NPC Issuance Wiki

NPC Advisory Opinion No. 2026-008 — Eligibility for Participation in the APEC CBPR System and Compliance with LGU Health Permit Requirements Involving Employee Personal Data

Issued Advisory Opinion

Official opinion tags

Source

Text

PRIVACY POLICY OFFICE

ADVISORY OPINION NO. 2026-0081

09 September 2026

[Redacted]

Re: Eligibility for Participation in the APEC CBPR System and Compliance with LGU Health Permit Requirements Involving Employee Personal Data

Dear Mr. [Redacted],

We write in response to your request for an Advisory Opinion as you seek guidance on the eligibility for participation in the APEC CBPR System and compliance with LGU health permit requirements involving employee personal data.

We understand that your organization operates within a multinational corporate structure, where:

  1. The ultimate parent entity is incorporated outside the Philippines, i.e., [Redacted];

  2. A Philippine branch, [Redacted] Philippine Branch, is duly registered and operates locally;

  3. The Philippine entity functions as a Personal Information Controller (PIC) and/or Personal Information Processor (PIP) under Republic Act No. 10173 (Data Privacy Act of 2012 or DPA);

  4. Processing activities include cross-border transfers of personal data to parent and affiliate entities;

  5. At the same time, the Philippine entity is subject to local government unit (LGU) regulatory requirements, including business permit and sanitary permit compliance requirements in Muntinlupa City.

In your letter, to ensure alignment and compliance with the Philippine data privacy laws and NPC issuances and clarify the use of CBPR as a cross-border compliance mechanism, you raised the following inquiries:

I. CBPR ELIGIBILITY AND APPLICATION SCOPE

A. Eligibility of Philippine-Registered Organizations.

Whether an organization may apply for APEC Cross-Border Privacy Rules (CBPR) certification if:

  • It is legally established and operating in the Philippines;
  • It is subject to the Data Privacy Act of 2012;
  • It engages in cross-border personal data processing; and
  • Notwithstanding that its parent entity or ultimate controlling organization is located outside the Philippines

The DPA applies to [Redacted] by reason of its Philippine branch. Section 4 of the law reads:

Scope. – This Act applies to the processing of all types of personal information and to any natural and juridical person involved in personal information processing including those personal information controllers and processors who, although not found or established in the Philippines, use equipment that are located in the Philippines, or those who maintain an office, branch or agency in the Philippines subject to the immediately succeeding paragraph: Provided, That the requirements of Section 5 [sic] are complied with. (underscoring supplied)2

Philippine data privacy law contemplates and accommodates multinational organizational structures, and its coverage extends broadly to all types of personal information and to any natural or juridical person involved in personal information processing, subject to its jurisdictional requirements. An organization that falls under Section 4 remains fully subject to the DPA, regardless of the nationality or location of its parent.

In relation to the APEC CBPR System (“System”), a Philippine-registered organization, as of this writing, cannot apply for domestic certification, as the Philippines does not yet have a recognized Accountability Agent under the System. Under the APEC CBPR Policies, Rules and Guidelines, an applicant is expected to use an Accountability Agent in the economy in which it is primarily located,3 or another economy’s Accountability Agent only where its own economy has so arranged.4 The Philippines has not made the arrangement contemplated under the System.

B. Eligibility of Philippine Subsidiaries of Multinational Corporations

In the case of multinational organizations [Redacted], whether a Philippine subsidiary [Redacted] may:

  • Submit a CBPR application independently, covering its Philippine operations;
  • Be recognized as a certifiable applicant entity under the CBPR system; or
  • Participate as part of a group-wide certification led by the parent entity.

