Why brokers are covered
The Data Privacy Act of 2012 (Republic Act No. 10173) applies to people and organizations that process personal information in the Philippines. Brokers who collect client names, phone numbers, IDs, TINs or income documents are processing personal data.
Core principles
- Transparency: tell clients what you collect and why.
- Legitimate purpose: use the data only for the purpose the client agreed to, such as arranging a viewing or a transaction.
- Proportionality: collect only what you actually need.
Sensitive personal information
Identifiers issued by government agencies, such as SSS and TIN numbers, are treated as sensitive personal information and carry stricter rules, including generally requiring the individual's consent to process them.
Good habits
- Do not post or forward client IDs in group chats.
- Store documents in a secured, access-controlled place, not on shared devices.
- Delete or return documents when the transaction ends and you no longer need them.
- Honor requests to access, correct or delete a client's data.
If there is a breach
A personal data breach that meets the legal threshold must generally be reported to the National Privacy Commission and to affected individuals within 72 hours of discovery. Consult the NPC's current rules or a lawyer for the details that apply to you.