National Privacy Commission

What National Privacy Commission does

The National Privacy Commission (NPC) is the statutory regulatory agency of the Republic of the Philippines mandated to administer and enforce the Data Privacy Act of 2012 (Republic Act No. 10173). Established by law in 2012 and operational since March 2016, the NPC operates as an independent body under the Department of Information and Communications Technology, headquartered at the Upper Class Tower in Quezon City with 51-100 employees. The agency regulates all Personal Information Controllers (PICs) and Personal Information Processors (PIPs) operating in the Philippines, issues circulars and advisory opinions, monitors compliance, investigates complaints, and conducts enforcement actions including cease and desist orders and show-cause orders.

The NPC's core technology infrastructure comprises the NPCRS (National Privacy Commission Registration System) for mandatory DPO and Data Processing System registration, the DBNMS (Data Breach Notification Management System) for incident reporting, and the Compliance and Security Monitoring Command Center launched in December 2024 for centralized oversight. Supporting platforms include the Complaints-Assisted Form (CAF) for public complaints, ASK PRIVA for inquiries, the PhilHealth Data Leak Checker Portal, and the DPO Journal resource hub. Public education is delivered through the Privacy in the Spotlight (PITS) webcast, Kabataang Digital youth program, PSST public awareness initiative, and Privacy Awareness Week (PAW). The agency maintains international engagement through membership in the Global Privacy Assembly (where it became the first fee-funded secretariat in 2023) and the APEC CBPR system, alongside bilateral MOUs with Japan, South Korea, Singapore, UK ICO, Hong Kong, DIFC, Mexico INAI, and others.

The NPC's revenue model is government appropriation as primary funding source, supplemented by administrative fees for DPO/DPS registration, certification requests, and training provider licensing under the Data Privacy Competency Program (DPCP). Payment is processed through Land Bank of the Philippines Link.Biz Portal. The agency does not generate commercial revenue and has no private ownership or shareholders. Customer segments span regulated entities across all Philippine industries (financial services, healthcare, government, BPO, media, utilities, hospitality), individual Data Protection Officers (mandated appointment under the DPA), licensed training providers, and Filipino data subjects exercising statutory privacy rights.

Name

National Privacy Commission

Legal name

National Privacy Commission

Website

https://privacy.gov.ph

Company type

Public

Founded year

2016

Operating status

Operating

Headcount range

51–100 employees

Short description

The National Privacy Commission is the Philippine government agency mandated by the Data Privacy Act of 2012 to administer, enforce, and promote data privacy regulation nationwide, serving regulated entities (PICs/PIPs), Data Protection Officers, and Filipino data subjects through registration systems, breach monitoring, public education, and international cooperation.

Ownership category

akta.pro rank

Product category

Government Data Privacy Regulation

NAICS

Regulation, Licensing, and Inspection of Miscellaneous Commercial Sectors (926150), Public Administration (92)

akta.pro primary industry

Data Protection, Privacy & Cybersecurity Regulators (BPAIAOAH)

akta.pro secondary industry

Privacy Governance & Consent Management (HDADAIAI)

Keywords

• Data privacy regulation
• Compliance monitoring services
• Breach notification system
• Privacy registration platform
• Data protection enforcement

Headquarters

HQ city

Quezon

HQ country

Philippines

HQ region

Asia

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Operations, Technology or R&D, Infrastructure, Marketing or Sales, Others

Revenue model

1. Government Appropriation: Core operational funding from the Philippine government national budget
2. Registration and Filing Fees: Fees collected for DPO registration, DPS registration, certification requests, and other administrative services as per the Schedule of Fees and Charges
3. Training Provider Licensing: Fees related to licensing of training providers under the Data Privacy Competency Program (DPCP)

Pricing tiers

Go-to-market motion1 record

Distribution channels7 records

Marketing channels12 records

Core offering

The National Privacy Commission is the Philippine government agency mandated to administer and enforce the Data Privacy Act of 2012. It operates the NPC Registration System (NPCRS) and Data Breach Notification Management System (DBNMS), runs public education programs such as Privacy in the Spotlight and Kabataang Digital, issues circulars and advisory opinions, investigates complaints, and licenses training providers under the Data Privacy Competency Program. Its core offerings therefore consist of regulatory services, compliance/registration platforms, breach response infrastructure, and public privacy awareness initiatives delivered to regulated entities and data subjects.

