Stiff penalties are provided in the Philippine Data Privacy Law for non-compliance Summary: 1) Data Privacy Law has severe penalties for non-compliance. 2) Penalties are harsher when violations involve sensitive personal information compared to personal information. 3) Public officers and employees, as well as private individuals who are responsible officers in juridical entities, are made liable. 4) The law provides for a combination or series of acts that could result in increasing the penalty. 5) Maximum penalty is imposed for large scale offense when at least 100 persons are harmed, affected, or involved.

1. Penalties for Non-Compliance
with Data Privacy Law
Basics of Philippine Data Privacy Law
for Non-Lawyers

2. Unauthorized processing of
Personal Information
Unauthorized Processing of Personal Information:
• Without the consent of the data subject
• Without being authorized by the Data Privacy Law or any other law
Reference: Section 25 (a), R.A. 10173
PENALTIES
Imprisonment Fine
1 year to 3 years Php500K – Php2M
Notice: Both are imposed – i.e. imprisonment and fine

3. Unauthorized processing of
Sensitive Personal Information
Unauthorized Processing of Sensitive Personal Information:
• Without the consent of the data subject
• Without being authorized by the Data Privacy Law or any other law
Reference: Section 25 (b), R.A. 10173
PENALTIES
Imprisonment Fine
3 years to 6 years Php500K – Php4M
Notice: Both are imposed – i.e. imprisonment and fine

4. Accessing of
Personal Information
Providing access to Personal Information – Due to Negligence:
• Without being authorized by the Data Privacy Law or any other law
Reference: Section 26 (a), R.A. 10173
PENALTIES
Imprisonment Fine
1 year to 3 years Php500K – Php2M
Notice: Both are imposed – i.e. imprisonment and fine

5. Accessing of
Sensitive Personal Information
Providing access to Sensitive Personal Information – Due to Negligence:
• Without being authorized by the Data Privacy Law or any other law
Reference: Section 26 (b), R.A. 10173
PENALTIES
Imprisonment Fine
3 years to 6 years Php500K – Php4M
Notice: Both are imposed – i.e. imprisonment and fine

6. Improper disposal of
Personal Information
Improper disposal of Personal Information – Knowingly or Negligently:
• Dispose, Discard or Abandon the personal information of an individual
in an area accessible to the public; or
• Has otherwise placed the personal information of an individual in its
container for trash collection.
Reference: Section 27 (a), R.A. 10173
PENALTIES
Imprisonment Fine
6 months to 2 years Php100K – Php500K
Notice: Both are imposed – i.e. imprisonment and fine

7. Improper disposal of
Sensitive Personal Information
Improper disposal of Sensitive Personal Information – Knowingly or
Negligently:
• Dispose, Discard or Abandon the personal information of an individual
in an area accessible to the public; or
• Has otherwise placed the personal information of an individual in its
container for trash collection.
Reference: Section 27 (b), R.A. 10173
PENALTIES
Imprisonment Fine
1 year to 3 years Php100K – Php1M
Notice: Both are imposed – i.e. imprisonment and fine

8. Processing for unauthorized purposes of
Personal Information
Processing of Personal Information:
• For purposes not authorized by the data subject; or
• Otherwise authorized under the Data Privacy Law or existing law.
Reference: Section 28, R.A. 10173
PENALTIES
Imprisonment Fine
6 months to 5 years Php500K – Php1M
Notice: Both are imposed – i.e. imprisonment and fine

9. Processing for unauthorized purposes of
Sensitive Personal Information
Processing of Sensitive Personal Information:
• For purposes not authorized by the data subject; or
• Otherwise authorized under the Data Privacy Law or existing law.
Reference: Section 28, R.A. 10173
PENALTIES
Imprisonment Fine
2 years to 7 years Php500K – Php2M
Notice: Both are imposed – i.e. imprisonment and fine

10. Unauthorized Access or Intentional Breach
Breaking – in any way – into any system where personal and sensitive
personal information is stored:
• Knowingly or and unlawfully; or
• Violating data confidentiality and security data systems
Reference: Section 29, R.A. 10173
PENALTIES
Imprisonment Fine
1 year to 3 years Php500K – Php2M
Notice: Both are imposed – i.e. imprisonment and fine

