The Beginner's DPO Reviewer

How to use this guide

If you have never worked in privacy before, this guide is written for you. It assumes you know nothing about the law and builds up from there.

Read it in order the first time. Each section uses words the previous one defined. Skipping ahead is how people end up memorising phrases they cannot explain.

How much time do you have?

← swipe tables sideways

The big picture

Before any law, understand the problem it solves.

Organisations collect information about people. Your name, your birthday, your medical records, your salary, your location, what you clicked on last night. That information has value, and it can be used to help you or to hurt you.

The Data Privacy Act exists to say: you can collect and use people's information, but only under conditions, and the person the information is about keeps certain rights over it.

That is the whole law in one sentence. Everything else is detail.

The three things you need to know

1. The law is Republic Act No. 10173, the Data Privacy Act of 2012. People shorten it to "the DPA" or "RA 10173." It has been in force since 2012.

2. The regulator is the National Privacy Commission, the NPC. They are the government body that enforces the law. They write rules, investigate complaints, impose fines, and can order a company to stop processing data entirely. They became operational in 2016.

3. The DPA has an IRR — Implementing Rules and Regulations. The law says what; the IRR says how. When someone cites "Rule XI," they mean a rule in the IRR, not a section of the Act. The IRR came out in 2016 and was amended in 2023.

Where the NPC's rules come from

The NPC publishes two kinds of document you will hear referenced constantly:

• Circulars — binding rules. "NPC Circular 2022-01" sets out how fines are calculated.
• Advisories — guidance on how the NPC interprets the law. Not binding in the same way, but ignore them at your peril; they tell you exactly how the regulator thinks.

Both are numbered by year. 2025-02 means the second issuance of 2025.

The vocabulary

Privacy has a lot of jargon and it is genuinely the biggest barrier for beginners. Learn these eleven terms and most documents become readable.

What a DPO actually does

The job in one line

A DPO makes sure the organisation follows privacy law, and is the person the regulator and the public can talk to.

The five duties, in plain terms

1. Know what data the organisation holds. You cannot protect what you cannot see. This means building and maintaining a record of every system that touches personal data — what it holds, why, who can see it, how long it stays.

2. Check that new things are safe before they launch. This is where PIAs live. A new app, a new vendor, a new marketing campaign — you review it before it goes live.

3. Handle people's requests. Someone asks what data you hold on them, or asks you to correct or delete it. You make sure that happens, properly and on time.

4. Handle breaches. When something goes wrong, you run the response and decide whether the NPC and affected people must be told — within 72 hours. Part 5 covers this.

5. Train everyone else. Most privacy failures are ordinary people making ordinary mistakes. Training is not a box-tick; it is the highest-leverage thing you do.

The part interviewers care about most: independence

The law requires the DPO to be independent. Beginners often nod at this word without understanding it. Here is what it actually means:

• Nobody can tell you what conclusion to reach on a privacy question.
• You cannot be fired or punished for doing the role properly.
• You report to the highest level of management, not to a department head.
• You get budget, access, and time to do the work.

But independence is not veto power. You advise. You flag risk. You put it in writing. Management decides, and management owns the consequences.

Who cannot be the DPO

Anyone who decides how personal data gets used, because they would be checking their own work. That rules out the CEO, Head of IT, Head of HR, and Head of Marketing. This is called a conflict of interest and it is a favourite interview question.

DPO vs COP

A Compliance Officer for Privacy handles a branch or a regional office and reports to the DPO. It is a delegation, not a replacement. Every organisation still needs one DPO. Many fresh graduates enter privacy as a COP or a privacy associate — it is a normal path.

The five pillars — memorise these

The NPC frames compliance as five pillars. This gets asked almost verbatim.

1. Appoint a DPO
2. Conduct a Privacy Impact Assessment
3. Create a Privacy Management Program and privacy manual
4. Implement privacy and data protection measures — organisational, physical, technical
5. Exercise breach reporting procedures

The law in plain English

Who the law applies to

Anyone processing personal data in the Philippines, government or private.

It also reaches outside the country, if the organisation uses equipment located here, has an office or branch here, or processes Filipinos' data in connection with that presence. This is called extraterritorial reach.

The three principles (Sec. 11)

Every processing activity must satisfy all three.

The six lawful bases (Sec. 12)

You need at least one before processing ordinary personal information.

1. Consent — the person agreed.
2. Contract — you need the data to deliver something they asked for. An online store needs your address to ship your order.
3. Legal obligation — a law requires you to hold it. Employers must keep tax records.
4. Vital interests — to protect someone's life or health.
5. Public authority or national emergency — government mandate, public order and safety.
6. Legitimate interests — a genuine business reason that does not override the person's rights. Fraud detection is the classic example.