Product overview

The National Privacy Commission operates a unified platform of regulatory and public-facing digital services centered on data privacy administration and enforcement. The core infrastructure consists of the NPCRS (NPC Registration System) for DPO and Data Processing System registration, and the DBNMS (Data Breach Notification Management System) for incident reporting—both mandatory online portals for PICs and PIPs compliance. Supporting these are public education programs including Privacy in the Spotlight (PITS) webcast series and Rated DP showcasing DPO practices; the Kabataang Digital youth initiative; PSST (Privacy Safety Security & Trust Online) education program; and the Data Privacy Competency Program for DPO training and certification. The Commission also offers certification products including the Philippine Privacy Trust Mark and NPC Seal of Registration, alongside direct services such as ASK PRIVA inquiry system, Complaints-Assisted Form for dispute filing, and the PhilHealth Data Leak Checker portal. The DPO Journal serves as a professional resource hub. The Compliance and Security Monitoring Command Center and Accountability Agent Recognition program round out the regulatory toolkit.

Differentiator

Problem solved

Functional benefit

Products and services

• NPCRS (NPC Registration System) Mandatory online portal for Personal Information Controllers and Processors to register, renew, and amend Data Protection Officers and Data Processing Systems under the Data Privacy Act and NPC Circular No. 2022-04.
• DBNMS (Data Breach Notification Management System) Official online platform for submitting Personal Data Breach Notifications (PDBN) and Annual Security Incident Reports (ASIR) to the National Privacy Commission, the only valid channel for breach reporting under NPC requirements.
• Compliance and Security Monitoring Command Center Centralized monitoring system for compliance and security incident management, providing the NPC with oversight of regulated entities' compliance posture and security events.
• PhilHealth Data Leak Checker Portal Public online portal (Na-leak ba ang PhilHealth Data ko?) allowing PhilHealth data subjects to check if their personal data was exposed in the PhilHealth data breach.
• Complaints-Assisted Form (CAF) Standardized digital complaint filing system available on the NPC website for data subjects to file complaints for alleged violations of the Data Privacy Act of 2012.
• ASK PRIVA Online public inquiry and assistance system that allows the public to ask data privacy questions and receive guidance from the National Privacy Commission.
• Philippine Privacy Trust Mark Trust certification mark issued by the NPC for businesses that demonstrates compliance with data privacy standards and adds value to cross-border data transfer assurance.
• NPC Seal of Registration Official seal of registration issued to compliant Personal Information Controllers and Processors, with mandatory display requirements for registered entities.
• Data Privacy Competency Program (DPCP) Comprehensive NPC training and certification program for Data Protection Officers, including the Foundational Course, Level 1 examinations, and licensing of training providers under the DPCP framework.
• Kabataang Digital Program NPC youth advocacy campaign under PSST with the theme 'Matalino, Mapagmatyag, at Mapanuri,' promoting a safe online environment for Filipino youth through regional caravans and educational materials.
• Privacy in the Spotlight (PITS) Webcast Webcast series in which data privacy experts and professionals discuss data privacy and protection topics, distributed via Facebook and YouTube to raise public awareness and educate viewers.
• PSST (Privacy Safety Security & Trust Online) NPC public education program covering data privacy, data protection, and fair information rights and responsibilities, with sub-programs and educational materials on eCommerce, social media, online games, search engines, and online videos.
• Rated DP Webcast NPC webcast showcasing data privacy practices, best practices, and compliance frameworks of exemplary organizations and their Data Protection Officers.
• DPO Journal Online portal and publication serving as a resource hub for Data Protection Officers, providing guidance, best practices, and professional development content.
• PAW Awards (Privacy Awareness Week Awards) Annual NPC awards program during Privacy Awareness Week recognizing outstanding data privacy practices in the public and private sectors.
• Accountability Agent Recognition Recognition program enabling organizations to achieve Accountability Agent status under APEC CBPR and Global CBPR systems for cross-border data flow certifications.

Named customers12 records

Segments6 records

Ideal customer profiles3 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature5 records

Partnerships

31 partnerships are on record, tiered core.

