Connect with us

Hi, what are you looking for?


Staying in control: The rights of data subjects

Since the promulgation of the Implementing Rules and Regulations for the Data Privacy Act (DPA) on Aug. 24, 2016, the National Privacy Commission (NPC) has always emphasized that one of the guiding principles of the DPA is the empowerment of individuals to have reasonable control over the flow of their personal data.

To address frequently recurring questions regarding the rights of data subjects under the DPA, the NPC issued Advisory No. 2021-01 on Jan. 29 this year. The Advisory now explicitly provides that Personal Information Controllers (PICs) are required to implement a clear, simple, straight-forward, and convenient procedure to allow data subjects to exercise their rights, including the use of request forms and measures to verify the identity of the requesting data subjects. PICs are also not allowed to charge any fee to fulfill the exercise of data subject rights, (except reasonable fees for requests for copies of personal information), and must comply with requests within a period not exceeding 30 working days.

The Advisory also clarifies that PICs may not retain personal data for the sole purpose of making it available for potential future requests for the right to access or data portability. Thus, once the purpose for which the data was obtained has been fulfilled, such data may no longer be retained. Where data subject rights are denied or limited, PICs must clearly and fully inform the data subject of the reason for the limitation or denial.

The Advisory also provided expanded guidelines on the exercise of specific data subject rights. Of significance are guidelines on:

• the right to be informed, where PICs must notify and furnish data subjects with the required information before their personal data is processed and where a privacy notice is required at all times in order for data subjects to be informed which is, however, not equivalent to consent;

• the right to object, where data subjects can object to the processing of personal data for direct marketing, profiling or where automated processing of the data is to be the sole basis for any decision that significantly affects the data subject, and which mandates PICs to cease the processing of personal data when a data subject objects or to inform the data subject if there are other grounds to continue processing;

• the right to access, where PICs may refuse to comply with repeated, identical, or similar requests for access when these have already been granted except in cases where a reasonable interval of time from the previous request or if the grant of the request would result in a disproportionate amount of effort or resources or may cause serious harm to the physical, mental, or emotional health of the data subject;

• the right to rectification, where in cases involving the correction of personal data, the PIC must ensure that the data subject has access to both the new and retracted information, and upon the request of the data subject, inform recipients or third parties of the said rectification;

• the right to erasure or blocking, where required substantial proof for the exercise of the right to erasure or blocking of personal information and the specific instances when such requests may be denied is outlined and where PICs are directed to grant the request for erasure or blocking if the request is based on unlawful processing, use for unauthorized purposes or violation of data subject rights,

• the right to data portability, where the processing must be based on consent or contract and the personal data is processed by electronic means and in a structured and commonly used format to enable data subjects to exercise the right and where PICs are directed to consider commonly used, machine-readable, interoperable, open formats such as XML, JSON, CSV, etc. for data portability requests; and,

• the right to damages which states that the NPC may award indemnity on the basis of applicable provisions of the New Civil Code.

While Filipinos have gradually become aware of their rights under the DPA, navigating and exercising these rights have resembled a tug-of-war between data subjects and personal information controllers and processors. Hopefully, NPC Advisory No. 2021-01 will provide sufficient guidance to ensure that data subjects are able to take hold of and effectively control their personal information.

The views and opinions expressed in this article are those of the author. This article is for general information and educational purposes, and not offered as, and does not constitute, legal advice or legal opinion.


Maria Isabel M. Llave is a Senior Associate of the Intellectual Property Department of the Angara Abello Concepcion Regala & Cruz Law Offices (ACCRALAW)


Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Get the daily email that makes reading the news actually enjoyable. Stay informed and entertained, for free.
Your information is secure and your privacy is protected. By opting in you agree to receive emails from us. Remember that you can opt-out any time, we hate spam too!



A cabinet split is hampering the government’s efforts to deal with the nationwide shortage of lorry drivers that threatens fuel supplies at some petrol...


Pubgoers are flocking back to their locals, according to figures that drew a cautious toast from the industry but also prompted warnings of fresh...


Ministers are backing a multibillion-pound plan to build another large-scale nuclear power plant in Britain to ease pressure on electricity supplies as the country...


The Philippines’ balance of payment position (BoP) hit $1.044 billion in August, the highest in four months, due to increased special drawing rights (SDR)...


Consumers were less pessimistic in the third quarter as more jobs opened up, but business sentiment turned sour amid a fresh surge in coronavirus...


The Philippine central bank fully awarded the short-term securities it sold at an auction on Friday, even as rates rose on growing inflation fears....

You May Also Like


Having a good Instagram marketing agency to back up your Instagram account is an absolute must going into the new year. With competition stronger...


Ivermectin, an existing drug against parasites including head lice, has had a checkered history when it comes to treating COVID-19. The bulk of studies...


As a traditionally rigid insurance industry becomes bogged down by antiquated processes and operations, a handful of industry leaders are seeking to shake things...


US President Joseph R. Biden, Jr., will rely on ally countries to supply the bulk of the metals needed to build electric vehicles and focus on...

Disclaimer:, its managers, its employees, and assigns (collectively "The Company") do not make any guarantee or warranty about what is advertised above. Information provided by this website is for research purposes only and should not be considered as personalized financial advice. The Company is not affiliated with, nor does it receive compensation from, any specific security. The Company is not registered or licensed by any governing body in any jurisdiction to give investing advice or provide investment recommendation. Any investments recommended here should be taken into consideration only after consulting with your investment advisor and after reviewing the prospectus or financial statements of the company.

Copyright © 2021 SmartRetirementReport. All Rights Reserved.

Get the daily email that makes reading the news actually enjoyable. Stay informed and entertained, for free.

Your information is secure and your privacy is protected. By opting in you agree to receive emails from us. Remember that you can opt-out any time, we hate spam too!