I. Introduction

The protection of personal data has become a central legal concern in the Philippines. With the growth of digital platforms, electronic commerce, online banking, telemedicine, human resources systems, government databases, and artificial intelligence-driven services, organizations increasingly collect, use, store, share, and analyze information about individuals. Some of this information is ordinary personal information. Some, however, is of a more delicate nature because its misuse can expose a person to discrimination, fraud, stigma, identity theft, harassment, exclusion, or other serious harm.

This special category is called sensitive personal information under the Data Privacy Act of 2012, or Republic Act No. 10173. The law treats sensitive personal information with greater caution than ordinary personal information. It generally prohibits its processing, subject only to specific exceptions. Organizations that handle it must observe stricter legal, organizational, physical, and technical safeguards.

In the Philippine legal framework, sensitive personal information is not merely data that a person considers private. It is information specifically recognized by law as deserving heightened protection because of its nature and potential impact on the rights and freedoms of the data subject.

II. Legal Framework

The primary law governing sensitive personal information in the Philippines is the Data Privacy Act of 2012. It is implemented through rules, regulations, circulars, advisories, and issuances of the National Privacy Commission, the government agency tasked with administering and enforcing the law.

The law applies to the processing of personal information by natural and juridical persons in government and the private sector, subject to territorial and extraterritorial rules. It applies where the processing occurs in the Philippines, where the personal information relates to Philippine citizens or residents in certain circumstances, or where an entity has links to the Philippines as provided by law.

The key concepts are:

Personal information refers to information from which the identity of an individual is apparent or can be reasonably and directly ascertained, or information which, when combined with other information, would directly and certainly identify an individual.

Sensitive personal information refers to specific categories of personal information that the law treats as especially sensitive.

Privileged information refers to information which, under the Rules of Court and other pertinent laws, constitutes privileged communication.

Processing includes almost any operation performed upon personal data, such as collection, recording, organization, storage, updating, retrieval, consultation, use, consolidation, blocking, erasure, destruction, disclosure, or sharing.

Data subject means the individual whose personal, sensitive personal, or privileged information is processed.

Personal information controller refers to a person or organization that controls the processing of personal data or instructs another to process personal data on its behalf.

Personal information processor refers to a person or organization that processes personal data upon the instruction of a personal information controller.

III. Definition of Sensitive Personal Information

Under the Data Privacy Act, sensitive personal information includes personal information:

About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical, or political affiliations;
About an individual’s health, education, genetic or sexual life, or any proceeding for any offense committed or alleged to have been committed by the individual, the disposal of such proceedings, or the sentence of any court in such proceedings;
Issued by government agencies peculiar to an individual, including social security numbers, previous or current health records, licenses or their denials, suspension or revocation, and tax returns; and
Specifically established by an executive order or an act of Congress to be kept classified.

This statutory list is important. Not every embarrassing, confidential, or private fact is automatically sensitive personal information under the law. However, even ordinary personal information can become sensitive in practical effect depending on context, combination, or risk. For legal classification, the statutory definition remains the starting point.

IV. Categories of Sensitive Personal Information

A. Race, Ethnic Origin, Color, and Related Identity Information

Information about race, ethnic origin, and color is sensitive because it can be used for discrimination, profiling, exclusion, harassment, or unequal treatment. In the Philippine setting, ethnic origin may be relevant to indigenous peoples, regional communities, cultural minorities, or groups with distinct linguistic or ancestral identities.

Organizations should be cautious when asking applicants, customers, patients, students, employees, or beneficiaries to disclose such information. Collection must be justified by a lawful basis and limited to what is necessary.

For example, a government program intended to deliver benefits to indigenous communities may need to process ethnic origin data. By contrast, a private employer generally should not collect such information unless there is a lawful and necessary purpose.

B. Marital Status and Age

The law expressly includes marital status and age as sensitive personal information. This may surprise some, since age and marital status are frequently requested in everyday transactions. Their inclusion reflects the possibility of discriminatory or unfair treatment.

Age may be relevant in employment, education, insurance, healthcare, lending, child protection, pension systems, and senior citizen benefits. Marital status may affect benefits administration, insurance dependents, tax matters, family law issues, or employment records. However, routine collection does not remove the need for a lawful basis.

An organization should not collect age or marital status simply because it is customary. It should determine whether the information is necessary for the declared purpose.

C. Religious, Philosophical, and Political Affiliations

Religious, philosophical, and political affiliations are highly protected because they relate to freedom of conscience, belief, expression, association, and democratic participation.

