The Philippines' National Privacy Commission has spent nine years telling every entity that processes personal data to write a Privacy Impact Assessment (PIA) — a paper trail meant to map data flows and flag risks. On August 10, 2026, the NPC published a draft circular that would scrap that blanket approach and replace it with a threshold test: a mandatory PIA is required only when processing falls into one of eight defined high-risk categories, including artificial intelligence systems, biometric enrollment programs, high-risk cross-border data transfers, children's personal data, and large-scale processing (reported thresholds of roughly 250-plus employees or 1,000-plus data subjects). Everything else becomes voluntary. The draft is out for public comment, with written submissions due August 14 and an online consultation held August 25.
From "Assess Everything" to "Assess What's Risky"
NPC Advisory No. 2017-03, the rule this circular would replace, applied to "any person processing personal data" subject to the Data Privacy Act of 2012 (Republic Act No. 10173). In practice, that meant a payroll vendor running standard HR records and a fintech deploying a facial-recognition KYC pipeline were nominally under the same assessment obligation. The new draft's threshold analysis asks a controller to check its processing against the eight categories first; only a match triggers the formal PIA machinery — data-flow mapping, risk scoring, mitigation planning, sign-off.
There's a real case for the old blanket rule, and it's worth stating plainly before knocking it. In 2017, the Data Privacy Act was still new and few Philippine companies had any privacy-compliance muscle at all. A universal PIA requirement was blunt, but it forced every controller — not just the sophisticated ones — to sit down and document what data it held and why. Blanket rules are also simply easier for a resource-constrained regulator to audit: "did you file a PIA, yes or no" is a much cheaper enforcement question than "was your risk categorization defensible." For a commission with a famously thin enforcement staff relative to the number of registered controllers, that administrability mattered.
Why the Reform Is the Right Call
But nine years on, the costs of that bluntness have become clearer than the benefits. A universal PIA mandate spends the same compliance energy on a barangay cooperative's membership rolls as it does on a bank's AI-driven credit-scoring model — and the barangay cooperative is, by definition, not where the privacy risk lives. Compliance capacity, especially at small and mid-sized businesses, is finite; every hour a two-person compliance team spends producing a boilerplate PIA for routine payroll processing is an hour not spent scrutinizing the one system that actually touches biometric or children's data. Risk-based thresholds are how mature regulatory regimes are supposed to work — the EU's GDPR itself only mandates a Data Protection Impact Assessment for processing "likely to result in a high risk," not for processing generally. The NPC's draft brings the Philippines closer to that global norm rather than further from it.
The categories the draft does flag — AI systems, biometrics, cross-border transfers, children's data — are also the correct ones to flag. These are precisely the processing types where an error compounds silently: a biased AI model or a leaky biometric database can harm thousands of data subjects before anyone notices, in a way that a mislabeled HR spreadsheet typically cannot. Concentrating mandatory scrutiny there, instead of diffusing it across every controller in the country, is a more honest match between regulatory effort and actual harm.
The Timeline Is the Weak Point
What undercuts the reform isn't the substance — it's the process. The draft was published August 10 and public comments were due August 14: a four-day window for a rule that rewrites the compliance baseline for every data controller in the country. The subsequent online consultation on August 25 helps, but it doesn't cure a written-comment period that short for a document this consequential; industry groups, civil-society privacy advocates, and smaller PICs without in-house counsel on retainer all need more than four business days to read an updated circular, map it against their own processing, and write a considered response. If the NPC wants buy-in for a genuinely good reform, it should extend the formal comment window before finalizing the circular — not treat the single online session as a substitute for written input.
What Comes Next
Assuming the threshold model survives consultation roughly as drafted, most Philippine controllers running conventional back-office processing will be able to retire their PIA paperwork — though prudent controllers will keep informal risk logs regardless, since "voluntary" doesn't mean "consequence-free" if a breach later reveals an untracked risk. For the AI, biometric, cross-border, and children's-data categories, expect the opposite: a formal PIA becomes non-negotiable, likely paired with more detailed documentation standards than the 2017 advisory ever specified. That's the correct trade. A privacy regulator that concentrates its mandatory-assessment regime on AI models and biometric databases, rather than every spreadsheet in the country, is one that will actually catch the failures worth catching.