top of page
Search

Smart glasses at work: the Philippine rule is already in place

Oct 19
6 min read

Europe's data protection regulators set out their view of smart glasses on 13 October 2026. In the Philippines, the National Privacy Commission already has a rule in force that names smart eyeglasses and smart watches. Here is what it asks, and what we at PrivaLex suggest you do before the first pair arrives at work.

Key Takeaways

  • On 13 October 2026 the European Data Protection Board (EDPB) adopted a Statement on Smart glasses. It is guidance, not binding law, but EU clients and auditors will read it.

  • NPC Circular No. 2025-01 (26 May 2025) covers body-worn cameras and "alternative recording devices", whose examples include smart watches and smart eyeglasses.

  • The Circular is not only for police and security guards. It applies to recording for training, quality control, monitoring, assessment, evaluation and audit.

  • Duties include a privacy impact assessment, a visible recording indicator, annual training, controlled access, encryption, a 30-calendar-day retention period for non-law-enforcement users, and secure deletion.


What happened in Europe


The EDPB describes its statement as preliminary reflections. Its main points:

  • Several parties can be responsible. The device maker, an AI provider and the wearer can each be a controller (the party accountable for the data), alone or jointly.

  • The personal-use exemption is narrow. Once glasses are used for professional or other non-personal activities, the wearer can be a controller.

  • Makers and AI providers keep their own duties. When they act as controllers, they cannot rely on the wearer to meet their obligations.

  • Bystanders may not know they are being recorded. The EDPB recommends visible indicators, such as an LED light, combined with other signals, and no recording when the indicator is covered.

  • Legitimate interests needs careful case-by-case analysis. This legal basis weighs the organization's interest against people's rights. The EDPB says a fair balance would be particularly difficult to show for training AI on bystanders' data, because bystanders would not expect it.

  • Workplaces and children need care. Workplace use may raise employee-monitoring concerns, and children need particular attention.


What the Philippine rule says


NPC Circular No. 2025-01, Guidelines on the Processing of Personal Data Collected Using Body-Worn Cameras (26 May 2025), already answers most of these questions.


Who and what it covers (Sections 1 and 2).

  • It applies to personal information controllers and processors that use body-worn cameras or alternative recording devices.

  • An alternative recording device is a camera-equipped device, other than a body-worn camera, that can record audio-visual material. The Circular's examples include digital cameras, mobile phones, action cameras, smart watches and smart eyeglasses.

  • Purely personal, family or household use is outside its scope, but only where it is not for profit and the footage is not shared online.


Uses beyond law enforcement (Section 3.C). Recording for training, quality control, monitoring, assessment, evaluation, audit and related purposes must have a lawful basis, follow the general privacy principles, have safeguards and respect data subject rights. Under the Data Privacy Act of 2012 (RA 10173), that means:

  • a lawful basis under Section 12, or Section 13 for sensitive personal information

  • the principles of transparency, legitimate purpose and proportionality in Section 11


Safeguards (Section 4). The Circular requires:

  • documented training at least once a year and at onboarding

  • access to recordings for authorized personnel only, backed by a security clearance or similar authorization, with a copy filed with the data protection officer

  • device features:

    • a standard, open, non-proprietary format

    • export in the original format without loss of quality or metadata

    • protection from editing or deletion

    • date, time and location stamps

    • a visual recording indicator clearly visible to those being recorded

  • encryption in storage and transmission

  • a policy on downloading, transmitting and storing recordings


This builds on the security duty in Section 20 of RA 10173.


Retention (Section 4). Organizations other than law enforcement and public authorities keep recordings for 30 calendar days, or longer where another law or regulation requires it. Disposal must be secure, including backups.


People's rights (Section 5).

  • The rights in Sections 16 to 18 of RA 10173 apply.

  • People must be told they are being recorded. The only exception is narrow: where telling them would be impractical, dangerous or impossible for a specific police operation, other law enforcement activity or analogous circumstances.