In the Philippines, this category may include information about a person’s religious denomination, membership in a religious group, political party affiliation, campaign participation, ideological association, or declared political preference. Such information can expose individuals to discrimination, retaliation, social pressure, harassment, or profiling.

Employers, schools, digital platforms, civic groups, and public authorities must be especially careful when collecting or inferring such information. Even indirect indicators, such as group membership, event attendance, donation history, or online engagement, may reveal affiliations.

D. Health Information

Health information is one of the most significant forms of sensitive personal information. It includes medical records, diagnosis, treatment history, prescriptions, laboratory results, disability information, mental health information, vaccination records, hospital admission data, and other health-related details.

Health data is routinely processed by hospitals, clinics, laboratories, pharmacies, health maintenance organizations, insurers, employers, schools, and government health agencies. The fact that health data is commonly processed does not make it less sensitive.

Processing health information must be tied to a lawful purpose, such as medical treatment, health service administration, public health, insurance claims, occupational health compliance, or legal obligation. The organization should apply strict access controls, confidentiality rules, retention limits, and secure transmission methods.

Special care should be given to mental health information, reproductive health information, HIV-related information, disability information, and other health data subject to additional confidentiality laws or ethical duties.

E. Education Information

Educational information includes school records, grades, transcripts, disciplinary records, academic standing, enrollment status, scholarship records, and other education-related data. Schools, universities, review centers, employers, credential verification services, and government agencies often process this category.

The sensitivity of education data arises from its impact on opportunities, reputation, employment, scholarships, and future prospects. Unauthorized disclosure of grades, disciplinary records, or academic deficiencies may cause embarrassment, discrimination, or reputational harm.

Educational institutions should ensure that students and parents, where applicable, understand how educational data is collected, used, disclosed, retained, and protected.

F. Genetic Information

Genetic information is especially sensitive because it reveals biological characteristics not only of an individual but potentially of family members and future descendants. It may be used in medicine, research, ancestry services, forensic investigation, or insurance risk analysis.

Because genetic information can reveal predispositions to disease, familial relationships, ethnic ancestry, and other intimate details, it requires heightened safeguards. Its processing should be strictly limited, purpose-specific, and supported by a clear lawful basis.

G. Sexual Life

Information about an individual’s sexual life is sensitive because of its intimate nature and its potential to expose a person to stigma, discrimination, blackmail, harassment, or violence. It may include information relating to sexual history, sexual behavior, sexual orientation, reproductive health, sexually transmitted infections, or intimate relationships, depending on the context.

Organizations should avoid collecting such information unless it is absolutely necessary and legally justified. Healthcare providers, counselors, social workers, law enforcement agencies, and courts may process such information in appropriate circumstances, but confidentiality and proportionality remain essential.

H. Criminal, Administrative, or Court Proceedings

Sensitive personal information includes information about proceedings for any offense committed or alleged to have been committed by an individual, the disposition of such proceedings, or court sentences.

This category covers criminal accusations, pending cases, case outcomes, convictions, acquittals, dismissals, settlements, and sentences. The reason for special protection is clear: allegations alone can damage reputation, livelihood, and liberty. Processing such information must respect due process, presumption of innocence, proportionality, and lawful purpose.

Employers conducting background checks should be careful not to collect or use criminal records indiscriminately. Public access to court information does not automatically authorize unlimited processing, republication, profiling, or commercial exploitation.

I. Government-Issued Identifiers and Records

The law treats as sensitive personal information those issued by government agencies peculiar to an individual, including social security numbers, health records, licenses or their denial, suspension or revocation, and tax returns.

This category includes identifiers and records such as Social Security System numbers, Government Service Insurance System numbers, Tax Identification Numbers, PhilHealth numbers, Pag-IBIG numbers, driver’s license numbers, passport numbers, professional license numbers, national ID-related information, and similar government-issued identifiers.

These data points are highly valuable for identity verification but also attractive for fraud, impersonation, account takeover, phishing, and identity theft. Organizations should avoid excessive collection of government IDs and should not store copies unless necessary.

Where ID collection is required, the organization should limit access, redact unnecessary fields where possible, use secure storage, avoid sending IDs over unsecured channels, and retain copies only for as long as legally or operationally necessary.

J. Tax Returns

Tax returns are specifically mentioned because they reveal income, financial status, business interests, dependents, deductions, and other private financial details. Employers, lenders, accountants, tax agents, government agencies, and courts may handle tax-related data.

Unauthorized disclosure of tax returns can cause financial harm, reputational injury, or exposure to fraud. The processing of tax returns should be based on law, contract, consent, or another valid ground and must be limited to the specific purpose.

