Sensitive Data Restriction
Plain English Translation
Sensitive personal information — including health records, financial data, religious beliefs, and political affiliations — is subject to heightened restrictions under RA 10173 and may generally not be processed without explicit consent or another narrowly defined legal ground. Privileged information, such as communications between attorneys and clients, is similarly protected and restricted. Organizations must implement stricter controls and access limitations for any system that handles these categories of data.
Technical Implementation
Use the tabs below to select your organization size.
Required Actions (startup)
- Identify all sensitive data elements (e.g., government IDs, health info) collected by the organization.
- Ensure explicit consent is implemented and captured in the UI before any sensitive data is processed.
Required Actions (scaleup)
- Implement automated data discovery and classification tagging across all databases.
- Enforce strict role-based access controls (RBAC) specifically tailored to limit access to sensitive data tables to authorized personnel only.
Required Actions (enterprise)
- Integrate consent management platforms directly with data engineering pipelines.
- Ensure downstream systems automatically block sensitive data processing if valid consent or a recorded legal exception is missing.
Under RA 10173, sensitive personal information includes an individual's race, ethnic origin, marital status, age, color, religious, philosophical or political affiliations, health, education, genetic or sexual life, offenses, and government-issued numbers like social security and tax returns.
An organization can process sensitive data if the data subject gives prior consent for a specific, legitimate purpose, or if a legal exception applies, such as protecting vital interests, medical treatment, or establishing legal claims.
Yes, the general rule is that processing sensitive personal information is prohibited unless the data subject provides explicit prior consent pursuant to a declared, specified, and legitimate purpose.
Exceptions include existing laws guaranteeing protection, protecting the life and health of a person unable to consent, lawful noncommercial objectives of public organizations, medical treatment by practitioners, and protection of lawful rights in court proceedings.
Yes, information about an individual's health, genetic life, and previous or current health records are explicitly defined as sensitive personal information under the Act.
Personal information is any data from which an identity is apparent or ascertainable, whereas sensitive personal information is a protected subset requiring stricter measures, covering intimate details like race, health, religious beliefs, and government IDs.
Employers can only process such sensitive data if they obtain prior explicit consent from the employee for a declared and legitimate purpose, or if another legal exception applies, such as a strict statutory obligation.
Organizations must implement appropriate organizational, physical, and technical security measures, such as encryption and strict access controls, to ensure the confidentiality, integrity, and availability of sensitive data.
Yes, the processing of sensitive information is allowed if necessary for medical treatment by a medical practitioner, or for the establishment, exercise, or defense of legal claims and court proceedings.
The unauthorized processing of sensitive personal information is penalized by imprisonment ranging from three to six years and a fine of Php500,000 to Php,000,000.
Sensitive personal information requires tighter governance because processing is generally prohibited unless explicit consent or a recognized exception applies. WatchDog Security's Compliance Center can help teams map sensitive data processing activities to required controls, track evidence such as consent records or legal basis documentation, and identify gaps before an audit or privacy review.
Sensitive data often exists across HR systems, cloud storage, SaaS tools, and internal databases, so organizations need visibility into where it lives and who can access it. WatchDog Security's Asset Inventory can help maintain an inventory of connected systems and identity mappings, while WatchDog Security's Posture Management can surface misconfigurations that may expose sensitive personal information.
| Version | Date | Author | Description |
|---|---|---|---|
| 1.0.0 | 2026-05-06 | Compliance Content Team | Initial publication |
