Most business owners think of their website as a marketing tool. Under Philippine law, it is also a data processing system. The moment a visitor fills in a contact form, accepts an analytics cookie, chats with a support widget or sends an email through a "Contact us" link, your business is collecting personal information, and the Data Privacy Act of 2012 applies to how you handle it.
This article explains, in plain terms, what the law expects of a typical SME website: where personal data actually flows, what a privacy notice should cover, how to handle consent properly, what to do if something goes wrong, and a practical checklist you can work through with your web developer. It is not legal advice. For the specifics of your situation, confirm with the National Privacy Commission (NPC) or a lawyer familiar with data privacy.
Key takeaways
- Your website almost certainly processes personal data, even if it only has a contact form.
- You need a clear privacy notice, a lawful basis for each kind of processing, and reasonable security measures.
- If you rely on consent, use an unticked checkbox linked to your notice and keep a record of it.
- Know your vendors: hosting, analytics, email and chat providers all handle your visitors' data on your behalf.
- Have a breach plan before you need one; some breaches must be reported to the NPC within 72 hours.
The law in brief
The Data Privacy Act of 2012 is Republic Act No. 10173. It governs how organisations collect, use, store, share and dispose of personal information, and it is enforced by the National Privacy Commission (NPC). The NPC also issues circulars that add detail, so check its website periodically.
Two terms come up constantly. A personal information controller is the organisation that decides why and how personal data is processed; for your website, that is your business. A personal information processor is a third party that processes data on your behalf, such as your hosting company, email provider or analytics service. As the controller, you remain accountable even when a processor does the actual handling.
The law also expects controllers to designate a Data Protection Officer (DPO), the person responsible for overseeing compliance. In a small business, this is often the owner or a trusted manager. Some organisations must also register their DPO and data processing systems with the NPC, depending on their size and the kind of data they handle. Check the NPC's current registration rules to see whether this applies to you.
Where your website touches personal data
Personal information is any information from which a person's identity is apparent or can reasonably be determined. On a business website, that usually includes more than owners expect.
- Contact and inquiry forms collect names, email addresses, phone numbers and whatever the visitor types in the message field.
- Analytics tools can record IP addresses, device details and browsing behaviour, often through cookies.
- Chat widgets capture conversations, which may include sensitive details a customer volunteers.
- Email sent from or to the website creates copies of personal data in inboxes, which are often poorly secured.
- Newsletter sign-ups, booking tools and job application forms each collect their own set of details, sometimes including sensitive personal information such as age, health or government ID numbers.
Start by mapping these flows: for each, note what data is collected, why, where it is stored, who can see it and which vendor is involved.
Your privacy notice
Data subjects, meaning the people whose data you process, have a right to be informed. A privacy notice on your website is how you meet that right. It should be written in plain language and easy to find, typically linked from the footer and from every form.
A useful privacy notice explains what data you collect, the purpose of each kind of processing, the lawful basis you rely on, who you share it with (including processors), how long you keep it, how you protect it, and how people can contact your DPO.
The rights you must explain
Your notice should also tell visitors about their rights under the law. These include the right to be informed, to access their data, to object to processing, to erasure or blocking, to rectification (having inaccurate data corrected), to data portability, to damages, and to file a complaint with the NPC. You also need someone assigned to actually respond when a person exercises these rights.
Consent, done properly
Consent is only one of several lawful bases for processing, and it is not always the right one. If someone asks you for a quote, you can usually process their details to respond. But where you do rely on consent, for example to add someone to a marketing mailing list, it must be freely given, specific and informed.
In practice, that means:
- Use an unticked checkbox. A pre-ticked box is not meaningful consent.
- Link the checkbox directly to your privacy notice so the visitor can read it before agreeing.
- Keep consent for different purposes separate. Agreeing to be contacted about an inquiry is not agreeing to receive newsletters.
- Record the consent: what the person agreed to, when, and which version of the notice was in effect.
- Make withdrawing consent as easy as giving it.
Collect less, protect what you keep
Data minimisation means collecting only what you actually need. If a phone number is not essential for responding to an inquiry, make it optional or remove it.
The law requires reasonable organisational, physical and technical security measures. For a website, the basics include HTTPS across the whole site, keeping the content management system and plugins updated, strong unique passwords with multi-factor authentication for admin accounts, limiting who can see form submissions, and regular backups that are themselves protected.
Retention deserves its own decision. Decide how long you keep inquiry records, applicant data and chat logs, then actually delete or anonymise them when that period ends. Old inboxes full of years of form submissions are a common and avoidable risk.
Your vendors are part of the picture
Your hosting provider, email service, analytics platform and chat tool are processors acting on your behalf. Know who they are, where they store data, and what their terms say about security and breach notification. Where possible, put their obligations in a written agreement.
When something goes wrong
NPC Circular 16-03 sets out personal data breach management rules. Under it, the NPC and affected data subjects must be notified within 72 hours of knowledge of a breach when the breach involves sensitive personal information, or information that could be used to enable identity fraud, and is likely to give rise to a real risk of serious harm to the people affected.
Seventy-two hours passes quickly. Decide in advance who investigates, who decides whether notification is required, who drafts the notices and who speaks to customers. Write it down as a one-page plan.
Where to start
You do not need to fix everything at once. Work through these steps in order:
- Map every place your website collects personal data, and the vendor behind each one.
- Remove form fields and tools you do not genuinely need.
- Publish or update a plain-language privacy notice and link it from every form.
- Fix your consent mechanics: unticked checkboxes, separate purposes, recorded consent.
- Designate a DPO and check the NPC's current registration rules.
- Confirm the security basics: HTTPS, updates, MFA on admin accounts, protected backups.
- Set retention periods and write a short breach response plan.
- Confirm anything you are unsure of with the NPC or a lawyer.
If you would like an independent view of where your website and systems stand, Northgate's Security Baseline & Data Privacy Readiness assessment reviews your current setup and gives you plain-language, prioritised recommendations. It does not certify compliance, but it does show you what to fix first. You can book a free 30-minute call to talk it through.