Overview of the NPC draft Circular on Data Subject Requests
Could your team answer a data request in 30 days? A draft National Privacy Commission circular, now under public consultation, would put that clock on every request.
A data subject request is what happens when a customer, employee or applicant asks to see, correct, delete or object to the use of their personal data. The Data Privacy Act already gives people these rights. What the NPC's draft Circular on Data Subject Rights would add is a set of fixed periods and procedures for honoring them.
As drafted, an organization would acknowledge a request within 15 calendar days of receipt and resolve it within 30, with one extension for exceptional cases. The draft would also generally bar fees, stop organizations from refusing a request only because their own form was not used, and require records of every request.
This is a proposal. It has no number or date yet, and the text may change before it is issued.
So what for a Philippine organization? If the periods survive consultation, the hard part will not be the law. It will be operations: knowing where requests arrive, who owns them, and how quickly a service provider can retrieve the data.
What we suggest preparing now (our suggestions, not requirements of the draft):
1. Map every channel where a request can arrive, including email, branches, chat and social media.
2. Name one owner and keep a simple log with dates.
3. Check whether your outsourcing agreements say who does what, and by when.
4. Time one test request from receipt to reply.
The NPC's in-person consultation is on 19 October 2026. Follow PrivaLex and we'll tell you what changes.
Source: NPC, draft Circular on Data Subject Rights and Notice of Public Consultation, privacy.gov.ph.