Sensitive personal information (Sec. 13)

Start your answer with the framing: processing SPI is prohibited by default. Then give the exceptions:

1. Consent, given before processing. For privileged information, all parties must consent.
2. A law provides for it, with safeguards.
3. Life and health, where the person cannot consent themselves.
4. Non-commercial purposes of public organisations, limited to members, no onward sharing.
5. Medical treatment by a practitioner or institution with safeguards.
6. Legal claims — establishing, exercising, or defending them.

The rights of a data subject (Sec. 16)

People hold rights over their own data. In plain terms:

Rights pass to lawful heirs if the person dies or becomes incapacitated.

Keeping data secure (Sec. 20)

The law asks for reasonable and appropriate measures in three categories:

• Organisational — policies, a DPO, training, access rules, contracts with vendors.
• Physical — locked rooms, controlled office access, secure disposal of paper and drives.
• Technical — encryption, access controls, logging, backups, patching.

"Reasonable and appropriate" scales with the sensitivity of the data, the size of the organisation, and the cost. A hospital and a sari-sari store are not held to the same standard.

Accountability (Sec. 21)

The PIC stays responsible for personal data it holds or transfers to someone else, including overseas.

When things go wrong

What counts as a breach

A security incident is anything that threatens data. A personal data breach is narrower: personal data was actually destroyed, lost, altered, disclosed, or accessed without authorisation.

The 72-hour rule (Sec. 20(f))

You must notify the NPC and the affected people within 72 hours — but only when all three of these are true:

1. Sensitive personal information, or information that could enable identity fraud, is involved.
2. There is reasonable belief it was acquired by someone unauthorised.
3. The breach is likely to give rise to a real risk of serious harm.

Two details beginners get wrong:

• The clock starts on knowledge or reasonable belief, not on confirmation. You do not get to run a three-week investigation first. File an initial notification and supplement it later.
• The clock starts when you find out, not when the incident happened. Discovering a leak that began eight months ago does not forfeit the duty — and the duration will make the harm assessment worse.

Ongoing reporting

• Annual Security Incident Report (ASIR) — due 31 March each year, covering the previous year. It includes all incidents, even those that never met the notification threshold.
• Registration with the NPC — the certificate lasts one year and needs renewal.

What the NPC can actually do to you

The fines (NPC Circular 2022-01)

Note the base is gross income, not profit. A company losing money still pays.

The criminal side

Roughly 6 months to 7 years imprisonment and ₱100,000 to ₱5,000,000 in fines, depending on the offence.

Three aggravators worth knowing:

• Responsible officers are personally liable (Sec. 34) — the company being fined does not shield the individuals.
• Data of 100 or more people draws the maximum penalty (Sec. 35).
• Public officers face disqualification from office (Sec. 36).

A real case to cite

In October 2025 the NPC issued a cease and desist order against Tools for Humanity, operator of World App, over collection of biometric iris data.

The point it established: paying people for their data does not produce valid consent. Consent obtained through financial incentive is not freely given. The NPC looked at the quality of the consent, not merely whether a box had been ticked.

Privacy in software development

If the employer builds software, this section is where you can outshine candidates with more years than you. Most of them stopped reading at the 2012 Act.

The key document: NPC Advisory 2025-02

In 2025 the NPC published Guidelines on Privacy Engineering in Systems Life Cycle Processes. It maps privacy duties onto the five phases of building software, and applies to systems at any stage — new builds, live systems, and updates alike.

Two concepts anchor it:

• Privacy by design — privacy is built into the architecture from the start, not added before launch.
• Privacy by default — the out-of-the-box setting is the most private one. The user opts in to more sharing, never has to opt out.

The five phases

1. Planning and requirements. Decide the lawful basis before anything is built. Run the PIA here. Write privacy requirements into the acceptance criteria. Push back on collecting fields nobody can justify — this is the cheapest moment to say no.

2. Design and development. Encryption in transit and at rest. Role-based access so people see only what their job needs. Pseudonymisation and other privacy-enhancing technologies. Secure coding. Private defaults. No dark patterns.

3. Testing. Do not use real production data to test. Test systems rarely have production-grade access control or logging, so copying real customer data into them multiplies your exposure. Use synthetic or properly anonymised data. And test the privacy features themselves — does the consent withdrawal actually work? Does the deletion job actually delete?