At the outset, it appears that [Redacted] Philippine Branch is a branch, rather than a separately incorporated subsidiary. A branch has no juridical personality separate from its head office.5 [Redacted] is therefore the entity accountable under Section 21 for all personal data processed through its Philippine branch. The head office complies with the DPA in the Philippines through its branch, including registration and the designation of its Data Protection Officer. Personal data transfers between the branch and the head office do not constitute data sharing6 as they are “one and the same entity.”7

Neither the DPA nor the Commission prevents such an entity from participating in the APEC CBPR System. Participation is governed by the System’s rules and eligibility requirements, and currently the System’s rules do not prescribe the corporate form of the applicant. But as discussed above, the System’s rules provide that generally, an applicant is expected to use an Accountability Agent in the economy in which it is primarily located.

India is not a participating economy in the APEC CBPR System; thus, the parent company, [Redacted], may also not be the proper entity to pursue certification covering its affiliates and subsidiaries. The practical route may be participation in a certification led by another, third affiliate, in neither the Philippines nor India, that is primarily located in an economy with a recognized Accountability Agent. Bear in mind that the scope of such a certification, such as whether it covers Philippine operations, is a matter for the evaluation of that particular Accountability Agent.

Finally, depending on the actual nature of its processing activities and its relationship with the relevant personal information, the Philippine branch may be classified as a PIC or PIP. While an organization providing business process outsourcing (BPO) may act as a PIP where it processes personal data on behalf of and under the instructions of a PIC, it may also be considered a PIC with respect to processing activities for which it determines the purposes and means of processing. The characterization as a PIC or a PIP matters because, should the entity act as a PIP, APEC CBPR will not directly apply to the organization. Instead, the APEC Privacy Recognition for Processors (PRP) may be the relevant framework.

C. Scope and Coverage of Certification

Whether CBPR certification may apply under any of the following models:

  • Limited to Philippine-based processing activities;
  • At the level of the Philippine legal entity;
  • Covering cross-border intra-group data transfers; or
  • Across multi-jurisdictional corporate group operations.

The scope of CBPR certification is determined under the rules of the APEC CBPR System as applied by the particular Accountability Agent certifying the organization. The Commission is not in a position to provide an opinion on whether CBPR certification may apply under any of the enumerated models. We recommend that you direct this query to the particular Accountability Agent from which you plan to seek certification, as it would be in the best position to answer.

D. Regulatory Recognition in the Philippine Context

Whether CBPR certification is recognized as a valid safeguard or supporting mechanism for cross-border data transfers under Philippine data privacy regulations.

The APEC Privacy Framework (“Framework”) describes the CBPR System as a “practical mechanism for participating economies to implement the APEC Privacy Framework in an international, cross-border context.”8 Paragraph 32 of the Framework states that, on transfer, a PIC should obtain the individual’s consent or “exercise due diligence and take reasonable steps to ensure that the recipient person or organization will protect the information consistently with these Principles.”9

The accountability provisions under the Framework correspond to Section 21(a) of the DPA, which makes a PIC “accountable for complying with the requirements of this Act” and requires it to “use contractual or other reasonable means to provide a comparable level of protection while the information [is] being processed by a third party.”10 (emphasis supplied).

With this context in mind, although no NPC issuance specifically recognizes APEC CBPR Certification as one of the means of fulfilling the accountability obligation under the DPA, the APEC CBPR System, by design, implements a broadly similar accountability principle. Obtaining the certification serves as evidence that an organization has adopted internationally recognized privacy governance standards. Of course, certification does not create a presumption of compliance with the DPA. The PIC must still ensure that it observes and implements the provisions of the DPA, its Implementing Rules and Regulations (IRR), and NPC issuances. In other words, CBPR certification complements—but does not replace—the obligations imposed by the DPA.

II. LGU HEALTH CERTIFICATE REQUIREMENTS FOR ISSUANCE OF SANITARY PERMIT AND DATA PRIVACY COMPLIANCE

You have stated that as part of obtaining a Sanitary Permit for your establishment, employees are required to acquire a Health Certificate ID under Presidential Decree No. 856 and local regulations. In connection with this, employees may be required to submit:

  • Laboratory test results (e.g., X-ray, fecalysis, urinalysis);
  • Community Tax Certificate (Cedula);
  • Completed health or occupational permit application forms.

