A Decade of Blanket Compliance
Since July 2017, the Philippines' National Privacy Commission (NPC) has told personal information controllers and processors, in effect, to assess everything. NPC Advisory No. 2017-03, the founding guidance on Privacy Impact Assessments (PIAs) under the Data Privacy Act of 2012 (Republic Act 10173), applied to essentially any processing of personal data, with no risk threshold separating a hospital's patient database from a corner sari-sari store's loyalty-card spreadsheet. On August 10, 2026, the NPC opened public consultation on a draft circular that would replace that blanket rule with a risk-tiered framework, published for comment through August 14 and discussed at an online consultation on August 25.
Under the draft, a PIA becomes mandatory only when processing falls into one of eight defined categories: sensitive personal information under Section 3(l) of the DPA; high-risk data such as biometric, financial, or children's information; large-scale processing (250 or more employees, or 1,000 or more data subjects); processing involving vulnerable groups; automated decision-making or profiling with legal or significant effects; novel high-risk technologies including AI, machine learning, and facial recognition; targeted advertising built on behavioral tracking; and cross-border transfers to jurisdictions the NPC considers to lack adequate protection. Processing that clears none of the eight triggers is explicitly exempt from the mandatory obligation, though the draft still permits a voluntary PIA. Organizations get a 90-day compliance window from effectivity, and the draft introduces a numeric risk-scoring method under which a score of 15–25, rated "critical," requires halting processing until the risk is reduced.
The Case for the Old Rule
Before arguing for the narrower approach, it's worth taking the 2017 rule's logic seriously. A universal PIA requirement is blunt, but blunt instruments have a virtue: they don't depend on a regulator or a company correctly predicting which processing will turn out to be risky. Data harms are often discovered in hindsight — a seemingly low-risk HR spreadsheet becomes a breach vector, an innocuous survey turns into a profiling tool once merged with other datasets. A flat requirement forces every controller to build the habit of assessment, rather than leaving that judgment to self-interested actors who may underrate their own risk. The NPC's own 2024-2026 cascade of supplemental issuances, layered onto the 2017 baseline, reflects a regulator that kept finding new risk categories worth flagging precisely because a general rule gave it room to do so without rewriting the whole framework each time.
Why the Narrower Rule Is the Better One
That said, a requirement that formally applies to everyone but is calibrated for no one tends to produce paperwork, not privacy. The Philippines' own economic structure makes this concrete: micro, small, and medium enterprises make up 99.63% of registered business establishments and generate roughly 40% of GDP and 62.4% of employment (Zenodo working paper, 2026, cited via Philippine MSME compliance research). A rule that nominally required every one of those businesses to conduct a formal impact assessment for any personal-data processing — payroll, a customer list, a Facebook page's contact form — was never going to be evenly enforced or meaningfully absorbed. What blanket rules produce in practice is a compliance-industrial layer of template PIAs filed to satisfy a checkbox, while the NPC's own enforcement capacity gets spread thin across low-risk filings instead of concentrated on facial recognition rollouts, biometric ID systems, and algorithmic lending decisions where the underlying privacy harm is real and often irreversible.
The eight-category structure fixes the targeting problem without abandoning the precautionary logic. AI and facial recognition, biometric and financial data, automated decision-making, and cross-border transfers to weak-privacy jurisdictions are exactly the processing types where a bad design choice compounds — where an assessment done before deployment can catch a discriminatory scoring model or an unencrypted biometric database before it ships. The large-scale thresholds (250 employees, 1,000 data subjects) are a reasonable, if inevitably somewhat arbitrary, proxy for the scale at which a breach or misuse affects enough people to warrant mandatory scrutiny rather than voluntary diligence. This is also the approach global regulators have converged on: the EU's GDPR Article 35 similarly reserves mandatory Data Protection Impact Assessments for high-risk processing rather than all processing, and the NPC's draft explicitly draws on that lineage. A regulator that had spent nine years building enforcement muscle on a universal rule choosing instead to concentrate it is a sign of institutional maturity, not deregulation for its own sake.
What to Watch
The risk-scoring mechanism is the part worth scrutinizing once the circular is finalized. A numeric 15–25 "critical" band that forces a processing halt is a serious enforcement lever, and its value depends entirely on how the NPC operationalizes the underlying scoring criteria — vague or inconsistently applied scoring could reintroduce the same unpredictability the reform is meant to fix, just relocated from "who must file" to "whose score triggers a shutdown." The 90-day compliance runway is short for large controllers restructuring existing data-processing registers built under the old advisory. And because cross-border transfers to "inadequate" jurisdictions is one of the eight triggers, the NPC's forthcoming list of which jurisdictions qualify will matter as much as the circular's text — a poorly calibrated list could quietly re-impose a de facto data-localization burden on Philippine firms doing routine business with regional cloud providers. Those are implementation questions, not reasons to prefer the blanket rule the draft replaces.