K. Classified Information by Law or Executive Order

Sensitive personal information also includes information specifically established by executive order or act of Congress to be kept classified. This recognizes that future laws or executive issuances may designate certain information as classified or protected.

Organizations must therefore consider not only the Data Privacy Act but also sector-specific laws, rules, and regulations.

V. Sensitive Personal Information Compared with Personal Information

The distinction between personal information and sensitive personal information is central to compliance.

Ordinary personal information may include a person’s name, address, email address, contact number, photograph, or other identifying details. Sensitive personal information includes the special categories listed by law, such as health data, age, marital status, government-issued identifiers, religious affiliation, political affiliation, education records, and criminal proceedings.

The practical difference lies in the level of legal restriction. Processing ordinary personal information is allowed when justified by lawful criteria under the Data Privacy Act. Processing sensitive personal information is generally prohibited unless it falls within one of the specific exceptions.

Thus, while both categories must be protected, sensitive personal information requires stricter justification, documentation, security, access limitation, and risk management.

VI. General Rule: Processing Is Prohibited

The Data Privacy Act provides a stricter rule for sensitive personal information and privileged information. As a general principle, their processing is prohibited unless one of the lawful exceptions applies.

This structure is significant. The law does not begin with permission and then regulate misuse. It begins with prohibition and allows processing only under defined circumstances. The burden is therefore on the personal information controller to identify and document the applicable legal basis.

An organization should not assume that consent alone automatically cures all privacy issues. Consent must be valid, specific, informed, and freely given. Even with consent, processing must still comply with the general data privacy principles of transparency, legitimate purpose, and proportionality.

VII. Lawful Bases for Processing Sensitive Personal Information

The Data Privacy Act allows the processing of sensitive personal information and privileged information in specific situations. These exceptions should be interpreted carefully.

A. Consent of the Data Subject

Processing is allowed when the data subject has given consent specific to the purpose prior to the processing.

For consent to be valid, it should be freely given, specific, informed, and evidenced by written, electronic, or recorded means. The data subject must understand what information is being collected, why it is being collected, how it will be used, who will receive it, how long it will be retained, and what rights the data subject has.

For sensitive personal information, vague or bundled consent is risky. For example, a generic statement saying “I agree to the processing of my personal data” may be insufficient if it does not clearly identify sensitive data categories and purposes.

Consent should not be coerced. In employment, education, healthcare, and government contexts, there may be a power imbalance. Organizations should consider whether consent is truly voluntary or whether another lawful basis is more appropriate.

B. Processing Provided by Existing Laws and Regulations

Processing is allowed when provided for by existing laws and regulations, provided that such laws and regulations do not require the consent of the data subject for processing and guarantee protection of personal data.

This is common in government reporting, taxation, employment compliance, social security, public health, anti-money laundering compliance, education regulation, and professional licensing.

For example, an employer may process employee government identification numbers for payroll, tax withholding, and statutory benefits. A bank may process identification documents to comply with customer due diligence requirements. A hospital may process health information to comply with health regulations.

The organization must identify the specific law or regulation requiring or authorizing the processing. It should not rely on a vague claim of “legal compliance.”

C. Necessity to Protect Life and Health

Processing is allowed when necessary to protect the life and health of the data subject or another person, and the data subject is not legally or physically able to express consent prior to the processing.

This basis is relevant in emergencies. For example, a hospital may process a patient’s medical information during an emergency when the patient is unconscious. An emergency responder may disclose relevant medical information to save a person’s life.

This basis should not be used casually. It is meant for situations where immediate processing is necessary and prior consent cannot be obtained.

D. Medical Treatment

Processing is allowed when necessary to achieve the lawful and noncommercial objectives of public organizations and their associations, subject to appropriate safeguards, or when necessary for medical treatment, subject to adequate secrecy and confidentiality by medical practitioners and health care institutions.

In healthcare, processing sensitive personal information is often necessary for diagnosis, treatment, referral, laboratory testing, billing, insurance claims, and continuity of care. However, medical necessity does not authorize indiscriminate disclosure. Medical confidentiality remains a cornerstone.

Healthcare institutions must ensure that only authorized personnel access patient data, and only for legitimate healthcare-related purposes.

E. Protection of Lawful Rights and Interests in Court Proceedings or Legal Claims

Processing is allowed when necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, establishment of legal claims, or when provided to government or public authority.

This basis is important in litigation, arbitration, administrative proceedings, labor disputes, insurance claims, debt recovery, disciplinary proceedings, and legal advice.

For example, an employer may process attendance records, medical certificates, disciplinary records, or government identification details in a labor case. A party to litigation may process medical records or financial documents if relevant to the claims or defenses, subject to court rules and confidentiality obligations.

