NPC Issuance Wiki

NPC Advisory Opinion No. 2026-009 — Request for Guidance on Barangay Bel-Air Ordinance Requiring CCTV Systems with Audio Recording Capability

Issued Advisory Opinion

Official opinion tags

Source

  • Reference: Advisory Opinion No. 2026-009
  • Official PDF: https://privacy.gov.ph/wp-content/uploads/2026/09/Advisory-Opinion-2026-009-Barangay-Ordinance-on-CCTV_Redacted.pdf
  • Issue date: 21 September 2026
  • Website index date: 09/22/2026
  • Subject: Request for Guidance on Barangay Bel-Air Ordinance Requiring CCTV Systems with Audio Recording Capability
  • OCR used during extraction: no; checked against the rendered PDF
  • Editorial note: The published PDF contains markers 27, 28, and 31–33 without corresponding footnote text. These omissions are identified in the footnotes below. Visible redactions are preserved as [Redacted].

Text

PRIVACY POLICY OFFICE

ADVISORY OPINION NO. 2026-0091

21 September 2026

[Redacted]

Re: Request for Guidance on Barangay Bel-Air Ordinance Requiring CCTV Systems with Audio Recording Capability

Dear [Redacted]

Greetings from the National Privacy Commission!

We write in response to your request for an Advisory Opinion concerning the data privacy implications of [Redacted] Ordinance No. 2025-004, Series of 2025 (Ordinance), which requires covered establishments within [Redacted], Makati City to install closed-circuit television (CCTV) systems and prescribes penalties for violations.2 The Ordinance was reviewed by the Sangguniang Panlungsod ng Makati and declared in conformity with existing laws under City Resolution No. 2026-029 dated 16 February 2026.

We understand that [Redacted] provides guest accommodations and other client-facing services, processes personal data of guests, employees, visitors, and other individuals in its premises, and currently maintains visible CCTV systems for security and incident-response purposes. We further understand that the Hotel’s existing cameras record video only, that CCTV notices are displayed in camera-covered areas, and that recordings are retained for thirty (30) days under the Hotel’s CCTV and retention policies. The Hotel states that its existing system already meets the Ordinance’s storage and resolution specifications, and that its cameras lack only audio capability.

You now seek guidance on the following matters:

  1. whether the requirement for CCTV systems with audio recording capability complies with the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations (IRR), and relevant issuances of the National Privacy Commission (NPC);

  2. whether the Hotel may retain its current thirty (30)-day retention period notwithstanding the Ordinance’s requirement to retain recordings for at least sixty (60) days;

  3. whether the Hotel may provide access to CCTV recordings to law enforcement or other persons under the terms of the Ordinance without violating the DPA; and

  4. whether the Ordinance’s clause requiring a court order to access an establishment’s own CCTV recordings impedes the use of footage for the establishment’s own legitimate purposes.3

An ordinance enjoys the presumption of validity.4 This Advisory Opinion does not pass upon the validity of the Ordinance or determine whether the Hotel is a covered establishment. It addresses how the Hotel, as personal information controller (PIC), may implement the Ordinance consistently with the DPA, its IRR, and NPC issuances.

Threshold matter: coverage under the Ordinance

The Hotel states that hotels are not enumerated in Section 3(a) of the Ordinance, that it may fall under Section 3(b), and that the Barangay communicated by telephone on 20 April 2026 its intention to include condominiums, condotels, and serviced residences. Section 3(c) authorizes the Punong Barangay to expand or contract the list of covered establishments by Executive Order.5 The Commission cannot determine the applicability of the ordinance, but the guidance below assumes that the Hotel is covered.

CCTV systems; audio recording capability; lawful basis and proportionality

CCTV systems that capture images of identifiable individuals involve the processing of personal data. The DPA defines processing broadly to include collection, recording, storage, retrieval, use, disclosure, blocking, erasure, and destruction of personal information.6 NPC Circular No. 2024-02 applies to PICs and personal information processors (PIPs) engaged in the processing of personal data through CCTV systems, subject to the exclusions stated in the Circular.7

The concern is the Ordinance’s requirement for CCTV systems with audio recording capability, and whether compliance with that requirement would expose the Hotel to data privacy and other legal risks. Audio recording is materially more intrusive than ordinary video surveillance because it may capture not only the presence, movement, or conduct of identifiable persons, but also the substance of conversations among guests, employees, visitors, contractors, and other persons within the premises.

