The Philippines just Rewrote the Rules on When You Need a Privacy Impact Assessment (PIA).

Has your company conducted the PIA for all proceses involving Personal Data?

If you organization has ever treated the Privacy Impact Assessment (PIA) as a box-ticking activity, and something that the DPO or Compliance Team files away once and forgets. Then the National Privacy Commission (NPC) has an updated regulation for you. The NPC is currently updating and will publish a circular that supersedes its 2017 guidance that required conducting the PIA for every processing activity a business undertakes, with a more targeted risk-tiered model.

The old rule was broad but shallow, and states that perform a PIA for everything, and treat it as satisfied once it’s on file.

The new approach is narrower and has stricter conditions, stating that PIAs are required only when processing falls into one of eight specific trigger categories, but where they are required, the circular introduces a four-level risk matrix (Low, Moderate, High, and Critical), with the highest tier requiring that the processing simply does not proceed until risk is brought down to an acceptable level.

For any company operating in or serving the Philippine market, this circular is one of the most consequential Philippine data privacy developments this year.  The following are what’s changing, who it affects, and what to do about it before the compliance clock starts running.

What’s Actually in the Circular

The eight mandatory PIA triggers are:

1. Sensitive Personal Information (health, religion, race, criminal history, and similar categories)

2. High-risk data, including financial information, biometric data, and children’s data

3. Large-scale processing ­­_­­— 1,000 or individuals’ sensitive personal information, or 250 or more employees’ data

4. Data on Vulnerable Groups ­— minors, the elderly

5. Automated Decision-Making or Profiling that affects individual rights

6. Novel or high-risk technologies, explicitly including artificial intelligence, machine learning, facial recognition, and behavioral analytics

7. Targeted advertising and behavioral tracking

8. Cross-border data transfers to jurisdiction with inadequate data protection

What this means:

Under the old blanket rule, the answer was simple — you always do PIA.

Under the new rule, the answer depends on a fact-specific assessment against the eight categories, several of which (biometrics data, AI / Automated Decision-making, Large-scale processing) are exactly the kind the kind of thing many businesses have adopted quietly over the past few years without formally cataloging it as such.  A company that assumes “we did a PIA once, and we are compliant!”, is now the wrong perception under this new framework.  Likewise a company that assumes it never needed to conduct PIA, shall now discover it does.

Action Items:

• Inventory every electronic system or manual process that touches personal data, however routinary it seems

• Map each once against the eight trigger categories — pay particular attention to biometric attendance systems, CCTV with any analytics capability, HR / Applicant screening tools, and customer-facing chatbots

• Flag any system using AI, machine learning, or facial recognition for a mandatory PIA regardless of scale, since this Circular calls these out explicitly

What this means:

A growing number of Philippine businesses have adopted AI tools — for HR screening, customer service chatbots, fraud detection, or analytics — often through a vendor’s product rather than a deliberate in-house build.  Because the technology arrived as a feature of a purchased tool rather than a formal “AI project,” many organizations have not evaluated it through a privacy lens at all.  This new Circular removes that excuse, and deliberately saying that AI, machine learning, facial recognition, and behavioral analytics are now explicit and named triggers for a mandatory PIA.

Action Items:

• Audit every third-party tool or vendor platform in use for embedded AI or analytics feature, not just those found in in-house developed systems

• Apply Privacy-by-Design Principles going forward: any new AI tool deployment should have its PIA drafted before implementation, not after

• For high-risk automated decision-making, build in a documented mechanism for human review or intervention — this Circular’s risk matrix pushes hardest on systems that make consequential decisions with no human intervention.

What this means:

It’s tempting to assume that hiring an outside consultant to draft a PIA discharges the organization’s responsibility.  This Circular is explicit in saying that this is not the case.  The Personal Information Controller (PIC) remains primarily accountable for the PIA’s quality and completeness even when a third party performs the assessment, and the Data Protection Officer (DPO) must formally review and sign-off on the result — with any disagreement between the DPO and management properly documented, and not quietly resolved off the record.

Action Items:

• Build a formal DPO sign-off step into any PIA process, whether performed in-house or by an external adviser

• Keep version-controlled PIA records with clear timestamps for commencement, completion, and approval.  This Circular specifically calls for this level of documentation.

• Establish a documented process for handling disagreements between the DPO and business units over risk classification, rather than leaving it informal.

What this means:

Once finalized, companies don’t have much time in performing the Privacy Impact Assessment from process inventory, data flow narratives, the PIA risk management, all the way to documentation and implementation, especially coming from a standing start.  This is more particular to organizations with multiple business lines and highly embedded vendor ecosystems.  The implementation of this Circular lines up with the Commission’s visibly stepped-up enforcement activities — The Commission’s own Privacy Awareness Week 2026 declares 2,390 Compliance Checks and 628 Privacy Sweeps conducted this year, alongside renewed emphasis on Privacy-by-Design from Commission leadership.

Action Items:

• Do not wait for this Circular to start the preparatory work — the Trigger Categories and Risk Matrix Structure will become the hard baseline for conducting PIA

• Build PIA screening into new-vendor and new-project onboarding now, so future processing activities are evaluated at the design stage rather than retrofitted later

• Assign clear internal ownership, and go beyond the mentality of “the DPO will handle it” for maintaining Processing Inventory and the PIA Report, since annual review is already expected to become a standing obligation under the new framework

How Cosaint Consulting Inc. Can Help

At the time of writing, Cosaint Consulting Inc. has spent almost a decade managing Data Privacy and Cybersecurity compliance programs across a wide range of Philippine industries.  Performing the Privacy Impact Assessment (PIA) and personal data risk management for all systems and processes of each compliance partner and client.  We fully understand that a regulatory shift like this one rarely arrives as a single clean project, it touches HR, IT, Vendor Management, Operations, Sales and Marketing, Executive Management, and most especially Frontline Operations all at once.

Contact us and we can discuss how Cosaint can help your company with the following:

• Design and Run a PIA Program — building the Records of Processing Activities Inventory, screening processes that triggers a PIA, performing Privacy Risk Management, and documentation templates that the Circular expects

• Provide outsourced or managed services for DPO support — this includes the formal review and sign-off the Circular requires

• Advise on AI and Personal Data Analytics governance, from vendor due diligence to Privacy-by-Design implementation for new tools

• Update Data Breach Response Plans and Playbooks to reflect current NPC procedural and reportorial requirements

• Deliver employee privacy training tailored to your industry and the specific data your teams handle

• Conduct vendor and third-party cybersecurity assessments

If you are still unsure whether your organization’s current PIA practices will hold up to this Circular, now is the time to find out.

Sources:

• Draft Circular — Updated PIA Guidelines (Public Consultation, August 2026) — National Privacy Commission

• Philippines Replaces Blanket PIA Rule: AI, Biometric Processing Faces New Scrutiny — Tech Times

• NPC Advisories & Circulars — National Privacy Commission

• PAW 2026: NPC celebrates a decade of privacy leadership, calls for responsible AI governance

Get in touch with Cosaint Consulting Inc. at info@cosaintconsulting.com or visit the other sections of our website cosaintconsulting.com, to find out how we can support your Compliance and IT Governance journey.