The processing must still be necessary and proportionate. Sensitive data should not be disclosed beyond what is relevant to the claim or proceeding.

F. Other Lawful Bases and Sector-Specific Rules

The Data Privacy Act must be read alongside other Philippine laws, including laws on banking, insurance, telecommunications, education, health, labor, taxation, social security, anti-money laundering, public health, child protection, cybercrime, and government records.

Sector-specific laws may impose additional duties of confidentiality or reporting. Compliance requires harmonizing the Data Privacy Act with these laws.

VIII. Privileged Information

Although the focus of this article is sensitive personal information, privileged information deserves mention because the Data Privacy Act treats it together with sensitive personal information in several provisions.

Privileged information includes information that constitutes privileged communication under the Rules of Court and other pertinent laws. Examples may include attorney-client communications, physician-patient communications, priest-penitent communications, marital communications, and other legally recognized privileges.

The processing of privileged information requires extreme caution. A person or organization handling privileged information should consider not only the Data Privacy Act but also evidentiary rules, professional ethics, confidentiality obligations, and privilege doctrines.

IX. Principles Governing Processing

Even when processing sensitive personal information is allowed, it must comply with the core data privacy principles.

A. Transparency

The data subject must be informed of the nature, purpose, and extent of processing. This generally requires a privacy notice or comparable communication.

The notice should explain:

What sensitive personal information is collected;
Why it is collected;
The legal basis for processing;
How it will be used;
Whether it will be shared;
Who may receive it;
How long it will be retained;
How it will be protected;
The rights of the data subject; and
How to contact the organization’s data protection officer or responsible unit.

Transparency does not mean overwhelming the data subject with legalistic text. It means giving meaningful, understandable, and accessible information.

B. Legitimate Purpose

Processing must be compatible with a declared and lawful purpose. Sensitive personal information should not be collected “just in case.” A purpose must be real, specific, lawful, and connected to the organization’s function or transaction.

For example, collecting a customer’s government ID number may be legitimate for identity verification where required by law or risk controls. Collecting the customer’s religion or marital status for a simple retail transaction would usually be difficult to justify.

C. Proportionality

Processing must be adequate, relevant, suitable, necessary, and not excessive in relation to the declared purpose. This principle is especially important for sensitive personal information.

Organizations should ask:

Is this sensitive data truly necessary?
Can the purpose be achieved with less intrusive data?
Can the data be anonymized, aggregated, or redacted?
Can access be limited to fewer people?
Can retention be shortened?
Can the data subject be given more control?

Proportionality requires restraint. The more sensitive the data, the stronger the justification and safeguards should be.

X. Rights of the Data Subject

Data subjects have rights under the Data Privacy Act. These rights apply to sensitive personal information, subject to lawful limitations.

A. Right to Be Informed

A data subject has the right to be informed whether personal data is being processed or has been processed. For sensitive personal information, this right is particularly important because the data subject should know why highly sensitive data is being collected and used.

B. Right to Object

A data subject may object to processing in certain circumstances, including processing based on consent or legitimate interests. When the data subject objects, the organization should stop processing unless there is a legal or contractual basis to continue.

For sensitive personal information, the right to object may be limited where processing is required by law, necessary for legal claims, or necessary for other lawful grounds.

C. Right of Access

A data subject has the right to reasonable access to personal data processed about them, including sources, recipients, reasons for disclosure, and other relevant information.

Access to sensitive personal information must be handled securely. Organizations should verify identity before releasing sensitive records.

D. Right to Rectification

A data subject may dispute inaccuracies and request correction. This is important for sensitive information such as health records, education records, government identifiers, employment records, and disciplinary records.

Incorrect sensitive personal information can cause serious harm. Organizations should have procedures for correction, notation of disputes, and communication of corrections to recipients where appropriate.

E. Right to Erasure or Blocking

A data subject may request suspension, withdrawal, blocking, removal, or destruction of personal data under certain circumstances, such as unlawful processing, expired purpose, or withdrawal of consent.

However, erasure is not absolute. An organization may retain sensitive personal information where retention is required by law, necessary for legal claims, or justified by another lawful basis.

F. Right to Damages

A data subject may be indemnified for damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal data, considering any violation of rights and freedoms.

G. Right to Data Portability

Where applicable, a data subject may obtain a copy of electronically processed personal data in a structured or commonly used format. This right may be relevant to health records, financial records, employment records, or platform data, depending on the circumstances.

XI. Obligations of Personal Information Controllers

Organizations that control the processing of sensitive personal information must comply with several obligations.