4. Deployment. Check the configuration before go-live. Assess every third-party SDK and vendor. Update your records and NPC registration. Notify the NPC if the system does automated decision-making or profiling.

5. Operation and maintenance. Audit logging. Patching. Automated deletion when retention periods expire. Periodic reassessment. Monitoring good enough to detect a breach inside the 72-hour window.

Dark patterns

A dark pattern is an interface designed to push someone toward a choice they would not freely make.

Examples you can name:

• "Accept all" as a bright button, "Reject" as grey text
• Pre-ticked marketing checkboxes
• One click to sign up, five clicks to delete your account
• Guilt-tripping copy: "No thanks, I like paying more"

AI features

The NPC confirmed in Advisory 2024-04 that the DPA applies fully to AI systems — there is no AI exemption. You still need a lawful basis for training data and for inference, and they may be different. Transparency still applies. And "the model performs better with more data" is not a lawful basis — proportionality still bites.

Scraping public data

Advisory 2026-01 deals with scraping publicly available personal data. The headline: public does not mean free to process. Data being visible on the internet is not one of the six lawful bases. Purpose limitation carries over — information posted for one context cannot simply be repurposed.

Anonymised vs pseudonymised

Beginners mix these up constantly, and interviewers know it.

• Anonymised — identity cannot be recovered by anyone, ever. Falls outside the DPA.
• Pseudonymised — identifiers replaced with codes, but a key exists somewhere that could reverse it. Still personal data. Still fully covered.

Answering as a fresh graduate

This section is the one nobody writes for you. Read it twice.

The honest situation

You will likely be asked, in some form: "You don't have experience. Why should we hire you?"

It is a fair question and it is not hostile. They already know your background — they read your CV and invited you anyway. They are testing how you handle it, not whether it is true.

What does not work

• Pretending. Claiming experience you do not have collapses on the second follow-up question, and it ends the interview.
• Apologising. "I know I'm just a fresh grad, sorry…" tells them to doubt you.
• Deflecting into unrelated achievements.

What works

Acknowledge it plainly, then pivot to what you did instead.

That answer does three things: it is honest, it proves initiative with a specific citation, and it shows self-awareness. All three are things they are actually screening for.

Your real advantages — name them

You are current. Someone who trained in 2018 may not have read the 2025 privacy engineering advisory or the 2026 scraping guidance. You have. That is a genuine edge, not a consolation prize.

You have no bad habits. You have not spent years at an organisation that treated privacy as paperwork.

You are cheaper and you will stay. Nobody says this out loud, but it is real. Signalling that you want to grow into the role matters.

You know how software gets built. If you have any coding, IT, or systems background, that is unusually valuable here — most privacy people do not, and they struggle to talk to engineers.

Have these three things ready

1. A 90-day plan. Even a rough one. It shows you can think in structure rather than tasks.

2. Two things you would ask a senior person in week one. Naming what you do not know, specifically, is more convincing than claiming you know everything. Good candidates: "I'd want to sit with whoever handles vendor contracts, because PIP agreements are where accountability actually gets lost."

3. Questions for them. Part 10 has a list. Asking nothing reads as low interest.

On saying "I don't know"

You will hit a question you cannot answer. Everyone does. The strong version:

That is a good answer, not a failure. A DPO who guesses is genuinely dangerous, and interviewers know it. Showing that you know where to look beats bluffing every time.

Practice questions

Work through these out loud. Full sets are in the practice app.

Cheat sheet

The six sections worth memorising

The scenario skeleton

Every situational question follows the same shape. Memorise the sequence, not the answers:

Before the interview

Checklist

• Read Parts 1–5 until the vocabulary feels normal
• Drill the practice app until the Scenarios set retires
• Skim NPC Advisory 2025-02 in full — it is short and it is your edge
• Know the fine numbers and the 72-hour rule cold
• Write your 90-day plan in bullet points
• Prepare your answer to "you don't have experience" — say it out loud five times
• Research the company and name three kinds of personal data they probably hold
• Check privacy.gov.ph for anything issued after August 2026
• Prepare two questions you would ask a senior colleague in week one

Questions to ask them

Asking good questions is the cheapest way to look senior. Pick three:

1. Is the DPO role full-time, and who does it report to?
2. Are you currently registered with the NPC?
3. Has a Privacy Impact Assessment been done, and on which systems?
4. Is there a privacy manual and a breach response plan already?
5. Have you had a reportable breach or an NPC inquiry before?
6. How many vendors process personal data on your behalf?
7. Does engineering have a privacy checkpoint today, or would I be building that?
8. Who would I learn from — is there a senior privacy person or external counsel?