Home / Resources / Philippine Data Privacy Act for marketing automation
Global · Philippines · CompliancePhilippine Data Privacy Act and AI marketing automation: a practical guide
Philippine customers expect quick replies on Messenger, Viber and SMS, and automation makes that possible. Here is how to do it within the Data Privacy Act.
Key takeaway: In the Philippines, automated marketing that uses personal data is governed by the Data Privacy Act of 2012 and the rules of the National Privacy Commission. Collect clear consent for marketing, tell people how their data is used, keep it secure, honour data subject rights and check what your AI tools do with the data.
The Data Privacy Act and the NPC
Republic Act No. 10173, the Data Privacy Act of 2012, sets the rules for processing personal information, guided by transparency, legitimate purpose and proportionality. The National Privacy Commission administers it and issues circulars and advisories, including on registration of data processing systems and data protection officers for organisations that meet its criteria.
Consent for marketing
- Get consent that is freely given, specific and informed, separate from other terms.
- Record when and how consent was given.
- Make opting out simple in every message and honour it everywhere.
- Sensitive personal information, such as health data, has stricter rules.
Rights and breaches
Data subjects have rights to be informed, to access, object, correct, erase or block, and to data portability. Serious personal data breaches must be reported to the NPC and affected individuals within the required time frame, so know which systems hold personal data.
AI tools and vendors
- List which tools process personal data and where.
- Have data sharing or outsourcing agreements with vendors.
- Confirm whether vendors use your data to train models.
- Follow any NPC guidance on AI and automated processing.
A practical set-up
- Capture consent in your forms and chat opt-in flows, with timestamps.
- Sync consent and opt-outs to your CRM and messaging tools.
- Limit what you store to what you need.
- Publish a clear privacy notice in English and, where useful, Filipino.
This article is general information, not legal advice. Rules change; check current guidance from the relevant regulator.
How we approach it
Reckona AI scopes Philippine automation around the Data Privacy Act from day one. See Reckona AI in the Philippines.
Frequently asked questions
What law governs personal data in the Philippines?
The Data Privacy Act of 2012 (Republic Act No. 10173), administered by the National Privacy Commission.
Do I need consent to send marketing messages in the Philippines?
You should have a lawful basis, and for marketing that is usually clear, specific consent, with an easy way to opt out.
Do I need a Data Protection Officer?
Organisations that process personal data should designate one, and some must register with the NPC. Check the NPC’s current registration criteria.
Can I use AI tools on customer data in the Philippines?
Yes, if processing follows the Data Privacy Act principles, vendors are under proper agreements and you understand how they use your data.
Want this done for your brand?
Start with a free audit: a written scope and a baseline of how AI assistants describe your brand today.
Get my free audit →