A. Accountability

The organization is responsible for personal data under its control, including data processed by contractors, vendors, cloud providers, payroll providers, clinics, background check providers, and other processors.

Accountability means the organization should be able to demonstrate compliance through policies, records, contracts, training, risk assessments, and safeguards.

B. Data Protection Officer

Organizations required to designate a Data Protection Officer or similar accountable person should ensure that such officer has sufficient knowledge, independence, authority, and resources. The DPO plays a key role in advising on sensitive personal information, handling data subject requests, monitoring compliance, and coordinating breach response.

C. Privacy Management Program

Organizations should maintain a privacy management program that includes governance, policies, risk assessment, training, incident response, vendor management, records of processing, and continuous improvement.

Sensitive personal information should be identified and mapped. An organization cannot protect what it does not know it holds.

D. Privacy Impact Assessment

A privacy impact assessment is especially important where processing involves large volumes of sensitive personal information, systematic monitoring, profiling, new technologies, vulnerable individuals, or high-risk processing.

A PIA should evaluate necessity, proportionality, risks, safeguards, retention, access controls, sharing, and breach impact.

E. Data Sharing Agreements

Where sensitive personal information is shared between organizations, a data sharing agreement or equivalent arrangement may be necessary. The agreement should define purpose, legal basis, data categories, security measures, retention, data subject rights, breach notification, accountability, and restrictions on onward transfer.

Data sharing should not be treated casually. Disclosure is itself a form of processing.

F. Contracts with Processors

If a processor handles sensitive personal information on behalf of a controller, there should be a written contract requiring the processor to process only on documented instructions, implement safeguards, maintain confidentiality, assist with rights requests, report breaches, and return or delete data after the engagement.

Cloud services, payroll vendors, HR platforms, medical service providers, IT support providers, and outsourced customer support providers may all function as processors depending on the arrangement.

XII. Security Measures

Sensitive personal information requires appropriate organizational, physical, and technical security measures.

A. Organizational Measures

Organizational safeguards include:

Privacy policies;
Access authorization procedures;
Confidentiality undertakings;
Employee training;
Role-based access;
Vendor due diligence;
Incident response plans;
Data retention schedules;
Internal audits;
Clear disciplinary rules for misuse.

Human error is one of the most common causes of privacy incidents. Training and clear procedures are therefore essential.

B. Physical Measures

Physical safeguards include:

Locked filing cabinets;
Restricted records rooms;
Visitor controls;
Secure disposal bins;
Shredding of documents;
Clean desk policies;
Secure storage of backup media;
Protection against theft, fire, flood, and unauthorized entry.

Paper records remain a major privacy risk, especially in clinics, schools, government offices, law firms, and HR departments.

C. Technical Measures

Technical safeguards include:

Encryption;
Strong authentication;
Multi-factor authentication;
Access logs;
Intrusion detection;
Secure backups;
Data loss prevention;
Secure file transfer;
Endpoint protection;
Patch management;
Network segmentation;
Password policies;
Audit trails;
Secure deletion;
Pseudonymization or anonymization where appropriate.

The level of security should correspond to the sensitivity, volume, context, and risk of the data.

XIII. Data Breach and Notification

A personal data breach may involve accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data. Breaches involving sensitive personal information are more likely to create real risk of serious harm.

The National Privacy Commission’s breach notification rules require notification in certain circumstances, particularly where sensitive personal information or information that may enable identity fraud is involved, where the data is reasonably believed to have been acquired by an unauthorized person, and where the breach is likely to give rise to a real risk of serious harm to the affected data subject.

Organizations should have a breach response plan that includes:

Detection and containment;
Internal escalation;
Assessment of affected data;
Determination of whether sensitive personal information is involved;
Risk assessment;
Notification to the National Privacy Commission where required;
Notification to affected data subjects where required;
Remediation;
Documentation;
Post-incident review.

Breach notification should not be delayed by reputational concerns. Failure to notify when required may worsen legal exposure.

XIV. Retention and Disposal

Sensitive personal information should not be retained indefinitely. Retention must be based on legal, regulatory, contractual, operational, or legitimate business needs.

Organizations should establish retention periods for different categories of sensitive data. For example:

Employee records may be retained based on labor, tax, and litigation requirements;
Health records may be retained based on medical, regulatory, and institutional rules;
Customer identification records may be retained based on financial regulation or fraud prevention needs;
CCTV footage should generally be retained only for a limited period unless needed for investigation;
Applicant records should not be kept indefinitely if the applicant is not hired, unless there is consent or another lawful basis.

Secure disposal is equally important. Paper records should be shredded or securely destroyed. Electronic records should be securely deleted, overwritten, anonymized, or otherwise rendered inaccessible.

