If you work with an assistant in the Philippines, your data is being accessed from a country with its own privacy law: the Data Privacy Act of 2012 (Republic Act No. 10173). This overview explains, in plain English, what the law is, why it matters to US companies, and practical steps to take. It is general information, not legal advice — consult counsel for your situation.
What the law is
The Data Privacy Act (DPA) establishes rules for processing personal information in the Philippines and created the National Privacy Commission (NPC), the regulator responsible for administering and enforcing it. The NPC publishes the law, its implementing rules and guidance on its website (privacy.gov.ph).
The law is built around familiar principles that will be recognizable to anyone who knows other modern privacy laws:
- Transparency: people should know how their data is processed.
- Legitimate purpose: processing must have a lawful, declared purpose.
- Proportionality: process only what's necessary for the purpose.
It also distinguishes ordinary personal information from sensitive personal information (such as health, government-issued identifiers and certain other categories), which carries stricter rules.
Why it matters to a US company
When a Philippines-based assistant accesses your systems, personal data — your customers', employees' or contacts' — is being processed in the Philippines. Depending on the arrangement, your provider and its personnel may have obligations under the DPA as personal information processors or controllers.
Practically, this means:
- Your provider should have contracts with its personnel that address confidentiality and data protection.
- Your agreement with the provider should address how your data is processed, security measures and what happens at termination.
- Security incidents involving personal data may trigger obligations under the DPA and its rules, in addition to any obligations you have under US law.
How it interacts with US rules
The DPA doesn't replace your US obligations. If you're subject to US sector rules — HIPAA for health information, for example — those continue to apply. For health data, HHS explains that service providers handling protected health information on behalf of a covered entity are generally business associates who require a BAA (HHS).
Think of it as layering: US obligations follow your data and your business; Philippine obligations apply to processing in the Philippines.
Practical steps for US companies
1. Map what data the assistant will touch
List the systems and data types: email, calendar, CRM contacts, financial records, health data. Identify anything sensitive.
2. Minimize
Give access only to what's needed. If the assistant manages your calendar, they don't need your HR system. Proportionality is both a DPA principle and good security.
3. Put it in writing
Your agreement with the provider should cover:
- Confidentiality and permitted use
- Security measures (access control, MFA, device standards)
- Incident notification
- Return or deletion of data at the end of the engagement
- Subcontracting rules
4. Confirm the provider's own controls
Ask how the provider:
- Engages personnel and what agreements they sign
- Trains staff on privacy and security
- Enforces device and access standards
- Handles incidents
ExecWing's assistants sign confidentiality and data-privacy agreements aligned with the DPA and client requirements; see Security.
5. Keep data in your systems
The simplest way to reduce risk is to keep work inside your own cloud tools, with named accounts you control, rather than files copied to personal devices.
6. Plan offboarding
Revoke access the same day an engagement ends, rotate shared credentials and confirm deletion of any local copies.
Common questions
Does the DPA mean my data is less safe in the Philippines? No. The DPA is a modern privacy law with an active regulator. Data safety depends far more on practical controls — access, MFA, devices, training — than on geography.
Do I need to register with the NPC? Registration obligations depend on the nature and scale of processing and typically fall on entities operating in the Philippines. Ask your provider how they handle it, and ask counsel if you're unsure about your own position.
Can I require US-only data storage? Usually yes — if your assistant works inside your US-hosted cloud tools, data stays in those systems; the assistant accesses it remotely. Contracts can reinforce this.
A worked example: who is the controller?
Under the Data Privacy Act of 2012 (Republic Act No. 10173), roles matter. The law distinguishes a personal information controller (PIC), who decides how and why data is processed, from a personal information processor (PIP), who processes data on the controller's behalf.
| Scenario | Likely role of the US company | Likely role of the Philippine provider |
|---|---|---|
| A US company's assistant in Manila manages the US company's CRM of US customers | Controller of that customer data | Processor, acting on instructions |
| The Philippine provider collects and stores its own employees' records, including the assistant's | — | Controller of its employee data |
| The US company receives the assistant's resume and ID to approve the placement | Controller of that limited data | Provider shares as controller |
These are general illustrations, not legal advice. Your contracts and actual practice decide the roles. Ask counsel to confirm.
What the provider should be able to show you
- A designated Data Protection Officer, as the National Privacy Commission requires
- Registration with the NPC where its thresholds apply
- Written privacy and security policies covering staff, devices and access
- Breach-handling procedures. NPC rules require notifying the Commission and affected people of certain breaches within 72 hours of knowledge
- Data-sharing or outsourcing agreements that set out each party's responsibilities
Checklist: contract clauses to discuss with counsel
- [ ] Roles of each party (controller or processor) for each data category
- [ ] Processing only on documented instructions
- [ ] Confidentiality obligations for every person with access
- [ ] Security measures: named accounts, MFA, device controls, access logging
- [ ] Breach notification to you within a set number of hours
- [ ] Subcontracting only with your approval
- [ ] Return or deletion of data at the end of the engagement
- [ ] Cooperation with audits and regulatory requests
How US obligations stack on top
The DPA doesn't replace US rules. If the work involves health information, HIPAA business-associate requirements still apply. Customer financial information may fall under the FTC Safeguards Rule. US state privacy laws may also apply to your customers' data, regardless of where your assistant sits. In practice, the strictest applicable standard sets the bar, and the same controls (least privilege, MFA, named accounts, logging) satisfy most regimes at once.
The bottom line
The Philippine Data Privacy Act gives data protection a clear legal footing for work done in the Philippines. For US companies, the practical takeaway is to minimize access, put data-protection terms in writing, confirm your provider's controls and keep work inside your systems.
Read the remote assistant security checklist or ExecWing's security approach.
Sources
- National Privacy Commission, Data Privacy Act of 2012.
- National Privacy Commission, privacy.gov.ph.
- HHS, Business Associates FAQ.
- National Privacy Commission, NPC Circular 16-03: Personal Data Breach Management.
- Federal Trade Commission, FTC Safeguards Rule: What Your Business Needs to Know. ---SOURCES---
Want a dedicated assistant who already knows this playbook?
ExecWing places full-time, managed assistants from the Philippines with US leaders. Month-to-month, from $1,900/mo. See pricing or how it works.
Book a 20-minute fit call