Recommended actions
Clients are encouraged to consider entering into DSAs with other PICs with whom they share personal data. While not mandatory, a DSA may serve as evidence of good faith compliance with the DPA, particularly in the event of a regulatory inquiry or investigation.
Regardless of whether a DSA is in place, PICs must ensure that any data sharing is grounded on a valid legal basis for processing or allowed pursuant to a special case under Section 4 of the DPA.
Quisumbing Torres is ready to assist organizations in navigating their data privacy compliance obligations under the DPA, including preparing or reviewing DSAs and identifying the appropriate legal basis for data sharing activities.
If you require assistance or have any further inquiries related to the Advisory or matters related to the DPA, please feel free to reach out to Quisumbing Torres' Intellectual Property, Data and Technology Practice Group.
In more detail
DSA not mandatory
The Advisory confirms that while DSAs are encouraged under the Circular, their execution is not a legal requirement. Therefore, PICs are not automatically in breach of the DPA if they share personal data without a formal DSA, provided that the data sharing is supported by a valid legal basis under Section 12 or 13 of the DPA or is covered by any of the special cases under Section 4 of the DPA.
DSA as a best practice
The NPC underscores that the use of DSAs is a key measure of accountability and good faith compliance with the DPA, its implementing rules and regulations, and relevant NPC issuances. A DSA should clearly outline the terms, conditions, responsibilities and safeguards agreed on by the participating PICs. It may take the form of a contract, memorandum of agreement or another formal collaborative instrument.
Importantly, the process leading to the execution of a DSA should facilitate — not hinder — lawful data sharing. However, the presence of a DSA alone does not validate the legality of a data sharing arrangement. PICs must still establish and document the appropriate legal basis under the DPA, regardless of whether a DSA is in place.
NPC review or approval of the DSA is not required
The Advisory also clarifies that DSAs do not need to be submitted to or approved by the NPC. What may be subject to regulatory scrutiny is the data sharing activity itself, whether on the NPC's own initiative or in response to a verified complaint from an affected data subject.
Noncompliance
While the absence of a DSA does not constitute a violation on its own, data sharing without a valid legal basis does. Noncompliance may lead the NPC to impose administrative penalties, such as compliance/enforcement orders, administrative fines of up to PHP 5 million (approximately USD 90,900) for a single violation, and cease and desist orders or temporary or permanent bans on personal data processing. In addition, affected data subjects may recover damages through civil indemnity claims for violations of their data privacy rights, specifically the right to be informed. Finally, data sharing without a valid legal basis is a criminal offense under the DPA, specifically Unauthorized Processing of Personal Data, and the criminal penalties may be imposed upon the responsible officer(s) who participated in, or by their gross negligence, allowed the commission of the crime.
*****
© 2025 Quisumbing Torres. All rights reserved. Quisumbing Torres is a member firm of Baker & McKenzie International, a Swiss Verein. This may qualify as "Attorney Advertising" requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome.
Please contact QTInfoDesk@quisumbingtorres.com for inquiries.
VISIT QUISUMBING TORRES SITE
