Issuance Text
NPC Advisory No. 2025-01
DATE: 26 June 2025
SUBJECT: CLARIFICATION ON CERTAIN PROVISIONS OF NPC CIRCULAR NO. 2020-03 ON DATA SHARING AGREEMENTS
WHEREAS, the National Privacy Commission (NPC) issued NPC Circular No. 2020-03 on Data Sharing Agreements in 2020, amending NPC Circular 16-02 on Data Sharing Agreements Involving Government Agencies and the pertinent provisions of the Rules and Regulations (IRR) implementing the Data Privacy Act of 2012 (DPA);
WHEREAS, Sections 6 and 7 of NPC Circular No. 2020-03 state that data sharing may be based on any of the criteria for lawful processing of personal data in Sections 12 and 13 of the DPA and may also be allowed under the special cases provided in Section 4 of the DPA, distinguishing it from the DPA’s IRR which required the consent of data subjects for data sharing in the private sector;
WHEREAS, Section 8 of NPC Circular No. 2020-03 also emphasized that data sharing may be covered by a data sharing agreement (DSA) or a similar document containing the terms and conditions of the sharing arrangement;
WHEREAS, applying the rules of statutory construction, the use of the word “may” in Section 8 of NPC Circular No. 2020-03 means that the execution of a DSA is optional;
WHEREAS, despite the issuance of NPC Circular No. 2020-03, the NPC continues to receive inquiries wherein personal information controllers (PICs) insist on the execution of a DSA for their data sharing activities under the belief that the same is mandatory or is a prerequisite for such processing;
WHEREAS, Section 7 (g) of the DPA provides that the NPC is empowered to publish, on a regular basis, a guide to all laws relating to data protection;
WHEREFORE, in consideration of these premises, the NPC hereby issues this Advisory clarifying certain provisions of NPC Circular No. 2020-03 on Data Sharing Agreements.
SECTION 1. Data sharing; DSAs; clarifications. PICs engaged in data sharing shall be guided by the following clarifications:
-
A. Nothing in this Advisory shall be construed as prohibiting or limiting the sharing, disclosure, or transfer of personal data that is already authorized or required by law.
-
B. Data sharing is a form of processing. As with any personal data processing activity, it should be based on any of the criteria for lawful processing under Sections 12 or 13 of the DPA or allowed pursuant to the special cases provided in Section 4 of the DPA.
-
C. The execution of a DSA is optional. Nevertheless, PICs are encouraged to execute DSAs as the same demonstrates accountability and good faith in complying with the requirements of the DPA, its IRR, and issuances of the NPC in relation to NPC Circular No. 2020-03. Moreover, the process, decision-making, and steps toward the actual execution of a DSA should facilitate and not hinder lawful data sharing arrangements.
-
D. A DSA does not in itself confer authority or legal basis for PICs to engage in data sharing activities. Rather, it outlines the terms, conditions, responsibilities, and safeguards agreed upon by PICs. It may be executed as a contract, memorandum, or other formal collaborative instrument.
-
E. There is no requirement under the DPA, its IRR, as amended, and NPC issuances for the NPC’s pre- or post-execution review and approval of DSAs. It is the data sharing activity itself, whether or not covered by DSAs, that may be reviewed by the Commission on its own initiative or upon a verified complaint by an affected data subject.
SECTION 2. Interpretation. Any doubt in the interpretation of any provision of this Advisory shall be liberally interpreted in a manner mindful of the rights and interests of data subjects.
Approved:
SGD.
JOHN HENRY D. NAGA
Privacy Commissioner
SGD.
NERISSA N. DE JESUS
Deputy Privacy Commissioner
SGD.
JOSE AMELITO S. BELARMINO II
Deputy Privacy Commissioner