Data Privacy and Consumer Protection in the Philippines — Legal Framework, Regulators, and 2025–2026 Practical Developments

As of 2026-08-30 · Updated 2026-08-30 · Section: Investment, Economic Zones & Licensing · 日本語版

Editor's note: This article covers a field in which the site's operating company has business interests. It is compiled from publicly available and primary sources.

0. The big picture: seven laws to know first

"Data protection" and "consumer protection" in the Philippines are not governed by a single code, but by a bundle of laws split across different regulators. The mistake Japanese companies commonly make is assuming "consumer trouble = go to the DTI." In reality the correct entry point differs: DTI for goods, the FDA for food/drugs/cosmetics, BSP/SEC/IC/CDA for financial matters, and the NPC for personal data.

The two biggest structural shifts of 2025–2026: (1) the ITA reached full implementation in June 2025, giving the DTI the power to blacklist and fine noncompliant e-commerce operators (Manila Bulletin, June 23, 2025); and (2) the NPC has shifted its regulatory focus to AI, biometric data, and data scraping (NPC Advisory 2024-04, 2026-01).

1. The Data Privacy Act (RA 10173, 2012)

1.1 History and scope

• Enacted August 15, 2012. The Implementing Rules and Regulations (IRR) took effect in 2016, and substantive enforcement dates from 2016 onward.
• (Amendment status confirmed in the 2026-08-26 verification pass) As of August 2026, no Republic Act amending RA 10173 could be identified. What actually moves is not the statute but NPC Circulars and Advisories (for example, NPC Circular 2022-01's administrative fine tiers, capped at ₱5,000,000). Amendment bills — for example adding stiffer penalties or defining biometric/genetic data — are repeatedly filed in successive Congresses, but they lapse or are refiled with every change of Congress, and none has ever been enacted (sources: NPC's official site, privacy.gov.ph; DLA Piper, "Data protection laws in the Philippines"; the House of Representatives bill database).
• Extraterritorial application applies. DPA Section 6 subjects a foreign entity handling the personal data of Philippine citizens or residents to the law if it has any of the following connections: (1) a contract was entered into in the Philippines, (2) its central management function is in the Philippines, or (3) it has a branch or subsidiary in the Philippines that processes such data (RA 10173, Sec. 6, text as published on LawPhil).
• Section 4 exemptions: information relating to a public officer's duties, information for journalistic/artistic/literary/research purposes, information necessary for a public authority's law-enforcement or regulatory functions, and information collected under foreign law, among others.

注 "A Japanese company is outside the scope of Philippine law" is incorrect. If a company outsources BPO work, sells via e-commerce, or obtains customer data through a local subsidiary, it can fall within scope under Section 6.

1.2 Definitions of personal and sensitive personal information (Section 3)

A decisive difference from Japan's Act on the Protection of Personal Information is that age, marital status, and education history all count as "sensitive" in the Philippines. Applying a Japanese head office's usual sensibilities directly when designing HR/recruitment databases will miss this.

1.3 Lawful basis for processing and data-subject rights

• For ordinary personal information, lawful bases are set out in Section 12 (consent, contract performance, legal obligation, protection of life, functions of public authority, legitimate interests); for sensitive personal information, in Section 13 (in principle, consent; specific statutory authorization; protection of life; internal processing by nonprofit organizations; medical purposes; establishment of legal claims, among others).
• The NPC has broken down operational standards further through Circular 2023-04 (consent), Circular 2023-07 (legitimate interests), and Advisory 2024-02 (Section 13(f)). The notion that "obtaining consent is sufficient for anything" has been clearly rejected since 2023.
• Data-subject rights (Section 16): the right to be informed of processing, the right of access, the right to correction, the right to demand blocking/erasure, the right to damages, and the right to data portability (obtaining a copy in electronic form).

2. The NPC (National Privacy Commission)

2.1 Powers

Under DPA Section 7, the NPC (1) oversees compliance and investigates complaints, (2) can issue cease-and-desist orders and temporarily or permanently prohibit personal data processing, (3) monitors the security measures of government agencies, (4) approves codes of conduct, (5) recommends prosecution to the DOJ, and (6) coordinates with foreign authorities.