NPC Circular No. 2024-02 does not specifically address audio recording, although it defines CCTV in terms of systems that capture both images or other information relating to individuals.8 Audio captured through a CCTV system is nonetheless personal data, and its collection, recording, storage, use, and disclosure are processing governed by the general data privacy principles under the DPA and its IRR, to which the safeguards under the Circular apply. We have previously applied the proportionality principle to audio capture: an audio-enabled CCTV camera focused on an employee’s workstation “may be disproportionate and intrusive on the rights of data subjects,”9 and the automatic recording of telephone calls is disproportionate where the PIC has not shown that its purposes cannot be fulfilled by less intrusive means.10

The DPA and its IRR require personal data processing to be fair and lawful, for a specified and legitimate purpose, adequate and not excessive in relation to that purpose, and retained only for as long as necessary or as otherwise provided by law.11 NPC Circular No. 2024-02 further requires PICs to provide appropriate CCTV notices and to ensure that the use of CCTV systems remains necessary and proportionate to the specified and declared legitimate purpose, with regular review of whether the purpose can reasonably be fulfilled by less intrusive means.12

The Ordinance may be relevant in identifying a lawful basis for the installation and operation of CCTV systems required by a legal obligation. However, the existence of such a requirement does not, by itself, dispense with the Hotel’s obligations under the DPA, its IRR, and NPC issuances. The Hotel remains accountable for ensuring that the processing is transparent, supported by a specified and legitimate purpose, limited to what is necessary and proportionate, secured against unauthorized access or disclosure, and covered by a documented retention and disposal policy.13

But note that the Ordinance requires audio capability, not audio recording. Section 5(e) provides that the camera “should be able to stream both audio and video” as one of 15 minimum technical specifications. The Ordinance’s operative provisions are framed in terms of video: Section 2 mandates a “CCTV or video surveillance system”; Section 5 requires that the system “record such images”; Section 4 governs the “video recording”; Sections 7 and 8 refer to “captured video footage or images”; and Section 6 requires a sticker stating that the establishment is “under video surveillance.”14 Nothing in the Ordinance directs that audio be recorded, retained, or disclosed. Whether the Hotel activates audio recording is therefore a separate processing decision that it must justify independently under the DPA, its IRR, NPC issuances, and other applicable laws.

Nevertheless, installing audio-capable CCTV hardware does not justify enabling audio capture, live listening or streaming, and recording. These capabilities should remain disabled unless the Hotel demonstrates a necessary and proportionate use for the specific function. The Ordinance’s stated purposes of crime prevention, deterrence, and preservation of evidence are ordinarily met by video recording alone. If the Hotel later determines that audio is necessary in a specific area for a specific purpose, that activation is a separate processing activity requiring its own lawful basis, privacy impact assessment (PIA),15 a prominent audio-recording notice, access controls, and retention rules.

NPC Circular No. 2024-02 strictly prohibits the use of CCTV systems in areas where individuals have a heightened expectation of privacy, such as fitting rooms, restrooms, toilets, and lactation or breastfeeding rooms.16 Guest rooms are another obvious addition, and the Hotel should not install or operate CCTV cameras there, much less audio-capable ones. The Ordinance itself does not require otherwise: Section 6 limits the required coverage to areas “where people normally transact business.”17 Separately, even in areas where video surveillance may otherwise be permissible for security, safety, or incident-response purposes, the Hotel should avoid activating audio recording where private communications or spoken words may reasonably be captured. This includes not only enclosed or reserved spaces such as private meeting rooms, private dining rooms, and offices used for confidential discussions, but also common areas such as reception counters, lounges, coffee shops, dining areas, elevator waiting areas, hallways, and similar spaces where guests, employees, visitors, and other persons may discuss guest concerns, transaction details, complaints, employment matters, health or disability-related information, or other matters not intended to be audio-recorded.

Retention period; proportionality; documented retention policy

The Ordinance requires camera recordings to be preserved for at least sixty (60) days, while the Hotel currently retains CCTV recordings for thirty (30) days under its existing policy. Under the DPA and its IRR, personal data must be retained only for as long as necessary for the fulfillment of the purposes for which it was obtained, for the establishment, exercise, or defense of legal claims, for legitimate business purposes, or as provided by law. NPC Circular No. 2024-02 likewise requires CCTV footage to be retained only for as long as necessary to fulfill the purpose for which it was obtained and requires retention periods to be clearly documented and not determined solely by storage capacity.18