• Asia Pacific Privacy Authorities (APPA) ForumcoreStrategic or Co-development Partner · 18 June 2026NPC strengthens regional ties and advances data privacy standards at the 65th APPA Forum in Hong Kong SAR China.
• Japan (Personal Information Protection Commission)coreStrategic or Co-development Partner · 1 June 2026Japan and the Philippines strengthen data privacy protection cooperation through bilateral MOU for enhanced collaboration in data privacy regulation, enforcement, and best practices exchange.
• MoroccocoreStrategic or Co-development Partner · 24 October 2025Philippines and Morocco strengthen ties on data privacy cooperation through bilateral partnership for cross-border data protection and privacy enforcement collaboration.
• Global Cross-Border Privacy Rules (CBPR) WorkshopcoreStrategic or Co-development Partner · 24 October 2025Philippines hosts Global Talks on Building Trust in Cross-Border Data Flows in Aklan, bringing together international privacy authorities.
• PAGCORcoreStrategic or Co-development Partner · 20 October 2025NPC and PAGCOR collaborate to foster responsible and secure digital gaming through policy guidance and compliance frameworks.
• PNP-Anti Cybercrime Group (PNP-ACG)coreStrategic or Co-development Partner · 1 August 2025NPC and PNP-ACG strengthen cybercrime response and data protection through strategic collaboration and joint enforcement efforts.
• Data Privacy CouncilcoreStrategic or Co-development Partner · 18 June 2025NPC and DP Council empower DPOs through Capacity Building and Leadership Training for enhanced privacy profession development.
• International Data Protection AuthoritiescoreStrategic or Co-development Partner · 12 June 2025Philippines hosts international data privacy authorities for closed sessions to strengthen global cooperation and enforcement alignment.
• Straits Interactive Pte. Ltd.coreTechnology or Integration · 3 June 2025NPC and Straits Interactive collaborate to enhance data privacy initiatives with generative AI through MOA for innovative technology integration.
• IsraelcoreStrategic or Co-development Partner · 25 April 2025Philippines and Israel deepen cooperation on personal data protection through bilateral MOU signed in Washington D.C.
• BermudacoreStrategic or Co-development Partner · 22 April 2025Philippines and Bermuda seal strategic partnership on cross-border data protection through MOU signing in Washington D.C.
• GCash (G-Xchange, Inc.)coreStrategic or Co-development Partner · 25 March 2025National Privacy Commission and GCash collaborate to enhance data privacy awareness for Filipinos through joint initiatives and education campaigns.
• Turkey (Türkiye)coreStrategic or Co-development Partner · 11 February 2025Philippines and Turkiye forge landmark partnership to bolster global data protection efforts through bilateral cooperation framework.
• Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI - Mexico)coreStrategic or Co-development Partner · 31 January 2025NPC and INAI hold transition meeting for GPA fee-funded secretariat coordination and global privacy initiatives.
• Insurance Commission (IC)coreStrategic or Co-development Partner · 5 December 2024NPC and IC signed MOA to strengthen privacy practices in insurance industry through compliance frameworks and guidance.
• Data Privacy CouncilcoreStrategic or Co-development Partner · 4 December 2024NPC brings Kabataang Digital Caravan across PH regions to extend digital literacy and privacy awareness nationwide.
• South Korea (Personal Information Protection Commission - PIPC)coreStrategic or Co-development Partner · 26 November 2024South Korea and Philippines ink MOU to enhance data protection collaboration signed in Tokyo, Japan.
• APEC CBPR SystemcoreStrategic or Co-development Partner · 4 July 2024Philippines supports establishing international certification system promoting interoperability among different data protection frameworks through APEC Cross-Border Privacy Rules system.
• Global Privacy Assembly (GPA)coreStrategic or Co-development Partner · 30 April 2024Philippines takes proactive role in promoting global cooperation on cross-border data protection and privacy enforcement through GPA membership and hosting of Global CBPR Workshop 2025.
• Dubai International Financial Centre (DIFC)coreStrategic or Co-development Partner · 8 April 2024NPC and DIFC gain stronger foothold through MOU signing for enhanced cooperation in data privacy regulation.
• Canada and MaltacoreStrategic or Co-development Partner · 23 October 2023NPC strengthens global data protection cooperation with Canada and Malta at 45th Annual Meeting of Global Privacy Assembly.
• Department of Information and Communications Technology (DICT)coreStrategic or Co-development Partner · 18 October 2023DICT and NPC unite to launch innovative Privacy Complaint Hotline Project for enhanced citizen access to data privacy redress.
• Global Privacy Assembly (GPA)coreStrategic or Co-development Partner · 19 June 2023NPC takes lead as the First Fee-Funded Secretariat of Global Privacy Assembly, marking significant international leadership milestone.
• Hong Kong (Office of the Privacy Commissioner)coreStrategic or Co-development Partner · 22 May 2023Philippines and Hong Kong sign MOU on Personal Data Protection for enhanced cross-border privacy cooperation.
• National Bureau of Investigation (NBI)coreStrategic or Co-development Partner · 19 May 2023NPC and NBI collaborate to apprehend bomb threat suspect through joint investigative efforts.
• Telecommunications Companies (Telcos)coreStrategic or Co-development Partner · 11 May 2023NPC strengthens strategic partnership with Telcos through MOU signing to drive positive change and transformation in data protection compliance.
• Cybercrime Investigation and Coordinating Center (CICC)coreStrategic or Co-development Partner · 12 December 2022NPC and CICC sign MOA to thwart the use of ICT for data breaches and cybercrimes through coordinated enforcement.
• SingaporecoreStrategic or Co-development Partner · 15 September 2022Philippines and Singapore renewed stronger ties in personal data protection through MOU renewal.
• Philippine Competition Commission (PCC)coreStrategic or Co-development Partner · 10 February 2022NPC and PCC sign MOA to boost consumer and data privacy protection through joint enforcement and policy alignment.
• Cybercrime Investigation and Coordinating Center (CICC)coreStrategic or Co-development Partner · 24 June 2021NPC collaborates with CICC to strengthen Digital Forensic Laboratory capabilities for enhanced cybercrime investigation.
• UK Information Commissioner's Office (ICO)coreStrategic or Co-development Partner · 14 January 2021Privacy Commission firms up collaboration with UK counterpart in sharing best privacy practices through MOU.

