Europe's data protection regulators set out their view of smart glasses on 13 October 2026. In the Philippines, the National Privacy Commission already has a rule in force that names smart eyeglasses and smart watches. Here is what it asks, and what we at PrivaLex suggest you do before the first pair arrives at work. *

From 1 January 2027, a Californian who asks a business to delete their data can reach information the business got from other sources, not only what they handed over themselves. The law binds the US business. Philippine BPOs, IT-BPM firms and vendors will feel it through their contracts and the deletion instructions that follow.

AI can make the decision. But your company may have to explain it.

Could your team answer a data request in 30 days? A draft National Privacy Commission circular, now under public consultation, would put that clock on every request.

In September 2026, Ireland's data protection regulator fined Google Ireland Limited €403 million over how it handled users' location data. Nothing was hacked and nothing leaked. For Philippine organizations, the lesson is close to home: tell people clearly what you do with their data.

The National Privacy Commission has made it clear that registration is not a formality. Here is a simple guide to who must register under NPC Circular No. 2022-04, what the rules expect once you do, and a six-step check you can run this month.

The National Privacy Commission has given organizations until 10 November 2026 to file their Annual Security Incident Report for 2025. Here is who must file, what goes into the report, and a seven-step way to get it done properly, even if nothing went wrong last year.