An ordinance is law for this purpose.19 If the Ordinance applies to the Hotel, the sixty (60)-day minimum under Section 4 is therefore a retention period provided by law. The Ordinance’s retention requirement does not, however, suspend or displace the Hotel’s obligations under the DPA. Regardless of the retention period applicable, the Hotel must observe purpose limitation and proportionality, uphold the rights of data subjects, and implement appropriate security measures, including secure storage, strict access controls, access logs, and secure deletion or disposal upon expiration of the applicable period. The CCTV Policy should record the sixty (60)-day period and its legal basis, and should provide for secure disposal at its expiry unless a specific incident, legal claim, or a pending access request under Section 8(A) of NPC Circular No. 2024-02 requires longer retention.20

The Hotel may wish to note, in any clarification it seeks from the Barangay, that Section 5, item (j) of the Ordinance refers to storage sufficient to retain footage for forty (40) days, while Section 4 requires preservation for at least sixty (60) days.21 For DPA compliance purposes, the Hotel should document the basis for whatever retention period it adopts, including whether the period is based on its ordinary operational need, a legal requirement under the Ordinance, or a specific incident or legal claim.

Access to recordings; law enforcement, Barangay, and third-party requests

The Hotel also seeks guidance on whether it may provide access to CCTV recordings to law enforcement or other persons under the Ordinance. NPC Circular No. 2024-02 recognizes that CCTV footage may be disclosed in appropriate cases, subject to the lawful processing criteria under the DPA and the safeguards in the Circular.22

On providing access to CCTV recordings, the Ordinance is consistent with what the Circular requires. Section 4 provides that the establishment “shall make available the camera recordings to the authorities engaged in the crime investigation upon written request stating the purpose thereof.” Section 7, which directs the establishment to “immediately contact the police” and “thereafter provide access to the pertinent recordings to the police and other investigators,” must be read with Section 4.23

Upon the occurrence of a crime, the Hotel is obliged under Section 7 of the Ordinance to immediately report the crime to the police. The Hotel should also immediately preserve the footage against automatic deletion, in order to make it available to police and other investigators. But the Hotel should continue to require a written request identifying the requesting officer, the investigation, and the footage sought before allowing viewing or releasing copies. Preserving the CCTV footage and eventually disclosing it to authorities may find basis under Section 12(c) of the DPA as compliance with a legal obligation. In addition, reporting a crime affecting the Hotel’s guests, employees, or premises is a legitimate interest under Section 12(f).24

Section 7 of the Ordinance provides that the CCTV operator “shall thereafter provide access to the pertinent recordings to the police and other investigators.” Such access should be mapped to Section 7(B) of the Circular, as a third-party access request. Disclosure to the police falls under Section 7(B)(1) on disclosure to law enforcement, and under the Circular, the request must have a written statement, affirmative declaration or equivalent establishing lawfulness, and adherence to applicable procedures.

Any disclosure to non-law enforcement “other investigators” does not fall under Section 7(B)(1) of the Circular. A request from a body conducting administrative investigation falls under Section 7(B)(3), while any other request, such as from private investigators, is evaluated under Section 7(B)(5), with greater scrutiny and on a case-to-case basis.

For law enforcement and criminal investigations, PICs and PIPs shall cooperate on the appropriate disclosure of CCTV footage to authorized law enforcement agencies in connection with the latter’s constitutional or statutory functions, such as criminal investigations or case build-up. Law enforcement officers must provide the PIC with a written statement, affirmative declaration, or equivalent to establish the lawfulness of the request, and the request must be made following, and with strict adherence to, existing standard operating procedures in the conduct of the investigation and law enforcement operation.25

Accordingly, the Hotel should verify the identity and authority of the requesting officer or agency, require an appropriate written request or equivalent documentation, determine the specific date, time, location, and purpose of the request, and disclose only the footage that is adequate, relevant, and necessary for the lawful purpose. Where the request is based on a lawful court order, disclosure and use of CCTV footage are allowed, taking into consideration the rules on subpoenas. Where the request is for an administrative investigation, the requesting party should provide sufficient proof of the investigation being conducted or the pending complaint before an administrative body.26

Use of CCTV footage for legitimate internal purposes

Section 4 of the Ordinance provides that “[i]t shall be unlawful to use or view any saved or archived video recording … without the order of a competent court of justice or authority.” The Hotel asks whether this prevents it from using footage for its own legitimate purposes.

Under the DPA, the Hotel, as PIC, may process footage for the specified and legitimate purposes for which it was collected, including premises security, incident response, verification of guest complaints, and investigation of workplace incidents, on the basis of its legitimate interests,27 provided those purposes are declared in its CCTV Policy and privacy notice.28 Neither the DPA nor the Circular conditions a PIC’s access to its own footage for those purposes on a court order.

