NPC Issuance Wiki

NPC Advisory Opinion No. 2026-007 — Disclosure of Personal Data in Retirement Benefit, Tax-Related, and Compensation Records Subject to Stockholder Inspection

Issued Advisory Opinion

Official opinion tags

Source

Text

PRIVACY POLICY OFFICE

ADVISORY OPINION NO. 2026-0071

25 August 2026

[Redacted]

Attention: [Redacted]

Re: DISCLOSURE OF PERSONAL DATA IN RETIREMENT BENEFIT, TAX- RELATED, AND COMPENSATION RECORDS SUBJECT TO STOCKHOLDER INSPECTION

Dear Counsels,

Greetings from the National Privacy Commission!

This pertains to your request, on behalf of First Philippine Holdings Corporation (FPH), for an Advisory Opinion concerning two written requests from certain stockholders to inspect and obtain copies or excerpts of corporate records. The first request concerns records relating to the Retirement and Other Employee Benefits reflected in FPH’s 2023 financial statements. The second request concerns records relating to the top seven most highly compensated directors or officers of FPH.

Based on your letter, the first request covers governance approvals, contributions, valuations, disbursements, payees, recipients or beneficiaries, commercial rationale, accounting treatment, audit review, regulatory compliance, tax withholdings, and reporting obligations relating to the retirement fund. The second request covers compensation policies, guidelines, committee charters, internal documents, benchmarking or comparative analysis, job descriptions, reporting lines, and minutes of the relevant committee or Board of Directors approving the compensation packages of the covered officers.

You state that the stockholders seek to ensure transparency, verify the accuracy and management of the retirement fund, assess its financial impact, evaluate the reasonableness of compensation and compliance with governance requirements, and exercise stockholder rights relating to corporate oversight and future stockholders’ meetings.

For purposes of this Advisory Opinion, the Commission proceeds solely from the facts stated in the request and attachments and treats FPH as the personal information controller of the requested corporate records. The discussion below is limited to the requirements of the Data Privacy Act of 2012 (DPA) and does not determine whether any requested record must or may be disclosed under other applicable laws. Because the records were not submitted with the request, the Commission cannot classify each data field or determine its necessity in the abstract.

You ask whether FPH may disclose the identities and related personal data of retirement fund beneficiaries, payees, and recipients; tax payments and tax returns filed with the Bureau of Internal Revenue; benchmarking analysis; and compensation-related minutes. You also ask whether FPH may use anonymization, pseudonymization, or selective redaction, and whether a confidentiality and non-disclosure undertaking is sufficient to permit complete and unconditional inspection.

Corporate inspection rights and privacy obligations

The DPA applies when corporate records contain personal data of natural persons.2 The Revised Corporation Code recognizes the right of stockholders to inspect corporate records and demand copies or excerpts, but expressly provides that the inspecting or reproducing party remains bound by confidentiality rules under prevailing laws, including the DPA.3

The stockholder inspection right and the DPA must be harmonized. Where FPH determines that an inspection demand is valid under applicable corporate law, it may act on the demand but remains responsible for ensuring that the disclosure is transparent, serves a legitimate purpose, and is proportionate to that purpose.4 The Commission has recognized that the DPA cannot be invoked to curtail existing stockholder inspection rights when the inspection complies with prevailing laws and regulations. It has likewise recognized that a corporation may limit the scope of inspection or redact information that is not relevant to the request.5

For personal information, disclosure may be based on compliance with a legal obligation under Section 12(c) of the DPA. Section 12(f) may also apply when the requirements for legitimate interest are satisfied.6 For sensitive personal information, Section 13(b) applies only when an existing law or regulation provides for the particular processing, guarantees the protection of the sensitive personal information or privileged information, and does not require consent of the data subject.7 In Advisory Opinion No. 2024-012, the Commission recognized that Section 73 of the Revised Corporation Code of the Philippines (RCC) may serve as the existing law contemplated by Sections 12(c) and 13(b).8 In particular, the second paragraph of Section 739 supplies the required protection by binding the inspecting or reproducing party to confidentiality rules under prevailing laws, including the DPA, and not requiring the consent of the affected data subjects.