On December 11, 2025, Johann Carlos Barcena was appointed Privacy Commissioner (Newsbytes.PH). A new Deputy Commissioner was also appointed in February 2026 (Newsbytes.PH, February 15, 2026).

2.2 Major issuances (2023–2026)

Key points of Advisory 2026-01 (data scraping): (1) purpose specification and limitation; (2) a lawful basis under the DPA is required — "the mere fact that data is publicly available does not imply consent"; (3) notice to the data subject before processing, or at the next practicable opportunity; (4) data minimization; (5) conducting a privacy impact assessment (PIA); (6) additional safeguards for sensitive information; and (7) heightened scrutiny for minors, the elderly, and persons with disabilities. Circumventing technical protection measures or using deceptive means to scrape data is unlawful (Section 4). This bears directly on the collection of training data for generative AI.

注 An August 10, 2026 Tech Times article reported that "the Philippines has replaced its uniform PIA requirement, imposing new review requirements for AI and biometric processing," but as of August 25, 2026, no corresponding 2026 circular appears in the NPC's official "Advisories & Circulars" listing (only Advisory 2026-01 and 2026-02 for 2026 appear there). Its number and official title are unconfirmed. Practitioners should avoid treating this as settled until the original text is published. Reconfirmed in the 2026-08-25 verification pass: a direct review of the Advisories & Circulars list on the NPC's official site, privacy.gov.ph, found only Advisory 2026-01 (April 2026, guidance on scraping of publicly available personal data) and Advisory 2026-02 (May 11, 2026, clarification of breach-notification filing via the DBNMS) listed for 2026 — only these two — with no circular matching the "new PIA rules" described above. The sector reference "Digital, Social Media, and Payments," Section 11, also treats this as "the NPC's proposed revision of PIA guidance, currently out for public comment" — i.e., still under deliberation. 注 In other words, this is not "an enacted rule" but still at the "proposed revision" stage, and should not be written up as a settled figure or confirmed system (consistency confirmed via cross-referencing in the 2026-08-25 pass).

2.3 Administrative fines (NPC Circular 2022-01, August 8, 2022)

Separately from the criminal penalties in the DPA itself, the NPC has independent authority to impose administrative fines.

• The total cap for a single act is ₱5,000,000 (Circular 2022-01. Directly confirmed via the original Circular 2022-01 PDF (dated August 8, 2022) as posted on the NPC's official site, in the 2026-08-25 verification pass: "the total imposable fine for a single act of a PIC or PIP … shall not exceed Five Million Pesos (Php 5,000,000.00)." The Grave (0.5–3%), Major (0.25–2%), and Other (₱50,000–₱200,000) tiers all match the original text). This is also consistent with the sector reference "Digital, Social Media, and Payments," Section 11 ("cap of 5 million pesos per violation").
• Factors considered: whether the violation was intentional or negligent, the extent of harm, the duration of the violation, prior remedial measures, prior violation history, the type of data affected, how the violation came to light, corrective measures taken, and any profit gained.

注 The old understanding that "Philippine data protection has weak penalties" is outdated. Revenue-proportional fines were introduced back in 2022, and large companies are the ones most likely to hit the ₱5M cap. That said, this is not the EU GDPR standard of "4% of worldwide turnover" — it is a Philippine entity's annual gross income, capped at ₱5M — this point should be kept clear too (don't conflate the old and new, or the EU and Philippine, standards).

3. Registration requirements and the DPO (NPC Circular 2022-04)

Appointing a DPO (Data Protection Officer) is mandatory for all PICs/PIPs, while registration is required only once certain thresholds are exceeded — a two-tier structure. Confusing the two leads to the mistaken belief that "we're too small to need a DPO."

