Who must register with the NPC? What the latest enforcement means for your organization

The National Privacy Commission has made it clear that registration is not a formality. Here is a simple guide to who must register under NPC Circular No. 2022-04, what the rules expect once you do, and a six-step check you can run this month.

Key takeaways

• You must register your data processing systems with the NPC if you employ 250 or more people, process sensitive personal information of 1,000 or more individuals, or run processing likely to risk people's rights and freedoms.

• Any system that uses automated decision-making or profiling must be registered in all cases, whatever your size.

• If you are not covered and choose not to register voluntarily, you still owe the NPC a sworn declaration.

• Registration lasts one year. Renewal, updates, and display of your NPC seal follow fixed timelines.

• The NPC's September 2026 show-cause orders show that it is enforcing the rules, including against organizations headquartered abroad.

What happened

On 22 September 2026, the National Privacy Commission (NPC) announced that it had issued show-cause orders to four global digital platforms for "non-compliance with applicable registration requirements" under the Data Privacy Act of 2012 (Republic Act No. 10173) and NPC Circular No. 2022-04. A show-cause order asks an organization to explain itself; it is not a finding of violation. The NPC also said it would step up its monitoring of digital platforms across registration, transparency, lawful processing, data subject rights, accountability, and security.

If the NPC is checking the registration status of some of the world's largest platforms, a Philippine company, BPO, or school should expect the same question and be ready to answer it quickly.

What the rule says

The governing rule is NPC Circular No. 2022-04 (5 December 2022), on registering data processing systems, notifying automated decision-making, designating data protection officers, and the NPC Seal of Registration. In practical terms, a "data processing system" is any set-up you use to handle personal data for a purpose: HR and payroll, your CRM, patient records, a contact-center platform you run for a client.

Who must register (mandatory registration)

Under Section 5, a personal information controller (PIC, the organization that decides why and how data is used) or personal information processor (PIP, the organization that processes data on someone else's behalf) must register all of its data processing systems if it:

1. employs 250 or more persons; or

2. processes sensitive personal information of 1,000 or more individuals (for example, health, government ID numbers, or details about age, marital status, or education); or

3. processes data that will likely pose a risk to the rights and freedoms of data subjects.

These are alternatives: meeting any one of them is enough. A 40-person clinic or a small HR outsourcing firm can be covered through the 1,000-record test alone.

The circular does not put a number on the third test, so it calls for judgment. In our view, organizations that profile customers, monitor employees at scale, handle children's data or run financial or health services should assume they are covered unless a documented assessment says otherwise.

The automated decision-making rule

Section 5(A) adds a rule that many organizations miss: a data processing system that involves automated decision-making or profiling must be registered "in all instances", whatever the organization's size. When you register it, the NPC expects information such as the lawful basis, retention period, methods and logic used, and decisions that may affect people's rights and freedoms. Credit scoring, automated fraud flags, AI-assisted hiring screens and contact-center productivity scoring can all fall within this rule.

If you are not covered

Section 6 allows organizations that fall outside Section 5 to register voluntarily. If you are not covered and do not register voluntarily, you must submit a sworn declaration instead. Since 1 October 2024, you can do this online through the NPC Registration System (NPCRS) as a Sworn Declaration and Undertaking for Exemption. "We're too small to register" is therefore not the end of the matter: you still need to file.

Timelines, renewal and display

• New systems and your first DPO: register within 20 days of the system going live or the DPO's appointment taking effect (Section 7).

• Changes: minor updates within 10 days; major amendments within 30 days of the change taking effect (Section 16).

• Renewal: the Certificate of Registration is valid for one year, and you can file a renewal only within the 30 days before it expires (Section 18). If it lapses without renewal, you are treated as unregistered (Section 17).

• Seal of Registration: display it at the main entrance of your place of business and on your main website. For global websites, include it on at least the Philippines page (Section 32).

• Fees: Under NPC Circular No. 2023-01 (17 May 2023), effective 1 October 2024, initial registration for organizations is PHP 500 to PHP 2,500, and renewal is PHP 350 to PHP 1,000, depending on classification.

What can non-registration cost?

Section 20 of Circular 2022-04 links non-registration to the NPC's Guidelines on Administrative Fines (NPC Circular No. 2022-01, 8 August 2022). Failure to register the data processing system or information on automated decision-making carries a fine of PHP 50,000 to PHP 200,000, and the NPC can also issue compliance orders and, in some cases, cease-and-desist orders.

Why this matters for Philippine organizations

SMEs and growing companies. The 1,000-record test catches more small businesses than owners expect, especially clinics, schools, lending businesses, and HR-heavy firms. Registration is also usually the first thing a larger customer's vendor questionnaire asks about.

Enterprises and regulated sectors. Banks, hospitals and universities typically meet more than one test. The risk is less about whether you register and more about keeping registration accurate: new systems, mergers, a change of DPO, or an AI tool rolled out without anyone updating the NPC record.