These documents may contain personal data and sensitive personal information, including health data and government-issued ID numbers.

Hence, you seek the NPC’s guidance on the following:

Lawful Basis for Processing

Whether the collection and submission of such employee data:

  • May be justified under legal obligation or compliance with a regulatory requirement imposed by an LGU;
  • Requires additional safeguards if processing involves sensitive personal information (health data).

The Commission has addressed the processing of employee personal data pursuant to a city ordinance in Advisory Opinion No. 2018-070, where it opined that an ordinance requiring employers to collect and submit employee data authorizes the processing of personal data, subject to the principles of transparency, legitimate purpose, and proportionality.11 The specific legal bases are:

Section 12(c) of the DPA, which states:

SEC. 12. Criteria for Lawful Processing of Personal Information. – The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists:

…

(c) The processing is necessary for compliance with a legal obligation to which the personal information controller is subject;12

Section 13(b) of the DPA, which states:

SEC. 13. Sensitive Personal Information and Privileged Information. – The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases:

…

(b) The processing of the same is provided for by existing laws and regulations: Provided, That such regulatory enactments guarantee the protection of the sensitive personal information and the privileged information: Provided, further, That the consent of the data subjects are not required by law or regulation permitting the processing of the sensitive personal information or the privileged information;13

The applicable provision thus depends on whether the processed personal data is plain personal information or sensitive personal information. You mentioned that employees are required to submit laboratory test results for medical examinations, which are health data that fall under the category of sensitive personal information. Likewise, a community tax certificate is also sensitive personal information.14 Section 13(b) is therefore applicable.

When sensitive personal information is processed pursuant to Section 13(b), it is insufficient that a law or regulation merely requires or contemplates the processing. The law or regulation must likewise guarantee the protection of the sensitive personal information concerned. In Philippine Stock Exchange, Inc. v. Secretary of Finance,15 the Supreme Court was categorical: “it must be the subject issuance itself” that provides the guarantee, and safeguards found in other laws or issuances do not satisfy the proviso. As the request does not identify the particular local ordinance or regulation being relied upon, we make no determination as to whether any specific Muntinlupa City ordinance satisfies this requirement.

If the applicable regulation does not satisfy the requirements of Section 13(b), you must identify another applicable lawful basis under Section 13; otherwise, you should refuse to process the sensitive personal information. Of course, processing founded on a lawful basis remains subject to the general data privacy principles of transparency, legitimate purpose, and proportionality.

You also ask whether additional safeguards are required because the processing involves sensitive personal information. The nature of the personal data to be protected is an express consideration under Section 20(c) of the DPA, Section 29 of its IRR, and NPC Circular No. 2023-06.16 Health data, by its sensitivity and potential for harm, warrants such heightened safeguards.

Role of the Employer

Whether the employer:

  • Acts as a Personal Information Controller (PIC) when collecting and submitting such employee data; or
  • Acts as a Personal Information Processor (PIP) on behalf of the LGU or another authority.

In the circumstances described, the employer is a PIC with respect to the collection, use, storage, and submission of employee information. As the Commission opined in Advisory Opinion No. 2023-027, rendered on your organization’s earlier request, “[c]ontrol over personal data exists when an individual or entity has the authority to determine the kind of information gathered, its intended use, or the scope of data processing.”17 The employer determines which employee information is collected, the purpose (i.e., compliance with sanitation and labor regulations), and the means of collection and transmission. It is therefore a PIC.

While the submission of employee information to the local government unit (LGU) is required by law, this requirement does not necessarily convert the employer into a PIP. A PIP merely processes personal information on behalf of another PIC and does not determine the purposes and essential means of processing. With that said, the LGU likewise acts as a separate PIC with respect to the personal information it receives and processes in the exercise of its regulatory authority.