4. Personal data breach notification ("72 hours")

4.1 Where does "72 hours" actually appear?

注 The most common misconception: 72 hours does not appear in the DPA statute itself. - RA 10173 Section 20(f) only states that, if sensitive personal information (etc.) is reasonably believed to have been acquired by an unauthorized person, the PIC shall promptly notify the NPC and the affected data subjects. - "72 hours" appears in the IRR (2016), Section 38: "The NPC and affected data subjects shall be notified by the PIC within seventy-two (72) hours upon knowledge of, or when there is reasonable belief by the [PIC] that, a personal data breach requiring notification has occurred." The operational details are in NPC Circular 16-03 (Personal Data Breach Management).

4.2 The three conditions that trigger notification (IRR Section 38)

1. The information involves sensitive personal information or information that could enable identity fraud
2. It is reasonably believed to have been acquired by an unauthorized person
3. The PIC or the NPC believes the acquisition is likely to give rise to a real risk of serious harm to the affected data subjects

→ Notification is required only when all three conditions are met. There is no obligation to report every internal incident within 72 hours, but even cases where notification is deemed unnecessary must still be recorded and included in annual reporting.

4.3 Notification content, delay, and annual reporting

• Required notification content (IRR Section 39): the nature of the breach, the data likely affected, remedial measures taken, mitigation measures, contact information for the PIC's representative, and the assistance available to the data subject.
• Delay (Section 40): permitted only where necessary to determine the scope of the breach, prevent further disclosure, or restore the integrity of the system. The NPC may grant an exemption or extension where public interest or a criminal investigation would otherwise be harmed.
• In practice, a detailed follow-up report is required within 5 days after the 72-hour notification (per the sector reference "Digital, Social Media, and Payments," Section 11, "a detailed report required within a further 5 days"). Notification is not the end of the process at 72 hours — this point deserves attention (added via cross-referencing in the 2026-08-25 pass).
• Annual Security Incident Report (ASIR): all PICs/PIPs must submit the prior year's report via the DBNMS (Data Breach Notification Management System) by March 31 every year. The deadline for the 2025 report was March 31, 2026 (per NPC announcement). Once submitted via the DBNMS, the report cannot reportedly be amended (per the sector reference "Digital, Social Media, and Payments," Section 11). 注 Sources differ on the legal basis for ASIR. The first draft of this article cited only "NPC operational practice," while the sector reference "Digital, Social Media, and Payments," Section 11, cites "NPC Circular 2022-04." As shown in Section 3 above, Circular 2022-04 governs registration and DPO appointment, so the personal-data-breach-management circular, NPC Circular 16-03, appears the better fit as the basis for ASIR. 注 This session could not directly confirm the legal basis from a primary source = unconfirmed. Both possibilities are retained here. When citing the basis in an external report, confirm it against the original NPC text.
• 2026-08-25 verification: it was directly confirmed, using the IRR as posted on the NPC's official site, that Sections 38 (72 hours), 39, and 40 fall under Rule IX, "Data Breach Notification." There is no mis-citation of the article numbers.
• Advisory 2026-02, dated May 11, 2026, clarified the method for submitting breach notifications via the DBNMS. 注 Filings that still assume paper or email submission may not be accepted.

5. Cross-border transfer

The Philippines has neither an EU-style "adequacy" system nor a prior-approval system. Its core mechanism is the Principle of Accountability.

• RA 10173, Section 21 (Principle of Accountability) / IRR Section 50, "Accountability for Transfer of Personal Data" (Rule XII, "Rules on Accountability"): "Each PIC is responsible for personal information under its control or custody, including information transferred to a third party for processing, whether domestically or internationally." A PIC must ensure, through "contractual or other reasonable means," a comparable level of protection while a third party is processing the data. (Article numbers, rule name, and wording directly confirmed against the IRR posted on the NPC's official site in the 2026-08-25 pass. No mis-citation.)
• NPC Advisory 2024-01 (May 30, 2024): a voluntary guidance document comparing ASEAN MCC, Council of Europe/EU standard contractual clauses, Ibero-American MCC, and clauses from Argentina, New Zealand, and the UK ICO's IDTA. It addresses two modules: controller-to-controller (C2C) and controller-to-processor (C2P). 注 The NPC states explicitly — "this guidance is intended for voluntary adoption and imposes no additional rights or obligations," and "the NPC does not accept requests to review whether a contract conforms to the model clauses." In other words, there is no way to obtain the regulator's stamp of approval.
• On June 2, 2026, the NPC and Japan's Personal Information Protection Commission signed an arrangement on cross-border data protection cooperation (Philippine News Agency / Newsbytes.PH / Manila Standard, June 2, 2026). This is a practical tailwind for cross-border data transfers by Japanese companies, but it should be understood as a cooperation framework, not an "adequacy" determination.
• The NPC operates applications for APEC and Global CBPR Accountability Agent certification, with an application deadline of March 20, 2026 (per NPC announcement).