Whether Section 4 of the Ordinance imposes such a condition is a question which the Commission cannot resolve. We observe however, that Section 8 of the Ordinance penalizes “unauthorized” viewing, which presupposes that some viewing may be authorized by the establishment.29

However, internal use is different from external disclosure. The Hotel should prohibit casual viewing, unnecessary replaying, unauthorized copying, posting, broadcasting, or disclosure of CCTV footage by employees, contractors, or third parties. Access should be limited to personnel whose functions require such access, and all access, reproduction, transfer, disclosure, deletion, and incidents involving CCTV footage should be logged and subject to audit.30 The existence of a legal basis, whether for internal or external use, does not excuse the Hotel from its obligations as a PIC under the DPA and related issuances.

Security measures; accountability

As PIC for CCTV systems under its control, the Hotel remains accountable for the personal data processed through such systems.31 NPC Circular No. 2024-02 requires PICs and PIPs to implement reasonable and appropriate security measures, including privacy by design principles, to protect personal data processed by CCTV systems against accidental, unlawful, or unauthorized use, and to minimize privacy intrusion.32 The same Circular requires policies covering, among others, the legitimate purpose, lawful basis, privacy impact assessments and regular review, CCTV notices, operational details, authorized personnel, access request procedures, breach and incident management, retention, disposal, security measures, audits, and policy updates.33

In sum, we answer the Hotel’s concerns as follows:

  1. On audio capability, the Ordinance requires cameras able to stream audio but it does not direct that audio be recorded. Audio recording should be treated as a separate, heightened-risk processing activity and kept disabled by default. Any audio recording done must have a separately documented lawful basis, for a specific documented purpose, only in a specific area, after a privacy impact assessment, with a public notice clearly indicating audio recording.

  2. On retention, if the Ordinance applies to the Hotel, the sixty (60)-day minimum under Section 4 thereof is a retention period provided by law and should be followed. The Hotel should document the period and its basis, and implement strict access controls, secure storage, access logs, and secure deletion upon expiration.

  3. On access to recordings, the Hotel may immediately report a suspected crime and preserve the relevant footage. Viewing, copying, or release of footage to the police and other investigators should follow a written request stating its purpose. Section 7(B)(1) of NPC Circular No. 2024-02 additionally requires a written statement, affirmative declaration or equivalent establishing lawfulness, and adherence to applicable procedures. Requests from other investigators must be assessed under the applicable category in Section 7(B).

  4. On internal use, the Hotel, as PIC, may process footage for the specified and legitimate purposes for which it was collected, provided those purposes are declared in its CCTV Policy and privacy notice, access is limited to authorized personnel, and access is logged. Whether Section 4 of the Ordinance requires a court order for internal access is a question the Commission cannot resolve. The Hotel may wish to seek written clarification from the Barangay, together with the question of its coverage under Section 3 of the Ordinance.

Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved, or to pass upon the validity, enforceability, or implementation of [Redacted] Ordinance No. 2025-004.

For your reference.

Very truly yours,

(Sgd.)

REINIER JEFFREY E. ABDON
Director IV, Privacy Policy Office

Footnotes

Footnotes

  1. Tags: CCTV systems; audio recording; NPC Circular No. 2024-02; Anti-Wire Tapping Act; barangay ordinance; proportionality; retention period; law enforcement requests; personal information controller ↩

  2. [Redacted], Makati City, An Ordinance Mandating All Establishments Engaged in Business and Operating Within the Territorial Jurisdiction of [Redacted] to Install Closed-Circuit Television System (CCTV) and Prescribing Penalties for Violations Thereof, Barangay Ordinance No. 2025-004, §§ 3-5 (Oct. 13, 2025). ↩

  3. Barangay Ordinance No. 2025-004, §§ 4–5, 7. ↩

  4. [Redacted], G.R. No. 156052 (Feb. 13, 2008), https://elibrary.judiciary.gov.ph/thebookshelf/showdocs/1/44706; see National Privacy Commission, Re: Muntinlupa City Ordinance No. 96-80, NPC Advisory Opinion No. 2018-070, at 2 (Oct. 5, 2018); National Privacy Commission, Re: Barangay Tanyag Ordinance No. 03 “Ordinansang Nag-Aatas sa Lahat ng May-Ari ng Apartment, Bahay-Paupahan, Paupahang Kuwarto at Lahat ng Uri ng Paupahan para sa Paninirahang Pang-Indibidwal, Pampamilya at Pangkomersyal na Iparehistro sa Tanggapan ng Barangay Tanyag ang Lahat ng Naninirahan sa Kanilang Paupahan at ang Pagtatakda ng Kaukulang Multa sa Lalabag Dito”, NPC Advisory Opinion No. 2018-075, at 2 (Nov. 8, 2018). ↩

