Philippines consults on updated privacy impact assessment guidelines

The Philippines’ National Privacy Commission (NPC) opened a public consultation on 10 August 2026 on draft updated guidelines for conducting privacy impact assessments (PIAs). The consultation was open until 14 August 2026.

The proposed rules would clarify when privacy impact assessments become mandatory for personal information controllers and processors. Mandatory cases would include the processing of sensitive personal information, financial, biometric and children’s data, as well as large-scale processing.

The draft would also cover processing involving vulnerable groups, automated decision-making or profiling, novel or high-risk technologies, targeted advertising and certain cross-border transfers that present heightened risks to individuals.

In addition to defining when a PIA is required, the proposed guidelines would establish requirements concerning accountability, stakeholder participation, the structure and content of PIA reports, assessment procedures, documentation and annual reviews. They would also introduce penalties for non-compliance.

If adopted, the new circular would replace NPC Advisory No. 2017-03. It would take effect 15 calendar days after publication in a newspaper of general circulation, with organisations given a 90-day transition period to comply.