6. Enforcement cases and data breaches, 2025–2026

6.1 Private-sector sanctions and disputes

In March 2026, the PNP intensified its crackdown citing 47,000 complaints regarding online lending apps (PNA, March 17, 2026); the SEC and other agencies also announced coordinated action (Inquirer.net, March 25, 2026). The Senate passed a fair debt collection bill on March 10, 2026 (Manila Bulletin). 注 (Corrected in the 2026-08-25 verification pass) the first draft had flatly stated that online lending's "harvest-your-contacts-then-shame-you-publicly" pattern of debt collection is the single largest category of privacy enforcement disputes in the Philippines, but it did not specify what metric this "largest" claim was based on. The only confirmable basis is that "the PNP cited 47,000 complaints related to online lending apps in March 2026" (PNA, March 17, 2026) — a figure of complaints, not of NPC enforcement actions or decisions, so whether it is the largest category by that measure could not be confirmed within this session = unconfirmed. It should be written as "the largest category by complaint volume," with the metric made explicit.

6.2 Government-sector breaches (2025–2026)

In this context, on July 16, 2026, President Marcos signed EO 119, launching domestic storage of government data (data residency) and related digital infrastructure development (Philippine Information Agency, July 16, 2026 / Tech in Asia, July 15). Telecom operators expressed support (Inquirer.net / Manila Standard, July 20).

7. Relationship with the SIM Registration Act (RA 11934, 2022)

Relationship with the DPA: the SIM registration database is a concentration of "sensitive personal information plus government-issued identifiers," and is subject to dual regulation under both the DPA and the SIM Registration Act. Where the database is breached, a telecom operator must consider both the 72-hour notification requirement under the DPA (IRR Section 38) and the 24-hour cyberattack-reporting requirement under the SIM Registration Act.

注 "SIM registration has stopped fraudulent SMS" is incorrect. Even in 2025–2026, the NTC continues to say that "raising awareness is still the first line of defense" (Philippine Information Agency, April 27, 2026), and reports questioning the measure's effectiveness continue to appear (WalasTech, June 10, 2025).

8. The Consumer Act (RA 7394, 1992) and the DTI's role

8.1 Basic policy and division of jurisdiction

RA 7394 sets out five goals: (1) protection against hazards to health and safety, (2) protection against deceptive, unfair, and unconscionable sales acts, (3) information and education, (4) means of redress, and (5) consumer participation in policymaking.

