FGen should maintain documentation sufficient to demonstrate compliance and should observe applicable data subject rights, including the right to be informed, subject to the statutory exceptions.13

Accordingly, from a data privacy perspective, the answers to your queries are as follows:

  1. FGen may disclose personal data in the benchmarking or comparative analysis where each personal data field is supported by a lawful basis, necessary, and proportionate. Aggregated, company-level, anonymized, or selectively redacted information should be used when it sufficiently serves the stated purpose. Pseudonymization alone does not remove the information from the DPA when the individuals remain identifiable.

  2. FGen may disclose personal data in the responsive portions of relevant committee or board minutes. It may provide excerpts and redact nonresponsive matters and unnecessary personal data. The DPA does not require automatic redaction of names, positions, or votes that are necessary to understand the corporate action.

  3. FGen may adopt anonymization, pseudonymization, selective redaction, disclosure by excerpt, and access controls to limit processing to what is necessary and proportionate.

  4. A confidentiality and non-disclosure undertaking is not a sufficient safeguard by itself. It is one security and organizational measure, but it does not replace the need for a lawful basis, compliance with transparency, legitimate purpose, and proportionality, or the implementation of appropriate security measures.

Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.

For your reference.

Very truly yours,

REINIER JEFFREY E. ABDON
Director IV, Privacy Policy Office

Footnotes

Footnotes

  1. Tags: stockholder inspection; corporate records; compensation records; directors and officers; personal information; disclosure; proportionality; redaction; confidentiality undertaking ↩

  2. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, §§ 3(g), (h), (i), (l) (2012). ↩

  3. An Act Providing for the Revised Corporation Code of the Philippines [Revised Corporation Code], Republic Act No. 11232, § 73 (2019). ↩

  4. Data Privacy Act of 2012, §§ 11-12. ↩

  5. National Privacy Commission, Re: Right to Inspect Corporate Records Vis-à-Vis the Data Privacy Act of 2012, NPC Advisory Opinion No. 2024-012 (Oct. 16, 2024). ↩

  6. Data Privacy Act of 2012, § 12. See NPC Advisory Opinion No. 2024-012 where the Commission opined that other stockholders need not consent to the inspection under Revised Corporation Code § 73. ↩

  7. Data Privacy Act of 2012, § 13. ↩

  8. Id. § 13(b). ↩

  9. NPC, NPC Advisory Opinion No. 2024-012. ↩

  10. Revised Corporation Code, § 73. ↩

  11. Data Privacy Act of 2012, § 20(a)-(c); National Privacy Commission, Security of Personal Data in the Government and the Private Sector, NPC Circular 2023-06 [NPC Circ. 2023-06], § 6 (Dec. 1, 2023). ↩

  12. Data Privacy Act of 2012, § 20; NPC Circ. 2023-06, § 6. ↩

  13. Data Privacy Act of 2012, § 16(a)-(b); NPC, NPC Advisory Opinion No. 2024-012. ↩

Backlinks

  • No backlinks found