Does Your Website Comply With the Data Privacy Act? (We Checked Ours)

We started this as a straightforward guide to the Data Privacy Act. Before publishing it, we did what we would ask any client to do and ran the checks against our own site first.

The policy side was in order. The consent mechanism we rebuilt while we were in there, and that turned out to be the more useful half of the article.

The Act has been law here since 2012, so the obligations are not new. What has moved is the tooling. Consent is now something you implement rather than something you declare, and the distance between those two is where a lot of otherwise well-run sites sit.

What the law actually asks of a website

Republic Act 10173 governs how organisations in the Philippines collect, store, use and share personal information. It is enforced by the National Privacy Commission, and it applies whether you are a university, a nonprofit, a retailer or a three-person studio. There is no revenue floor that exempts you from the basics.

The vocabulary matters a little. If you decide why and how data gets processed, you are a personal information controller, which is almost certainly what your organisation is. Your web agency, your host and your email platform are usually processors, handling it on your behalf. That distinction decides who carries which obligation when something goes wrong, which is a conversation better had before it does.

Most business websites collect more than their owners picture. Contact forms, obviously. But also newsletter signups, analytics identifiers that distinguish one visitor from another, advertising pixels that exist specifically to follow individuals between sites, chat transcripts sitting on somebody else's servers, and job application forms.

That last one deserves a flag. Sensitive personal information is a defined category with stricter rules attached, and it covers health, education, government-issued identifiers, and details about race, religion, marital status and legal proceedings. A recruitment page or a school enrolment form is usually holding it, whether or not anyone framed it that way when the form was built.

Do you have to register with the NPC?

Not everyone does, which surprises people in both directions.

Under NPC Circular 2022-04, registering your Data Protection Officer and your data processing systems becomes mandatory if you employ 250 or more people, or you process the sensitive personal information of 1,000 or more individuals, or your processing is likely to pose a risk to people's rights and freedoms. Separately, any system involving automated decision-making or profiling registers regardless of headcount, which is worth checking if you score leads or segment audiences automatically.

If none of that describes you, you are not required to register. You are still bound by everything else in the law, and that is the part worth sitting with. Registration is a filing threshold, not a definition of compliance, and the two get conflated constantly.

What we checked on our own site

Our privacy policy was in good order. It names Republic Act 10173, it references the Commission, and it sets out what we collect and why.

The mechanism is the part worth being precise about. The Commission does not recognise implied consent, so a banner announcing that continued browsing means agreement is not consent, and neither is silence. For anything non-essential, and analytics and advertising both are, the expectation is explicit agreement before the tags run, with declining as easy as accepting.

The audit turned up three tools initialising on page load: Google Analytics, a Google Ads conversion tag, and Microsoft Clarity. Clarity is the one worth pausing on, because it records sessions rather than counting visits, which puts it in a different category from ordinary analytics.

That points at the method. Reading a site's code tells you what you believe is running on it. Loading it in a clean browser and reading the cookies it actually writes tells you what is really there. The second list is usually the longer one.

How we implemented it

There were two routes worth weighing. Hold every tag back until someone agrees, which is the cleaner reading of the rule and costs you data from everyone who never answers. Or use consent signalling, where the tags load in a restricted state and unlock on agreement, which keeps some measurement but adds configuration.

We used both, for a practical reason. Google Analytics reaches our site through a platform integration we cannot run our own code ahead of, so it is held back by consent defaults set to denied before anything else executes. Clarity is different. It records sessions, and it sits in code we control, so it is simply not loaded at all until someone agrees. That also keeps the behaviour independent of any vendor dashboard setting, which matters when you want to be able to prove what happens rather than trust that it does.

The banner itself took the longest to get right. Declining carries the same visual weight as accepting, because the rule is not only that a choice exists, it is that the choice is real. A Decline styled as a faint text link next to a solid Accept button is a dark pattern, and it undercuts everything else you have built.

Then we measured it the same way we audited it. On the live site, a clean browser profile holds a single cookie before any choice is made, set by our CDN to keep the site up. Fourteen more appear the moment you press Accept, and not one of them before.

What happens if something goes wrong

The timelines are short. Where a breach involves sensitive personal information, or data that could enable identity fraud, and where there is real risk of serious harm, you have 72 hours from knowing or reasonably believing it happened to notify both the Commission and the people affected. A fuller report follows within five days unless you are granted more time.

Seventy-two hours disappears quickly when the first day goes on working out who holds the hosting credentials and who can say what was actually exposed. Those are answers to settle on an ordinary afternoon rather than a bad one.

The annual filing

There is also an Annual Security Incident Report, due 31 March each year and covering the year before. It applies to every controller and processor, whether or not you were required to register, and whether or not anything happened. A clean year still gets a filing that says so.

This is the one we see missed most often, usually because not needing to register gets read as having nothing to file.

What we would look at on your site

An afternoon covers most of it, and you do not need a lawyer in the room to start.

• Every form, and where its data lands. Including the ones added years ago by someone who has since left.
• What actually gets written before consent. Load the site in a clean browser profile and read the cookies, rather than only reading the code. The two lists rarely match.
• Your privacy policy, read as a stranger would read it. Does it name the real tools, the real third parties, a retention period and a contact that someone answers?
• Who your Data Protection Officer is. If the answer is nobody, that is the first decision, not the last.
• Whether the registration triggers apply to your headcount and the sensitive data you hold.
• Who you would call in the first hour of a breach, and where the credentials live.

If that turns up more than you expected, it usually means the website grew faster than the paperwork around it. That is ordinary. It is also more fixable than most compliance work, because nearly all of it lives in one place.

One caveat

We build websites. We are not lawyers, and this is not legal advice. It is what we look at when we audit a site, written for the person who has to raise the right questions internally. For anything specific to your organisation, particularly registration and breach handling, work with counsel and check the National Privacy Commission guidance directly, since circulars and deadlines do move.

If you would like us to look at yours, we usually fold it into a wider review. It is the quickest part of an audit and it tends to produce the fastest fixes.