注 (Amendment status confirmed in the 2026-08-26 verification pass) RA 7394 has not simply remained "as it was in 1992." Title IV ("Consumer Credit Transactions"), Articles 131–147, have already been repealed under the repealing clause of RA 11765 (the Financial Products and Services Consumer Protection Act, approved May 6, 2022). The original provision reads: "Articles 131 to 147 of Title IV of Republic Act No. 7394 are hereby repealed." (directly confirmed against the RA 11765 text on LawPhil in the 2026-08-26 pass). The repealed Articles 131–147 cover: Article 131 (declaration of policy), 132 (computation of finance charges), 133 (computation of simple annual interest), 134 (delinquency charges), 135 (deferral charges), 136 (finance charges on refinancing), 137 (right to prepay), 138 (rebates for prepayment), 139 (general disclosure requirements for the cost of credit), 140 (disclosure obligations for credit sales), 141 (disclosure for open-end credit), 142 (disclosure for non-open-end consumer loans), 143 (form and timing of disclosure), 144 (periodic statements), 145 (exempt transactions), 146 (installment sales), and 147 (penalties). It is therefore incorrect to write that "the Philippines' consumer-credit disclosure regime is Article 131 and following of RA 7394." The current basis is RA 11765 (the FCPA) and its implementing rules (issued separately by the BSP, SEC, IC, and CDA). 注LawPhil's copy of RA 7394 shows the original enacted text, including provisions that have since been repealed but are still displayed as-is, so matching LawPhil is no proof that a provision remains current law. 注 A comprehensive revision bill (the Enhanced Consumer Act, including House Bill 5386 of the 20th Congress and others) remains under deliberation and has not been enacted. Do not write that "the Consumer Act has been updated" (source: House Bill 5386 text, docs.congress.hrep.online).

8.2 Key rules

• Product safety and recalls (Article 10, "Injurious, Dangerous and Unsafe Products"): the DOH, DA, and DTI can order a recall, sales ban, or seizure for products found to be "injurious, unsafe, or dangerous" (article heading directly confirmed against the LawPhil original text on 2026-08-25).
• Remedies — repair, replacement, refund (Article 11): where a product is found to be nonconforming to a standard or to have a substantial defect, the responsible regulator may order the manufacturer, distributor, or seller to (1) bring it into conformity or repair the defect, (2) replace it with an equivalent conforming item, or (3) refund the purchase price less an allowance for use. 注 (Corrected in the 2026-08-25 verification pass) the first draft had described this as "Warranty (Article 4 and others): express and implied quality warranties; repair, replacement, or refund available for defective products," but RA 7394 Article 4 is actually "Definition of Terms" — a definitional provision, not a substantive rule on warranties or remedies. It merely contains a definition of "Guarantee" as an express or implied warranty as to the quality of a product or service. The actual basis for repair/replacement/refund is Article 11 (directly confirmed against the LawPhil original text). (Partly resolved as of 2026-08-26) the Warranties chapter of RA 7394 is Title III, Chapter 3, "Consumer Product and Service Warranties." The relevant articles are Article 66 (implementing agency: DTI) / Article 67 (Applicable Law on Warranties — the Civil Code's provisions on conditions and warranties apply) / Article 68 (Additional Provisions on Warranties — requirements for stating express warranties, warranties taking effect from the time of sale, a distributor's obligation to report within 30 days, and the required labeling of "Full warranty"/"Limited warranty") / Article 71 (warranties for services) / Article 72 (prohibited acts) / Article 73 (penalties — a violation of Article 67 draws ₱500–₱5,000 and/or 3 months to 2 years, with license revocation for repeat offenses). 注Whether Article 65 belongs to this chapter or the preceding one is disputed across sources (unresolved). It was also confirmed, via ChanRobles's table of contents, that Title III, Chapter 1 covers Articles 48–60, and Chapter 2 (weights and measures) covers Articles 61–64. 注The text of this chapter's articles cuts off around Article 64 in both LawPhil and ChanRobles, and the original article text could not be reached = primary source not reached. Always verify the article number against the original text when citing it.
• Deceptive sales (Article 50): prohibits false representations about sponsorship, quality, condition, price, or warranties.
• Unconscionable sales (Article 52): prohibits taking advantage of a consumer's "physical or mental infirmity, ignorance, illiteracy, or lack of time" to obtain a grossly one-sided transaction.
• Prohibited schemes: pyramid/chain sales (Article 53), improper referral sales (Article 59).
• Example penalties: product-safety violations (Article 19, "Penalties") ₱1,000–₱10,000 and 2 months–1 year; food/drug violations (Article 41, "Penalties") ₱5,000–₱10,000 and 1–5 years; hazardous substances (Article 47, "Penalties, exception") at least ₱1,000 and 6 months–5 years; deceptive sales (Article 60) ₱500–₱10,000 and 5 months–1 year. 2026-08-25 verification: the headings and fine amounts for Articles 19, 41, and 47 were directly confirmed against the RA 7394 original text on LawPhil (Article 19: "not less than One thousand pesos (P1,000.00) but not more than Ten thousand pesos (P10,000.00)"; Article 41: "not less than Five thousand pesos (P5,000.00) but not more than Ten thousand pesos (P10,000.00)"). 注 Article 60 could not be confirmed, as the retrieved page cuts off around Article 59.