11. Concealment of Security Breaches Involving Sensitive Personal Information
Sensitive Personal Information
After having knowledge of a security breach and of the obligation to notify
the National Privacy Commission pursuant to Section 20 (f):
• Intentionally or by omission, conceals the fact of such security breach
Reference: Section 30, R.A. 10173
PENALTIES
Imprisonment Fine
1 year and 6 months to 5 years Php500K – Php1M
Notice: Both are imposed – i.e. imprisonment and fine

12. Malicious Disclosure
Any personal information controller (PIC) or personal information processor
(PIP) or any of its officials, employees or agents, who:
• With malice or in bad faith,
• Discloses unwarranted or false information relative to any personal
information or personal sensitive information obtained by him or her
Reference: Section 31, R.A. 10173
PENALTIES
Imprisonment Fine
1 year and 6 months to 5 years Php500K – Php1M
Notice: Both are imposed – i.e. imprisonment and fine

13. Personal Information’s
Unauthorized Disclosure
Any personal information controller (PIC) or personal information processor
(PIP) or any of its officials, employees or agents, who:
• Discloses to a third party personal information not covered by the
immediately preceding section (on Malicious Disclosure)
• Without the consent of the data subject
Reference: Section 32 (a), R.A. 10173
PENALTIES
Imprisonment Fine
1 year to 3 years Php500K – Php1M
Notice: Both are imposed – i.e. imprisonment and fine

14. Sensitive Personal Information’s
Unauthorized Disclosure
Any personal information controller (PIC) or personal information processor
(PIP) or any of its officials, employees or agents, who:
• Discloses to a third party sensitive personal information not covered by
the immediately preceding section (on Malicious Disclosure)
• Without the consent of the data subject
Reference: Section 32 (b), R.A. 10173
PENALTIES
Imprisonment Fine
3 years to 5 years Php500K – Php2M
Notice: Both are imposed – i.e. imprisonment and fine

15. Combination or Series of Acts
For any combination or series of acts of the violations mentioned in the
preceding slides:
Reference: Section 33, R.A. 10173
PENALTIES
Imprisonment Fine
3 years to 6 years Php1M – Php5M
Notice: Both are imposed – i.e. imprisonment and fine

16. Liability: Responsible Officers
If the offender is a corporation, partnership or any juridical person, the penalty shall be imposed upon the
responsible officers, as the case may be, who participated in, or by their gross negligence, allowed the
commission of the crime. If the offender is a juridical person, the court may suspend or revoke any of its
rights under this Act. If the offender is an alien, he or she shall, in addition to the penalties herein
prescribed, be deported without further proceedings after serving the penalties prescribed. If the offender
is a public official or employee and he or she is found guilty of acts penalized under Sections 27 and 28 of
this Act, he or she shall, in addition to the penalties prescribed herein, suffer perpetual or temporary
absolute disqualification from office, as the case may be.
By default, responsible officers are made liable for juridical entities.
Reference: Section 34, R.A. 10173

17. Large Scale: Maximum Penalty
The maximum penalty in the scale of penalties respectively provided for the preceding offenses shall be
imposed when the personal information of at least one hundred (100) persons is harmed, affected or
involved as the result of the above mentioned actions.
Benchmark for imposing maximum penalty: 100 persons.
Reference: Section 35, R.A. 10173

18. Public Officers
When the offender or the person responsible for the offense is a public officer as defined in the
Administrative Code of the Philippines in the exercise of his or her duties, an accessory penalty
consisting in the disqualification to occupy public office for a term double the term of criminal penalty
imposed shall he applied.
Double-term disqualification to occupy public office for any public officer
found liable. The term is based on the criminal penalty imposed.
Reference: Section 36, R.A. 10173

19. Restitution
Restitution for any aggrieved party shall be governed by the provisions of the New Civil Code.
Complainants may seek restitution against the offenders as may be
provided by the Civil Code. This may be in the form damages.
Reference: Section 37, R.A. 10173

20. Summary
1) Data Privacy Law has severe penalties for non-compliance.
2) Penalties are harsher when violations involve sensitive personal
information compared to personal information.
3) Public officers and employees, as well as private individuals who are
responsible officers in juridical entities, are made liable.
4) The law provides for a combination or series of acts that could result in
increasing the penalty.
5) Maximum penalty is imposed for large scale offense when at least 100
persons are harmed, affected, or involved.

21. Basics of Philippine Data Privacy Law
for Non-Lawyers
Atty. Jericho B. Del Puerto
SME Business Lawyer
For inquiries, comment, or permission to use slides, send us an email : info@jdpconsulting.ph.
Penalties for Non-Compliance
with Data Privacy Law