Proportionality and Data Minimization

Whether requiring the full laboratory results and supporting documents from employees complies with the principles under the Data Privacy Act of 2012.

The employer should carefully assess whether requiring employees to submit complete laboratory reports is necessary. Consistent with the principles of proportionality and data minimization under the DPA, employers should collect only the information necessary to satisfy the applicable legal requirement.

Accordingly, if the LGU merely requires proof that an employee passed the required examination, collecting the complete laboratory report may exceed what is necessary. If the employer has an applicable lawful basis under Section 13 and the collection satisfies the conditions discussed above, it should only collect those reports necessary to meet the applicable requirement.

To better understand the extent of the collection and purpose of the health data, we highly recommend that the PIC connect with the LGU’s DPO and Health Officer to determine what constitutes substantial compliance with the applicable requirements, including the extent of laboratory results and other health data that must be submitted.

Employers should not collect additional medical information that bears no relation to the issuance of the health certificate.

Clarification on Which Party Is Responsible for Ensuring Appropriate Safeguards

  • Employer;
  • LGU; or
  • Both, depending on the stage of processing.

Responsibility for safeguarding the personal information depends on the stage of processing. The employer remains responsible for implementing appropriate safeguards while collecting, storing, using, transmitting, and retaining employee information under its control.

Where the laboratory results or other health data are collected solely to comply with the LGU’s requirements and are submitted to the LGU, the LGU assumes responsibility as a PIC for the personal information in its custody and is independently obligated to ensure that the information is protected and processed only for the specific and lawful purposes for which it was obtained, in accordance with the DPA.

However, if the employer retains copies of the laboratory results or other health data after submission to the LGU, it continues to be responsible, as a PIC, for safeguarding the personal information it retains and ensuring that such information is processed only for legitimate purposes and in compliance with the DPA.

Therefore, responsibility is shared, with each PIC accountable for the personal information under its respective control.

Cross-Border Data Implications

Where employee data may be processed or stored by systems outside the Philippines (e.g., IT systems hosted in parent entity locations), whether additional safeguards or restrictions apply.

Where employee personal data is processed or stored using information systems located outside the Philippines (such as IT infrastructure hosted by a parent entity or third-party service providers abroad), the employer remains fully responsible for ensuring continued compliance with the DPA.

Cross-border processing is not prohibited under Philippine law, but the processing remains subject to the same data protection obligations that apply to domestic processing. The employer must ensure that appropriate organizational, physical, and technical safeguards are implemented and maintained, consistent with the requirements of the DPA, its IRR, and NPC issuances, notably NPC Circular No. 2023-06. Furthermore, when data is transferred to a third party, the employer shall use contractual or other reasonable means to provide a comparable level of protection under Section 21(a) of the DPA. The instruments through which a PIC satisfies its accountability obligations under Section 21(a) depend on the relationship with the overseas entity.

Where the parent or an affiliate processes the data on your instructions, as is typical of shared IT infrastructure, the relationship is one of outsourcing and must be governed by a contract meeting Section 44 of the IRR, which requires, among other terms, the geographic location of the processing and documented instructions covering any transfer to another country.18 Where the parent or an affiliate processes the data for its own purposes, the relationship is one of data sharing between controllers and may be governed, as evidence of accountability, by a data sharing agreement under NPC Circular No. 2020-03, which extends each party’s accountability to personal data transferred outside the Philippines.19 In either case, the Commission has issued guidance on model contractual clauses that may be adopted to provide the comparable level of protection required by Section 21(a).20 Third-party certification, including CBPR certification, may serve as further evidence of accountability, as discussed in Part I.D. Finally, transfers between a parent and an unincorporated branch in the Philippines, as discussed in Part I.B., are not subject to the requirement in Section 21(a), as any data transfer between the branch and its head office is not a transfer to a third party as contemplated by law.

Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.

For your reference.