注 Because it was enacted in 1992, the fines are extremely low. Real deterrence is now delivered not by RA 7394's criminal penalties, but by the fines under the ITA (RA 11967), the administrative fines under the FCPA (RA 11765), and DTI's business-permit and blacklist powers. If an older reference book says "Philippine consumer protection tops out at a ₱10,000 fine," that reflects an explanation that looked only at RA 7394.

8.3 The DTI's consumer channels

• Complaint intake: the DTI Customer Contact Center (1-DTI (384) / (632) 7791-3100, ask@dti.gov.ph). Online transactions use the eReport system (operational since November 2024, also accessible via the eGovPH app).
• Price monitoring (e-Presyo, suggested retail prices for basic necessities), the Bagwis Awards, and product standards/conformity (BPS — Bureau of Philippine Standards).
• Complaints about online transactions reached 12,600 as of the end of April 2026 (BusinessWorld Online, June 23, 2026).

9. The Internet Transactions Act (RA 11967, 2023)

9.1 Framework

9.2 Obligations of e-marketplaces and online merchants

• Clearly indicating transaction terms; collecting and publishing seller information (name, address, contact details); maintaining an updated seller list
• Protection of consumer data in line with the DPA ( this is where the ITA and the DPA connect)
• A ban on selling regulated goods without the required license/permit; providing an effective complaint-resolution mechanism

9.3 Subsidiary liability

An e-marketplace bears subsidiary liability where (1) it fails to exercise ordinary diligence with respect to compliance, (2) it fails to promptly take down infringing content after notice, or (3) it fails to provide a seller's contact information where that seller has no legal presence in the Philippines.

→ This provision is why Japanese companies opening a storefront on a Philippine mall platform find themselves subjected to strict identity-document submission and KYC requirements by the mall operator. In practice, Shopee tightened its terms of service in June 2025 (as reported June 25, 2025).

9.4 Fines under RA 11967

9.5 The E-Commerce Trustmark (DAO 25-12)

• Legal basis: RA 11967 and RA 7394. Launched in July 2025 (DTI announcement, July 7–10, 2025).
• The initial registration deadline was set as September 30, 2025 (PNA, September 11, 2025), but after considering an extension (September 19, 2025), the DTI shifted to a policy of making it voluntary through 2026 (reported December 23, 2025). It remains free for MSMEs for now (September 19, 2025).
• As of January 8, 2026, identity verification requires only a government-issued ID (driver's license, PhilSys national ID, passport, TIN, unified SSS ID, or alien registration certificate). The OBD's QR-code verification feature is still under development (trustmark.dti.gov.ph, as of 2026).

注 Reporting from fall 2025 widely circulated the claim that "the Trustmark became mandatory on September 30, 2025," but it has since been relaxed to voluntary status. Be sure to distinguish the old and new versions.

9.6 DTI enforcement, 2025–2026

• August 2025: ordered e-commerce platforms to remove listings for illegal vape products, with sanctions for noncompliance (PNA and others, August 19, 2025)
• January–February 2026: entered into an agreement with TikTok Shop to promote responsible e-commerce (January 31–February 2, 2026)
• March 12, 2026: instructed e-commerce platforms to crack down on counterfeit goods
• March 20–22, 2026: agreement with DSAP (the direct-selling association) on countering online fraud
• February 2026: the FDA partnered with e-commerce platforms on a joint crackdown on unregistered products (ANC, February 5, 2026)