XV. Cross-Border Transfers

Sensitive personal information may be transferred outside the Philippines, such as when using cloud storage, offshore processors, international HR systems, regional databases, or foreign service providers.

The Data Privacy Act does not prohibit cross-border transfers per se, but the controller remains accountable for personal data under its control. The organization should ensure that foreign recipients provide comparable protection, contractual safeguards, access controls, breach notification duties, and limits on use.

Before transferring sensitive personal information abroad, organizations should assess:

The purpose of transfer;
The recipient’s role;
The destination country;
Security measures;
Contractual protections;
Sub-processing;
Government access risks;
Data subject rights;
Breach response arrangements.

XVI. Employment Context

Employers commonly process sensitive personal information, including age, marital status, health information, government identification numbers, tax information, disciplinary records, biometric data, and sometimes criminal background information.

Common HR-related purposes include recruitment, payroll, statutory benefits, tax compliance, occupational health, workplace safety, performance management, investigations, disciplinary proceedings, and litigation.

Employers should observe the following:

Collect only information necessary for employment purposes;
Avoid irrelevant questions in application forms;
Use medical examinations only when job-related and lawful;
Protect 201 files and HR information systems;
Limit access to HR, payroll, and authorized managers;
Keep disciplinary and investigation records confidential;
Avoid public disclosure of employee medical or disciplinary issues;
Use employee consent carefully because of unequal bargaining power;
Provide privacy notices to employees and applicants.

Employee monitoring, biometrics, and workplace investigations involving sensitive data require particular caution.

XVII. Healthcare Context

Healthcare providers process some of the most sensitive forms of personal information. Hospitals, clinics, laboratories, physicians, nurses, pharmacists, telemedicine platforms, and health insurers must comply with the Data Privacy Act as well as medical confidentiality obligations.

Important healthcare privacy practices include:

Patient privacy notices;
Confidential handling of charts and electronic medical records;
Role-based access;
Secure patient portals;
Confidential consultations;
Secure release of medical certificates;
Identity verification before releasing records;
Careful sharing with insurers and HMOs;
Secure telemedicine platforms;
Protection of minors, mental health patients, and vulnerable persons;
Clear rules for research use of patient data.

A patient’s presence in a hospital or clinic may itself be sensitive. Staff should avoid casual disclosure of patient status, diagnosis, or room number.

XVIII. Education Context

Schools and universities process student age, education records, health information, disciplinary records, ID numbers, family information, and sometimes religious information.

Educational institutions should ensure privacy in:

Enrollment forms;
Student information systems;
Online learning platforms;
Grade publication;
Disciplinary proceedings;
Guidance counseling;
Medical records;
Scholarship administration;
Parent or guardian access;
Alumni records;
Research involving students.

Publishing grades, class rankings, disciplinary actions, or student health information without lawful basis may violate privacy rights.

XIX. Financial and Commercial Context

Banks, fintech companies, insurers, lenders, payment providers, and other financial institutions process government IDs, tax information, financial records, biometric data, and other sensitive personal information.

They often process such data for identity verification, fraud prevention, credit evaluation, anti-money laundering compliance, account management, insurance underwriting, and claims processing.

Because financial identity data is attractive to criminals, organizations should apply strong authentication, encryption, fraud monitoring, vendor controls, and strict retention rules.

Commercial establishments should avoid over-collection. A retail promo, loyalty program, or raffle should not ask for sensitive personal information unless truly necessary.

XX. Government Context

Government agencies process large volumes of sensitive personal information, including civil registry data, tax data, health data, social welfare data, licensing records, criminal justice records, education records, and national identification information.

The public character of government functions does not eliminate privacy obligations. Government agencies must comply with transparency, legitimate purpose, proportionality, security, retention, and accountability requirements.

Privacy is particularly important in social welfare, law enforcement, taxation, health, education, immigration, and licensing because citizens often have no practical choice but to provide information.

XXI. Online Platforms, Apps, and Digital Services

Digital services may process sensitive personal information directly or indirectly. An app may collect age, location, health information, government ID images, biometric identifiers, payment data, or behavioral data. Even if the app does not ask for sensitive data, it may infer sensitive traits through analytics.

Privacy notices for apps should be clear and mobile-friendly. Consent screens should not be deceptive. Permissions should be limited. Sensitive data should not be shared with advertisers or analytics providers without a lawful basis and adequate disclosure.

Children’s data, health apps, dating apps, finance apps, e-wallets, and identity verification platforms require heightened privacy protection.