The existence of an applicable lawful basis does not, by itself, determine the extent of personal data that may be disclosed. It remains for FPH, as the personal information controller, to determine what personal data may be disclosed in relation to the stockholders’ stated purpose, consistent with the principles of transparency, legitimate purpose, and proportionality.

Retirement fund beneficiaries, payees, and recipients

Information that identifies a beneficiary, payee, recipient, or ultimate beneficial recipient is personal information. Age, marital status, and tax returns relating to a natural person are sensitive personal information under Section 3(l).10 Tax identification numbers, being identifiers issued by a government agency peculiar to an individual, likewise fall within Section 3(l)(3). Sex or gender, while not enumerated as sensitive personal information under the DPA, remains personal information and is subject to the same minimum necessary disclosure standard.

FPH may disclose an identity only when it is responsive and necessary to the stated inspection purpose, such as evaluating a specific related-party transaction, conflict-of-interest concern, or corporate governance issue. When the purpose can be achieved without identifying an individual, FPH should instead provide aggregate amounts, transaction categories, truly anonymized information, or redacted copies. If coding or pseudonymization is used, the information remains personal data and the reidentification key should be separately secured.

Even when an identity must be disclosed, FPH should disclose only the minimum personal data necessary and withhold unrelated details, including birthdates, home addresses, full tax identification numbers, bank account details, family information, and other data that do not materially assist the inspection.11 FPH, as the personal information controller, has to determine when and which of these details may be disclosed in relation to the stockholders’ stated purpose. In applying this assessment to the requested records, FPH should also take into account the general data privacy principles and the rights of affected data subjects. Where disclosure of specific personal data is withheld or limited on data privacy grounds, FPH should communicate the basis for such limitation to the requesting stockholders in appropriate terms.

Tax payments, tax returns, and information filed with the Bureau of Internal Revenue

The request may include proof of tax filings, withholdings, or remittances relating to retirement payments. This Advisory Opinion addresses only compliance with the DPA. It does not determine whether the National Internal Revenue Code or other tax laws permit or prohibit the disclosure of a particular tax return, filing, or document, and it does not adjudicate the validity of the stockholders’ demand for those records.12

From the standpoint of the DPA, FPH may disclose tax-related personal data only when an applicable lawful basis exists—for sensitive personal information such as tax returns, an exception under Section 13—and only to the minimum extent necessary. For records relating to natural persons, FPH should prefer certifications, summaries, redacted copies, masked tax identification numbers, or confirmation that withholding and remittance obligations were performed, when these alternatives sufficiently address the purpose. A full and unredacted tax return should not be disclosed merely because it was requested or because a confidentiality undertaking was executed. Any disclosure must also comply with applicable tax confidentiality rules.

FPH may disclose benchmarking or comparative analysis relating to compensation to the extent that the record is properly subject to inspection and the personal data in it is necessary, lawful, and proportionate. When industry-level, company-level, role-level, or aggregate information is sufficient, FPH should redact or anonymize the identities and individualized data of FPH personnel, comparator-company officers, and other individuals.

FPH may likewise disclose the relevant portions of committee or board minutes approving compensation packages. It may provide excerpts and redact unrelated matters and personal data, including sensitive personal information and privileged information that are not necessary for the stated purpose. The presence of personal data in a corporate record does not by itself make every data element necessary for disclosure.

Anonymization, pseudonymization, redaction, and confidentiality undertakings

FPH may use true anonymization, pseudonymization or coding, selective redaction, and disclosure by excerpt when these measures preserve the substance needed for inspection while limiting unnecessary exposure of personal data. Pseudonymized or coded information remains personal data and continues to be subject to the DPA.