Very truly yours,

REINIER JEFFREY E. ABDON
Director IV, Privacy Policy Office

Footnotes

Footnotes

  1. Tags: CBPR Compliance; Certification; Personal Information; Sensitive Personal Information; Health Data. ↩

  2. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, § 4 (2012). ↩

  3. Asia-Pacific Economic Cooperation, APEC Cross-Border Privacy Rules System: Policies, Rules and Guidelines, ¶ 38, available at https://www.apec.org/docs/default-source/Groups/ECSG/CBPR/CBPR-PoliciesRulesGuidelines.pdf (last accessed Sep. 8, 2026). ↩

  4. Id. ¶ 31. ↩

  5. Philippine Deposit Insurance Corporation v. Citibank, N.A., G.R. No. 170290 (Apr. 11, 2012), https://elibrary.judiciary.gov.ph/thebookshelf/showdocs/1/54679. ↩

  6. National Privacy Commission, Data Sharing Agreements, NPC Circular No. 2020-03 [NPC Circ. 2020-03], § 2(F) (Dec. 23, 2020). “Data sharing” is the sharing, disclosure, or transfer to a third party of personal data under the custody of a personal information controller to one or more other personal information controller/s.” (emphasis supplied). ↩

  7. Philippine Deposit Insurance Corporation v. Citibank, N.A., G.R. No. 170290 (Apr. 11, 2012), https://elibrary.judiciary.gov.ph/thebookshelf/showdocs/1/54679. ↩

  8. Asia-Pacific Economic Cooperation, APEC Privacy Framework (2015), ¶ 67 (Aug. 2017), available at https://apec.org/docs/default-source/Publications/2017/8/APEC-Privacy-Framework-%282015%29/217_ECSG_2015-APEC-Privacy-Framework.pdf (last accessed Sep. 8, 2026). ↩

  9. Id. ¶ 32. ↩

  10. Data Privacy Act of 2012, § 21(a). ↩

  11. National Privacy Commission, Muntinlupa City Ordinance No. 96-80, NPC Advisory Opinion No. 2018-070, at 1–3 (Oct. 5, 2018). ↩

  12. Data Privacy Act of 2012, § 12(c). ↩

  13. Id. § 13(b). ↩

  14. National Privacy Commission, Pasig City Ordinance No. 51, NPC Advisory Opinion No. 2018-041, at 2 (Aug. 9, 2018). ↩

  15. Philippine Stock Exchange, Inc. v. Secretary of Finance, G.R. No. 213860 (July 5, 2022), https://elibrary.judiciary.gov.ph/thebookshelf/showdocs/1/68497. ↩

  16. Data Privacy Act of 2012, § 20(c); Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 29 (2016); National Privacy Commission, Security of Personal Data in the Government and the Private Sector, NPC Circular No. 2023-06 [NPC Circ. 2023-06], § 6 (Dec. 1, 2023). ↩

  17. National Privacy Commission, Employer’s Data Privacy Obligations Concerning Its Financial Services Benefit to Its Employees, NPC Advisory Opinion No. 2023-027, at 2 (Dec. 29, 2023). ↩

  18. Rules and Regulations Implementing the Data Privacy Act of 2012, § 44(a)–(b); see also National Privacy Commission, Outsourcing Agreement, NPC Advisory Opinion No. 2018-057, at 1–2 (Sep. 20, 2018). ↩

  19. NPC Circ. 2020-03, §§ 8, 12. ↩

  20. See National Privacy Commission, Guidance for the Use of the ASEAN Model Contract Clauses and ASEAN Data Management Framework, NPC Advisory No. 2021-02, §§ 3, 5(A)(2) (June 28, 2021); National Privacy Commission, Model Contractual Clauses for Cross-Border Transfers of Personal Data, NPC Advisory No. 2024-01, §§ 3, 6(A) (May 30, 2024). ↩

Backlinks

  • No backlinks found