10. The Financial Products and Services Consumer Protection Act (RA 11765, 2022) and AFASA (RA 12010, 2024)

10.1 FCPA (RA 11765)

Approved May 6, 2022. (Amendment status confirmed in the 2026-08-26 verification pass) As of August 2026, no Republic Act amending RA 11765 could be identified. 注Insurance Memorandum Circular No. 2023-02 (effective March 28, 2023, amending Sections 5 and 6 of IMC 2023-01) is an "amendment to the IRR," not an amendment to the statute. English-language articles claiming "the Philippines has amended its financial consumer protection law" sometimes actually refer to this IRR amendment. RA 11765's repealing clause is what repealed Articles 131–147 of RA 7394 (the Consumer Act) (see Section 8.1). The BSP and SEC have adjudicatory authority over purely civil financial transactions with claims not exceeding ten million pesos (original text: "not exceeding the amount of Ten million pesos (P10,000,000.00)"). An award is final and executory, and can be set aside only via a petition for certiorari on grounds such as grave abuse of discretion or lack of jurisdiction (directly confirmed against the RA 11765 text on LawPhil in the 2026-08-26 pass).

• There are four covered regulators: the BSP (central bank), SEC, Insurance Commission, and CDA (Cooperative Development Authority).
• Five protected rights: (1) fair and non-discriminatory treatment, (2) disclosure and transparency, (3) protection of assets (against fraud and misuse), (4) data privacy and protection, and (5) dispute resolution and redress.
• Regulatory powers: restricting the collection of excessive or unreasonable interest/fees, disqualifying responsible officers, issuing suspension orders without prior hearing, halting the operation of a product, ordering restitution, and disgorgement of profits.

The FCPA is effectively "the financial-sector version of the Consumer Act" — complaints involving banks, e-money, insurance, securities, or cooperatives go to the BSP and its counterparts, not the DTI.

10.2 AFASA (RA 12010, 2024)

• The BSP issued AFASA's IRR in June 2025 (BusinessWorld, June 4, 2025). Financial institutions were given until June 2026 to strengthen their fraud-management systems (GMA Network, June 11, 2025).
• On February 20, 2026, the BSP signed an information-sharing agreement with the NBI, CICC, and SEC (GMA Network).

注 "Lending" one's account is a crime. A Japanese national living in the Philippines could be charged with money muling merely for "receiving a friend's remittance in one's own account." Pre-2024 attitudes no longer apply.

11. Online and investment fraud, and the SEC's warning list

• The SEC responds via two tools: Advisories and Cease and Desist Orders (CDOs). An Advisory publicizes that an entity "is not registered" or "has no authority to solicit investments," functioning as a named warning list.
• Major developments in 2025–2026:

• On the law-enforcement side: PNP-ACG arrested over 5,000 people for cybercrime in the first half of 2025 (GMA Network, June 26, 2025). On May 26, 2026, it raided investment-scam hubs in Pasig/Ortigas, arresting 63 people, with the victims mostly elderly (GMA / Daily Tribune).
• On April 29, 2026, the NPC warned about a "call-bot scam" using AI voice cloning (Interaksyon). On August 12, 2026, it stated clearly that "using a real person's face or likeness in AI-generated content is illegal" (Philstar.com). The PNP also said it would track malicious deepfakes (Inquirer.net, August 13, 2026).

注 Not appearing on the SEC's Advisory list does not mean an entity is safe. The SEC only publicizes whether registration exists, and listings are after the fact. In practice, checking all three of the following is realistic: (1) verifying the SEC registration number, (2) checking for a secondary license to solicit investments, and (3) checking whether the entity appears in the DTI Trustmark/OBD listing.

12. Product safety and recalls

• Basis: RA 7394 (Article 10 and others). The DOH (FDA), DA, and DTI can order recalls of products found to be dangerous. In practice, the dominant pattern is a voluntary recall by the company, publicized via an FDA Advisory.
• 2026 examples:
• FDA Advisory No. 2026-0030 (January 13, 2026): voluntary recall of NAN OPTIPRO and NANKID OPTIPRO (fda.gov.ph)
• The FDA partnered with e-commerce platforms on a joint crackdown on unregistered product sales (ANC 24/7, February 5, 2026)
• Consumer groups warned of chemical hazards in "squeeze-type dumpling toys" (Daily Tribune, July 22, 2026)
• On the DTI side, the BPS (Bureau of Philippine Standards) controls the entry point through PS/ICC marks (for mandatory-standard items). 注 Selling mandatory-standard items (electrical products, toys, building materials, etc.) without a PS/ICC mark can trigger an ITA takedown order plus fines.