BPOs, IT-BPM, and multinationals. Processors are covered too. The NPC's action against foreign-headquartered platforms also shows that it looks at who processes the personal data of people in the Philippines, not only at where a company is incorporated. For BPOs, the automated decision-making rule deserves particular attention: workforce analytics and AI-driven QA scoring are growing fast, and so are global clients' questions about them.

What to do now: a six-step registration check

1. Run the coverage test. Count employees, estimate how many individuals' sensitive personal information you process, and write down whether any processing is likely to pose a risk. Keep the analysis on file.

2. Inventory your systems. List every data processing system, including cloud tools and systems you run for clients. Mark any that involve automated decision-making or profiling; you must register those regardless.

3. Check your NPCRS record. Log in to the NPC Registration System and confirm that your DPO, systems, and contact details are current. Use an official DPO email address tied to the role, not to a person.

4. Diarize renewal. Note your certificate's expiry date and open the renewal window 30 days before it.

5. Display your seal. Check the main entrance and your website (or your Philippine page, if you run a global site).

6. If you are exempt, file the sworn declaration. Then review the decision whenever headcount, data volumes, or systems change.

While you're in compliance mode: separately from registration, all PICs and PIPs must file their 2025 Annual Security Incident Report through the NPC's Data Breach Notification Management System by 10 November 2026, including a "zero incident" report if nothing happened (NPC Advisory No. 2026-03, 8 September 2026).

Registration and the trust global clients look for

International clients increasingly ask Philippine providers to show, not just say, that they meet local law. A current NPC registration, a named DPO, and a visible Seal of Registration are among the easiest proofs to give, and a sign that your privacy program is maintained, not filed away. Getting the basics visibly right is part of how Philippine organizations earn the trust to compete globally.

Frequently asked questions

We have fewer than 250 employees. Are we exempt? Not automatically. You must still register if you process sensitive personal information of 1,000 or more individuals, if your processing is likely to pose a risk to people's rights and freedoms, or if any system involves automated decision-making or profiling. If none applies, you file a sworn declaration instead.

Do personal information processors (such as BPOs) need to register? Yes. Circular 2022-04 applies to both PICs and PIPs that meet the Section 5 criteria.

How long does registration last? One year from issuance. You can file a renewal only within the 30 days before expiry. A lapsed certificate means you are treated as unregistered.

Is registration the same as being compliant with the Data Privacy Act? No. Registration is one obligation among many. It sits alongside privacy notices, security measures, breach management, data subject rights and the annual security incident report.

Talk to us

If you're unsure whether your organization is covered, or your NPC record hasn't kept up with your systems, we at PrivaLex can help you work through the coverage test and the six steps above. Message us or book a short scoping call at www.privalex.com.ph.

Sources

• National Privacy Commission, Statement on intensified oversight of digital platforms to protect children's privacy, 22 September 2026: https://privacy.gov.ph/statement-of-the-national-privacy-commission-on-intensified-oversight-of-digital-platforms-to-protect-childrens-privacy/

• NPC Circular No. 2022-04, Registration of Personal Data Processing System, Notification Regarding Automated Decision-Making or Profiling, Designation of Data Protection Officer, and the National Privacy Commission Seal of Registration, 5 December 2022: https://privacy.gov.ph/wp-content/uploads/2023/05/Circular-2022-04-1.pdf

• NPC Circular No. 2022-01, Guidelines on Administrative Fines, 8 August 2022: https://privacy.gov.ph/wp-content/uploads/2022/08/NPC-CIRCULAR-NO.-2022-01-GUIDELINES-ON-ADMINISTRATIVE-FINES-dated-08-AUGUST-2022-w-SGD.pdf

• NPC Circular No. 2023-01, Schedule of Fees and Charges of the National Privacy Commission, 17 May 2023: https://privacy.gov.ph/wp-content/uploads/2023/05/Schedule-of-Fees-and-Charges-of-the-National-Privacy-Commission.pdf

• NPC, "NPC implements registration fees and charges, and submission of Sworn Declaration and Undertaking for Exemption from Data Processing System Registration," 1 October 2024: https://privacy.gov.ph/npc-implements-registration-fees-and-charges-and-submission-of-sworn-declaration-and-undertaking-for-exemption-from-data-processing-system-registration/

• NPC, Register (NPCRS guidance): https://privacy.gov.ph/pips-and-pics/register/

• NPC Advisory No. 2026-03, Grant of Additional Period to Submit 2025 Annual Security Incident Reports, 8 September 2026: https://privacy.gov.ph/wp-content/uploads/2026/09/For-Publication-Advisory-Grant-of-Additional-Period-to-Submit-2025-ASIRs_08Sept.pdf

• Data Privacy Act of 2012 (Republic Act No. 10173): https://privacy.gov.ph/data-privacy-act