XXII. Biometric Information

The Data Privacy Act’s text does not list “biometric information” in the same direct way as some foreign privacy laws, but biometric systems often involve sensitive personal information because they may relate to government IDs, identity verification, security, employment, or other legally protected data. Biometric data may include fingerprints, facial templates, iris scans, voiceprints, hand geometry, or other unique biological identifiers.

Organizations using biometrics should consider necessity and proportionality. Biometrics are difficult to replace once compromised. Unlike passwords, a person cannot easily change fingerprints or facial features.

Best practices include:

Use biometrics only where necessary;
Avoid storing raw biometric images when templates are sufficient;
Encrypt biometric templates;
Keep biometric databases separate from other identifiers;
Limit access;
Provide alternatives where appropriate;
Conduct a privacy impact assessment;
Define retention and deletion rules.

XXIII. Children and Vulnerable Data Subjects

Sensitive personal information of children and vulnerable persons requires special care. Children may not fully understand privacy risks, and parents or guardians may be involved in consent and access decisions.

Schools, pediatric clinics, social welfare agencies, online platforms, and child-focused services should adopt child-appropriate privacy notices, stricter access controls, and careful disclosure practices.

Sensitive information involving minors, such as health conditions, disciplinary matters, family circumstances, abuse reports, or counseling records, must be handled with heightened confidentiality.

XXIV. Consent in Detail

Consent is often misunderstood. Under the Data Privacy Act, consent should be specific and informed. For sensitive personal information, organizations should avoid broad blanket consent.

A good consent form should identify:

The organization collecting the data;
The specific sensitive personal information collected;
The purpose of collection;
The legal basis;
The recipients or categories of recipients;
Whether sharing is mandatory or optional;
Retention period;
Rights of the data subject;
Withdrawal mechanism;
Contact details of the DPO or privacy office.

Consent should not be hidden in long terms and conditions. It should not be obtained through pre-ticked boxes, vague clauses, or forced acceptance of unnecessary processing.

Withdrawal of consent should be as easy as giving consent, subject to legal or contractual consequences where applicable.

XXV. Data Minimization

Data minimization is one of the most practical ways to reduce privacy risk. Organizations should regularly review forms, systems, and workflows to remove unnecessary sensitive data fields.

Examples:

Do not collect birthdate if age range is sufficient;
Do not collect a government ID number if visual verification is enough;
Do not keep photocopies of IDs when recording verification may suffice;
Do not request marital status unless legally or operationally necessary;
Do not ask for religion unless relevant to the service;
Do not collect medical information beyond what is needed;
Do not store criminal background information longer than necessary.

The safest sensitive personal information is often the information never collected.

XXVI. Disclosure and Sharing

Disclosure of sensitive personal information must be supported by a lawful basis and limited to the intended purpose. Common disclosures include sharing with government agencies, insurers, service providers, courts, auditors, lawyers, banks, schools, employers, or healthcare providers.

Before sharing, an organization should ask:

Is sharing necessary?
What is the legal basis?
Has the data subject been informed?
Is the recipient authorized?
Is there a contract or data sharing agreement?
Are only necessary fields shared?
Is the transmission secure?
Is onward sharing prohibited?
Is the disclosure documented?

Accidental disclosure, such as emailing medical records to the wrong recipient or posting a list of beneficiaries with full identifiers, can constitute a privacy breach.

XXVII. Publicly Available Information

A common misconception is that information available online or in public records can be freely used for any purpose. Public availability does not eliminate data privacy obligations.

Sensitive personal information may appear in court records, government registries, social media posts, school publications, professional directories, or news reports. However, scraping, aggregating, republishing, profiling, or using such information for unrelated purposes may still violate privacy principles.

The purpose and context of availability matter. Information made available for one purpose should not automatically be used for another incompatible purpose.

XXVIII. Anonymization and Pseudonymization

Anonymization removes identifying elements so that an individual can no longer be identified. Properly anonymized data may fall outside personal data rules. However, anonymization must be robust. If re-identification is reasonably possible, the data remains personal data.

Pseudonymization replaces identifiers with codes or tokens but allows re-identification through additional information. Pseudonymized data remains personal data but reduces risk.

For sensitive personal information, anonymization or pseudonymization is useful in research, analytics, statistics, testing, and reporting. Organizations should avoid using live sensitive data for system testing or training unless necessary and protected.

XXIX. Research and Statistics

Sensitive personal information may be processed for research, public policy, health studies, academic work, or statistics, subject to applicable legal bases, ethics review, safeguards, and proportionality.

Researchers should consider:

Informed consent;
Ethics approval;
Data minimization;
De-identification;
Secure storage;
Limited access;
Data sharing restrictions;
Publication risk;
Retention and destruction;
Protection of vulnerable participants.

