The National Privacy Commission (NPC) of the Philippines has issued an important advisory clarifying provisions of its 2020 Circular No. 2020-03 concerning Data Sharing Agreements (DSAs). This advisory aims to address common queries and misconceptions surrounding data sharing practices and the execution of DSAs among personal information controllers (PICs).
Data sharing, an essential aspect of data processing, must always be grounded in lawful bases provided by the Data Privacy Act (DPA) of 2012. This includes criteria for lawful processing found in Sections 12 and 13 of the DPA, as well as special cases under Section 4. A DSA is a formal document outlining terms and conditions between parties in a data sharing arrangement but does not itself confer authority or serve as a legal basis for processing personal data.
Most notably, the NPC clarifies that the execution of a DSA is optional—not mandatory—for lawful data sharing. While DSAs are encouraged as a demonstration of accountability and good faith in compliance with the DPA and related issuances, their execution should facilitate rather than obstruct lawful data sharing activities. The advisory also highlights that personal data sharing already authorized or required by law is not prohibited or limited by these clarifications.
Furthermore, the advisory confirms that the NPC does not require pre- or post-execution review or approval of DSAs. Instead, the Commission may review the data sharing activity itself on its own initiative or in response to verified complaints from data subjects.
The NPC advises that any interpretation doubts should favor protecting the rights and interests of data subjects, underscoring the importance of placing data privacy at the forefront of all personal data processing activities.
This advisory is a significant step in providing clearer guidance to organizations managing personal data, balancing the need for operational flexibility with the commitment to privacy protection under Philippine law.
Issued on June 26, 2025, the clarification reinforces the NPC’s role in ensuring that data sharing conforms to legal standards while encouraging transparency and accountability among PICs.
For organizations and institutions engaged in data sharing, this advisory serves as a timely reminder to align their data handling practices with legislative frameworks, emphasizing lawful bases and responsible data governance over formalistic document execution.
By fostering better understanding and compliance, the NPC continues to safeguard the privacy rights of Filipino citizens in an increasingly data-driven world.
[This article is based on the official advisory released by the National Privacy Commission, Reference No. PDD-25-00268, dated June 26, 2025.]
If you need help drafting your Data Sharing Agreement, you can send a question or start the process by clicking here. Documents will be drafted and delivered via email within 3 to 7 business days upon
1. Completion of this form, and
2. Verified receipt of payment.
Link to Legal Document Drafting Request Form (For Data Privacy & Website/App Compliance): https://forms.gle/3UGEvF9rJVVWyZCQ8
attystela.com 