A confidentiality and non-disclosure undertaking may serve as an organizational safeguard, but it is not sufficient, by itself, to establish compliance with the DPA for complete, unlimited, and unconditional inspection. It does not constitute a lawful basis for disclosure or replace compliance with the general data privacy principles and applicable security requirements. FPH should assess the contemplated inspection or disclosure against NPC Circular No. 2023-06 and determine which reasonable and appropriate organizational, physical, and technical measures are applicable to the processing, taking into account its nature and attendant risks.13

FPH should maintain documentation sufficient to demonstrate compliance and should observe applicable data subject rights, including the right to be informed, subject to the statutory exceptions.14

Accordingly, from a data privacy perspective, the answers to your queries are as follows:

  1. Disclosure of the identities of retirement fund beneficiaries, payees, or recipients may be permissible only when identification is necessary, lawful, and proportionate to a legitimate inspection purpose. Birthdates, marital status, tax identification numbers, and other details should be withheld unless independently necessary. Less intrusive disclosure should be preferred when sufficient.

  2. Disclosure of tax-related personal data may be permissible only when an applicable lawful basis exists and only to the minimum extent necessary. The Commission does not determine whether disclosure is permitted or required under the National Internal Revenue Code or other tax laws. Full tax returns, full tax identification numbers, and unrelated individual tax details should not be disclosed as a matter of course.

  3. Disclosure of benchmarking or comparative analysis relating to director or officer compensation may be permissible, provided that FPH redacts or anonymizes personal data that is not necessary to assess the reasonableness of compensation.

  4. Disclosure of relevant portions of committee or board minutes approving compensation packages may be permissible, provided the records are otherwise properly subject to inspection under applicable corporate law. FPH may provide excerpts and redact unrelated matters and unnecessary personal data, including sensitive personal information and privileged information.

  5. FPH may use anonymization, pseudonymization or coding, selective redaction, and disclosure by excerpt as data privacy safeguards, provided that the information remains sufficient for the legitimate inspection purpose. Pseudonymized or coded information must remain protected as personal data.

  6. A confidentiality and non-disclosure undertaking is not sufficient, by itself, to establish compliance with the DPA for complete, unlimited, and unconditional inspection. It may serve as an organizational safeguard, but FPH must still determine the applicable lawful basis, observe the general data privacy principles, and assess the contemplated processing under NPC Circular No. 2023-06 to determine the reasonable and appropriate security measures applicable thereto. This conclusion does not determine whether other applicable laws require, permit, or limit access to the requested records.

Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.

For your reference.

Very truly yours,

REINIER JEFFREY E. ABDON
Director IV, Privacy Policy Office

Footnotes

Footnotes

  1. Tags: stockholder inspection; corporate records; retirement benefit records; tax-related records; compensation records; sensitive personal information; disclosure; proportionality; redaction; confidentiality undertaking ↩

  2. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, §§ 3(g), 3(j), 3(l), 4 (2012). ↩

  3. An Act Providing for the Revised Corporation Code of the Philippines [Revised Corporation Code], Republic Act No. 11232, § 73 (2019). ↩

  4. Data Privacy Act of 2012, § 11. ↩

  5. National Privacy Commission, Re: Right to Inspect Corporate Records Vis-à-Vis the Data Privacy Act of 2012, NPC Advisory Opinion No. 2024-012 (Oct. 16, 2024). ↩

  6. Data Privacy Act of 2012, § 12(c), (f). ↩

  7. Id. § 13(b). ↩

  8. NPC, NPC Advisory Opinion No. 2024-012. ↩

  9. Revised Corporation Code, § 73. ↩

  10. Data Privacy Act of 2012, § 3(l). ↩

  11. Id. § 11. ↩

  12. Cf. National Privacy Commission, Publication of the Full Content of Bureau of Internal Revenue Rulings in the BIR Website, NPC Advisory Opinion No. 2020-002 (Feb. 6, 2020). ↩

  13. Data Privacy Act of 2012, § 20; National Privacy Commission, Security of Personal Data in the Government and the Private Sector, NPC Circular 2023-06 [NPC Circ. 2023-06], § 6 (Dec. 1, 2023). ↩

  14. Data Privacy Act of 2012, § 16(a)-(b); NPC, NPC Advisory Opinion No. 2024-012. ↩

Backlinks

  • No backlinks found