13. The absence of a class-action system

注 The Philippines does not have a US-style opt-out class action.

• The Rules of Court, Rule 3, Section 12, "Class Suit": "When the subject matter of the controversy is one of common or general interest to many persons so numerous that it is impracticable to join all as parties, a number of them which the court finds to be sufficiently numerous and representative as to fully protect the interests of all concerned may sue or defend for the benefit of all."
• Features: (1) it requires a "single subject matter" of common or general interest; (2) it is more likely to be denied for the kind of consumer harm where each person's damages differ; and (3) there is no opt-out procedure — the court itself determines whether representation is adequate.
• As a result, redress for consumer harm in the Philippines relies heavily on collective administrative remedies: DTI mediation and adjudication (under RA 7394), the NPC's own-motion investigations and nominal damages, restitution orders from the BSP and others under the FCPA, and SEC CDOs and asset freezes.
• The implication for Japanese companies: "the risk of a massive class-action lawsuit is low, but the risk of regulatory sanctions and a business suspension is high" — the risk profile is the mirror image of the US. Even in data-breach cases, what actually bites a business is the NPC's processing-ban order plus revenue-proportional fines, more than damages awards.

14. The impact of the 2026 Middle East conflict (from February 28)

There has been no direct change in law, but the impact on consumer protection and fraud is clear.

Practical implications for consumer protection: (1) in a period of rising prices, scams promising "high-yield investment" or "side-gig task rewards" tend to increase (these are precisely the two dominant categories in SEC warnings in 2026); (2) reduced remittances and repatriation risk among Middle East-based OFW households push up demand for online lending, along with the associated misuse of personal data and public shaming during debt collection (the PNP's 47,000 complaints, March 2026); (3) 注 however, no official statistic quantifying a causal link between the Middle East conflict and the number of fraud cases in the Philippines could be confirmed as of August 25, 2026. The inference of correlation should not be pushed further than that.

15. A practical checklist for Japanese companies

16. Principal sources (those with confirmed original texts)

• Statutory texts: lawphil.net (RA 10173 / RA 7394 / RA 11765 / RA 11934 / RA 11967 / RA 12010, Rules of Court Rule 3 Section 12)
• National Privacy Commission (NPC): privacy.gov.ph — the Advisories & Circulars listing, DPA guidance pages, the IRR, NPC Circular 2022-01 (administrative fines) PDF, NPC Circular 2022-04 (registration/DPO) PDF, NPC Advisory 2024-01 (MCC) PDF, NPC Advisory 2026-01 (data scraping) PDF, the Decisions listing
• DTI: dti.gov.ph, trustmark.dti.gov.ph (E-Commerce Trustmark)
• FDA: fda.gov.ph (Advisory No. 2026-0030)
• News reporting: Philippine News Agency, BusinessWorld Online, Inquirer.net, Philstar.com, Rappler, GMA Network, Manila Bulletin, The Manila Times, Daily Tribune, ABS-CBN, Newsbytes.PH, Manila Standard, Philippine Information Agency, SCMP, BitPinas, Fintech News Philippines, Biometric Update, Tech in Asia, AFR (accessed via Google News RSS)

注 Items marked "unconfirmed" in this article (the amount of the Metro Retail fine, the details of the Supreme Court decision against FCash, the number of the new PIA-related rule reported in August 2026, the confirmed number of records affected in the LTO breach, and official confirmation of the NTC breach) should be updated once the original texts are published.

日本語の詳細版: 分野「投資制度・経済特区・許認可」「データ保護と消費者保護」（本サイト日本語版）。