Scale indicators4 records

Recent moves6 records

Expansion highlights6 records

Broad incumbents

• CNIL (Commission Nationale de l'Informatique et des Libertés): France's data protection authority, one of the most established and well-resourced GDPR enforcement bodies in the EU. Comparable in regulatory function to NPC and a reference model for international cooperation.

Direct peers

• UK Information Commissioner's Office (ICO): UK's independent data protection authority, comparable in mandate to NPC as a national privacy regulator with rule-making, enforcement, and international cooperation functions. NPC signed an MOU with ICO in 2021 for sharing best privacy practices.
• Japan Personal Information Protection Commission: Japan's national data protection authority enforcing the APPI. NPC signed a bilateral MOU in June 2026 to strengthen cooperation in data privacy regulation and enforcement.
• Office of the Australian Information Commissioner (OAIC): Australia's independent privacy regulator under the Privacy Act 1988, with comparable functions of privacy complaint handling, regulatory guidance, and international engagement in the APEC CBPR framework.
• Singapore Personal Data Protection Commission (PDPC): Singapore's data protection authority under the PDPA, with a comparable Asian-regulator mandate covering registration, enforcement, and cross-border data flow frameworks. NPC renewed its MOU with Singapore in 2022.
• Hong Kong Office of the Privacy Commissioner for Personal Data (PCPD): Hong Kong's independent privacy regulator enforcing the Personal Data (Privacy) Ordinance. NPC signed an MOU with PCPD in 2023 for cross-border privacy cooperation, making it a direct peer in Asian privacy enforcement.
• Office of the Privacy Commissioner of Canada: Canada's federal privacy enforcement authority under PIPEDA. NPC strengthened cooperation with Canada at the 45th Global Privacy Assembly in October 2023, making it a relevant peer in cross-border privacy enforcement.
• South Korea Personal Information Protection Commission (PIPC): South Korea's national privacy regulator with broad rule-making and enforcement authority under the Personal Information Protection Act. NPC signed an MOU with PIPC in November 2024 for enhanced collaboration.

Others

• Global Privacy Assembly (GPA): International forum of data protection authorities. NPC serves as the first fee-funded GPA secretariat (since 2023), making GPA a peer in international governance rather than a direct competitor — a key institutional relationship for NPC's global standing.

Emerging players

• Straits Interactive Pte. Ltd. Singapore-headquartered data privacy training and AI governance solutions provider. Entered an MOA with NPC in June 2025 to enhance data privacy initiatives with generative AI — an emerging ecosystem partner at the intersection of AI and privacy.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat6 records

Key risks6 records

Key highlights6 records

Customer concentration

• Xx.com/PrivacyPH
• Facebookfacebook.com/privacy.gov.ph
• Instagraminstagram.com/privacy.gov.ph/?hl=en
• LinkedInlinkedin.com/company/privacygovph

Compliance1 record

Revenue estimate

Valuation estimate

Number of profiles

Profiles4 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about National Privacy Commission