  • Third parties in footage are masked before release.

  • The organization must give its reasons for any delay in acting on an access request.


Privacy impact assessment (Section 6). A PIA is required before adopting these devices, or within a reasonable time after, and again when the governing law, regulations or relevant NPC issuances change. PIAs are regularly reviewed. Under Section 7, data protection officers regularly review internal policies, and under Section 8, doubts in interpreting the Circular are resolved liberally, with the rights and interests of the people recorded in mind.


One distinction. The Circular's signage or warning-light requirement sits in Section 3.A, on law enforcement and security. For other organizations, the Section 4 recording indicator and the Section 5 duty to inform do that work.


The AI question


The Circular does not mention artificial intelligence. Many smart glasses send images to an AI assistant. That is processing under RA 10173, and depending on who decides how the images are used, the provider may be a personal information processor or a controller in its own right.


NPC Advisory No. 2024-04 (19 December 2024) confirms that the Data Privacy Act and NPC issuances apply when personal data is processed in developing or deploying AI systems, including training and testing. Before approving glasses with an AI feature, find out where images go, whether they are stored and whether they train models.


Why it matters


SMEs and growing companies. A retail supervisor or field technician filming a job for quality checks is covered by Section 3.C. A short policy, a PIA and a 30-day deletion routine suit a small team.


Enterprises and regulated sectors. Hospitals, banks and schools handle sensitive information. The EDPB singles out medical facilities and places where children are present.


BPOs, IT-BPM and multinationals. On a contact-centre floor, glasses can capture screens holding a client's customer data. EU clients reviewing vendors will use the EDPB statement as a reference point. A vendor that can show a device policy, a PIA and retention controls answers quickly, and earns the trust to keep competing globally.


What to do now


This checklist is our practical guidance at PrivaLex, not the NPC's.


  1. Decide your position: allow, restrict or ban wearable cameras, by area and role.

  2. Take inventory of devices in use, including personal ones used for work.

  3. Run a PIA before approving any use, as Section 6 of the Circular requires.

  4. Record the basis: note the lawful basis and the specific purpose for each approved use.

  5. Check each device against Section 4. If it cannot show a visible indicator or protect recordings from editing or deletion, do not approve it for work recording.

  6. Tell people: let staff, customers and visitors know when recording happens.

  7. Set no-record zones: restrooms, changing rooms, clinics and screens showing client data.

  8. Handle AI features: switch them off, or first vet the AI provider's processing, storage and model-training terms.

  9. Set 30-day deletion, including backups, unless another law or regulation requires longer retention.

  10. Train staff yearly and at onboarding, and file access authorizations with your DPO.


Frequently asked questions


Do employees' own smart glasses count? Yes, when used for work. The household exclusion covers only purely personal use that is not for profit and not shared online.


Does the EDPB statement apply in the Philippines? No. It is EU guidance. It matters because EU clients and auditors may apply it when reviewing Philippine vendors.


Is 30 days a minimum or a maximum? The Circular sets 30 calendar days for non-law-enforcement users, or longer where another law or regulation requires it. In our view, longer retention without such a basis is hard to justify.


Do we need consent to record? Not always. The Circular requires a lawful basis under the Data Privacy Act, which need not be consent.


Talk to us

If wearable cameras or AI glasses are coming into your workplace, we at PrivaLex can help you scope the PIA, policy and controls. Book a scoping call or message us at privalex.com.ph.


Sources


 
 
PrivaLex Consulting Group logo

9th Floor Robinsons Cyberscape Gamma, Topaz and Ruby Roads, Pasig 1605 Philippines

Contact Us
hello@privalex.com.ph

Join our mailing list.

Sign up with your email address to get the latest news and updates on privacy, data security, regulatory developments, and AI governance.

FOLLOW US 

  • LinkedIn
  • Facebook
  • Instagram
bottom of page