  5. Barangay Ordinance No. 2025-004, § 3, ¶ c. ↩

  6. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, § 3, ¶ j (2012). ↩

  7. National Privacy Commission, Closed-Circuit Television (CCTV) Systems, NPC Circular No. 2024-02 [NPC Circ. 2024-02], § 1 (Aug. 9, 2024). ↩

  8. NPC Circ. 2024-02, § 2, ¶ B. ↩

  9. National Privacy Commission, Installation of Closed-Circuit Television (CCTV) in Local Government Unit Offices, NPC Advisory Opinion No. 2025-016, at 3 (Dec. 26, 2025). ↩

  10. National Privacy Commission, Recording of Telephone Conversation Through Voice Over Internet Protocol (VoIP) System, NPC Advisory Opinion No. 2023-010, at 5 (Feb. 15, 2023). ↩

  11. Data Privacy Act of 2012, § 11; Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, §§ 18-19 (2016). ↩

  12. NPC Circ. 2024-02, § 3, ¶¶ A, C. ↩

  13. Data Privacy Act of 2012, §§ 11, 20–21; Rules and Regulations Implementing the Data Privacy Act of 2012, §§ 18–19, 25–28; NPC Circ. 2024-02, § 5, ¶¶ A–B. ↩

  14. Barangay Ordinance No. 2025-004, §§ 2, 4–8. ↩

  15. NPC Circ. 2024-02, § 5, ¶ A(3); National Privacy Commission, Guidelines on Privacy Impact Assessments, NPC Advisory No. 2017-03, at 4–5 (July 31, 2017). ↩

  16. NPC Circ. 2024-02, § 5, ¶ B(1)(c). ↩

  17. Barangay Ordinance No. 2025-004, § 6. ↩

  18. Data Privacy Act of 2012, § 11, ¶ e; Rules and Regulations Implementing the Data Privacy Act of 2012, § 19, ¶ d; NPC Circ. 2024-02, § 5, ¶ B(4). ↩

  19. National Privacy Commission, Re: Data Sharing Agreement Between Government Agencies, NPC Advisory Opinion No. 2017-028, at 3 (June 23, 2017) (explaining that “law” under the DPA includes ordinances passed by the sanggunian of local government units); NPC, NPC Advisory Opinion No. 2018-070, at 2 (recognizing an ordinance as a legal basis for processing, subject to compliance with the DPA). ↩

  20. Data Privacy Act of 2012, §§ 11, 20–21; Rules and Regulations Implementing the Data Privacy Act of 2012, §§ 18–19, 25–28; NPC Circ. 2024-02, § 5, ¶¶ A(8), B(3)–(4); National Privacy Commission, Security of Personal Data in the Government and the Private Sector, NPC Circular No. 2023-06 [NPC Circ. 2023-06], §§ 9, 13, 28–30 (Dec. 1, 2023). ↩

  21. Barangay Ordinance No. 2025-004, § 4, § 5, ¶ j. ↩

  22. NPC Circ. 2024-02, § 7, ¶ B. ↩

  23. Barangay Ordinance No. 2025-004, §§ 4, 7. ↩

  24. Data Privacy Act of 2012, § 12, ¶¶ c, f; National Privacy Commission, Guidelines on Legitimate Interest, NPC Circular No. 2023-07 [NPC Circ. 2023-07], §§ 4–8 (Dec. 13, 2023). ↩

  25. NPC Circ. 2024-02, § 7, ¶ B(1)(a)-(b). ↩

  26. Id. § 7, ¶ B(2)-(3). ↩

  27. [Editorial note: Footnote marker 27 appears in the published PDF, but its corresponding footnote text is absent.] ↩

  28. [Editorial note: Footnote marker 28 appears in the published PDF, but its corresponding footnote text is absent.] ↩

  29. Barangay Ordinance No. 2025-004, §§ 4, 8. ↩

  30. Data Privacy Act of 2012, § 21; NPC Circ. 2024-02, § 5, ¶¶ A(6), A(9)–(10), B(3)(b)–(c); NPC Circ. 2023-06, §§ 13, 29. ↩

  31. [Editorial note: Footnote marker 31 appears in the published PDF, but its corresponding footnote text is absent.] ↩

  32. [Editorial note: Footnote marker 32 appears in the published PDF, but its corresponding footnote text is absent.] ↩

  33. [Editorial note: Footnote marker 33 appears in the published PDF, but its corresponding footnote text is absent.] ↩

Backlinks

  • No backlinks found