If your business takes a customer's name, email, phone number, address, or any other personal data, the Data Privacy Act of 2012 requires you to publish a Privacy Notice. And not just any Privacy Notice — one that includes specific, legally required elements.

Most Philippine small business Privacy Notices we audit fail on at least three of those elements. Many are copy-pasted from American or European templates and miss what NPC actually requires.

This guide gives you the 8 must-have elements in plain English, plus a starter template you can adapt for your business today.

What a Privacy Notice Actually Does

A Privacy Notice is the public-facing document on your website that tells customers what data you collect, why, what you do with it, and what rights they have. It is not the same as a Privacy Policy (the internal document for your team) or a Consent Form (the specific permission you collect at the point of data collection).

The NPC checks Privacy Notices during compliance audits. A missing or incomplete one is a confirmed administrative violation under NPC Circular 2022-01.

The 8 Elements Your Privacy Notice Must Include

1. Identity of the Data Controller

Your registered business name (per DTI or SEC), business address, and a contact email or phone where data subjects can reach you. Use your real legal name, not a brand name.

2. Contact Details of Your DPO

Your Data Protection Officer's name, official email, and phone number. If you do not yet have a DPO, you have a bigger problem — every business that processes personal data needs one.

3. What Personal Data You Collect

A complete list. Names, emails, phone numbers, addresses, IDs, payment information, IP addresses, photos, voice recordings — everything. Be specific. Vague descriptions like "your information" do not satisfy NPC requirements.

4. Why You Collect It

The specific, lawful purpose for each type of data. Service delivery, billing, marketing, compliance, security. One purpose per data type is best. "Other legitimate purposes" is too vague.

5. Legal Basis for Processing

Under the Data Privacy Act, processing must have one of six lawful bases — consent, contract, legal obligation, vital interests, public interest, or legitimate interests. State which one applies for each purpose.

6. Who You Share Data With

Every third party that receives the data. Payment processors, shipping providers, email marketing tools, your cloud hosting provider. Yes, you must name them. Vague "trusted partners" language is not acceptable.

7. How Long You Retain the Data

A specific retention period for each data type. "As long as legally required" works for tax records (10 years under BIR rules). For marketing data, state a number. Indefinite retention is a violation.

8. Data Subject Rights

The eight rights customers have under RA 10173 — to be informed, object, access, rectify, erase, damages, data portability, and complaint. State how they exercise each right with you.

Starter Privacy Notice Template (Copy and Adapt)

You can use this as your starting point. Replace every bracketed placeholder with your real details before publishing.

[BUSINESS NAME] is committed to protecting your personal data in accordance with the Data Privacy Act of 2012 (RA 10173) and its Implementing Rules and Regulations.

Who we are: [BUSINESS NAME], registered at [ADDRESS], with DTI/SEC Registration No. [NUMBER].

Data Protection Officer: [DPO NAME], [DPO EMAIL], [DPO PHONE].

What we collect: [LIST: e.g., name, email, phone number, billing address, transaction history, IP address, browser type].

Why we collect it: [PURPOSES, e.g., to deliver services you order, send transaction receipts, respond to inquiries, comply with BIR record-keeping requirements].

Legal basis: Your consent at the point of collection, plus our legitimate business interest in serving you, plus our legal obligation to retain transaction records.

Who we share it with: [LIST: e.g., GCash for payment processing, J&T Express for shipping, Google Workspace for email infrastructure]. We do not sell your data.

How long we keep it: [PERIODS: e.g., transaction records for 10 years per BIR; marketing data for 2 years after last engagement; account data for the duration of your account plus 1 year].

Your rights: You have the right to be informed, to object, to access, to rectify, to erase, to damages, to data portability, and to file a complaint with the National Privacy Commission. To exercise any of these, contact our DPO at the details above.

Updates: This Notice was last updated on [DATE]. We will notify you of material changes.

Where to Publish It

  • A dedicated Privacy Notice page on your website (linked from the footer)
  • Inside every form that collects data (a short summary + link to full notice)
  • Inside email opt-in confirmations
  • Posted physically at your shop where forms are filled out

Frequently Asked Questions

Can I just copy a Privacy Notice from another business?

No. Yours must reflect YOUR specific data, purposes, third parties, and retention periods. A copied notice is itself a compliance violation if it does not match reality.

Does my Privacy Notice need to be in Filipino?

There is no legal requirement, but if your customers primarily transact in Filipino, providing it in both English and Filipino is best practice — and NPC has signaled approval of multilingual notices.

How often should I update it?

Whenever anything material changes — new third party, new data type collected, new purpose, new retention period. Review at minimum annually.

Need One Done Right?

Drafting a compliant Privacy Notice is one of the standard deliverables in our outsourced DPO service at RDahunan I.T. Services. Want a free 30-minute review of your current Notice (or help drafting your first one)? Send us a message.

General DPO guidance. Not legal advice. For specific cases, consult a Philippine privacy lawyer.