Publication of research findings should avoid re-identifying participants, especially in small communities or rare conditions.

XXX. Artificial Intelligence and Automated Processing

AI systems may process sensitive personal information directly or infer it indirectly. For example, algorithms may infer health status, age, political preference, religious affiliation, ethnicity, pregnancy, or financial vulnerability from behavior, images, purchases, or communications.

AI-related processing raises issues of transparency, fairness, profiling, bias, explainability, purpose limitation, and proportionality.

Organizations using AI should:

Identify whether sensitive personal information is used or inferred;
Conduct privacy impact assessments;
Avoid unnecessary sensitive attributes;
Test for bias and discriminatory outcomes;
Provide meaningful notices;
Limit automated decisions with serious effects;
Secure training data;
Control vendor access;
Consider anonymization or synthetic data;
Maintain human oversight where appropriate.

Using AI does not remove obligations under the Data Privacy Act.

XXXI. Direct Marketing and Profiling

Sensitive personal information should generally not be used for direct marketing unless there is a clear lawful basis and the data subject has been properly informed. Profiling based on religion, health, ethnicity, political affiliation, sexual life, or government identifiers can be highly intrusive and risky.

Organizations should avoid using sensitive data to target individuals in ways that exploit vulnerability, manipulate beliefs, or discriminate.

Marketing consent should be separate from consent for essential services. Data subjects should be able to opt out easily.

XXXII. Common Compliance Mistakes

Common mistakes include:

Collecting government IDs without necessity;
Keeping photocopies of IDs indefinitely;
Using one broad consent clause for all processing;
Publishing lists containing full names with birthdates, addresses, or ID numbers;
Sending sensitive documents through unsecured email or messaging apps;
Allowing too many employees to access HR or medical records;
Failing to execute contracts with processors;
Ignoring retention limits;
Treating public records as free-for-all data;
Failing to notify the National Privacy Commission of notifiable breaches;
Using live sensitive data for software testing;
Collecting health data from employees without clear necessity;
Recording excessive CCTV footage or retaining it too long;
Sharing student grades or disciplinary records improperly;
Assuming consent is always valid in employment or government contexts.

XXXIII. Examples of Sensitive Personal Information in Practice

Examples include:

Birthdate where used as age information;
Marital status in HR records;
Religion in school or hospital records;
Political affiliation in campaign databases;
Medical certificates submitted to employers;
Laboratory results;
Vaccination records;
Mental health records;
Student transcripts;
Disciplinary records;
Genetic test results;
Criminal case records;
NBI clearance details;
Police blotter information;
Driver’s license number;
Passport number;
SSS, GSIS, PhilHealth, Pag-IBIG, or TIN numbers;
Tax returns;
Professional license records;
Government benefit records;
Disability records;
Biometric templates used for identification.

XXXIV. Enforcement and Penalties

The Data Privacy Act provides penalties for various violations, including unauthorized processing, processing for unauthorized purposes, negligent access, improper disposal, unauthorized access or intentional breach, concealment of security breaches involving sensitive personal information, malicious disclosure, and unauthorized disclosure.

Violations involving sensitive personal information generally carry heavier consequences than violations involving ordinary personal information. Officers, employees, agents, or responsible individuals may face liability depending on participation and the nature of the offense. Juridical entities may also face consequences through responsible officers and applicable regulatory action.

Apart from statutory penalties, organizations may face civil liability, regulatory orders, reputational damage, loss of trust, contractual claims, employment disputes, and business disruption.

XXXV. Sensitive Personal Information and Other Philippine Laws

Sensitive personal information often overlaps with other legal regimes, including:

Civil Code privacy and damages provisions;
Revised Penal Code provisions on secrecy and related offenses;
Cybercrime Prevention Act;
E-Commerce Act;
Anti-Photo and Video Voyeurism Act;
Safe Spaces Act;
Magna Carta for Disabled Persons;
Mental Health Act;
HIV and AIDS Policy Act;
Philippine Identification System Act;
Labor Code and labor regulations;
Tax laws;
Banking secrecy and financial regulations;
Anti-Money Laundering Act;
Insurance regulations;
Education laws and regulations;
Health laws and professional ethics rules;
Rules of Court and evidentiary privileges.

Compliance with the Data Privacy Act does not automatically mean compliance with all other confidentiality laws. Organizations should assess sector-specific duties.

XXXVI. Practical Compliance Checklist

An organization processing sensitive personal information should consider the following checklist:

Identify all sensitive personal information collected and processed;
Map where the data comes from, where it is stored, who accesses it, and where it is shared;
Determine the lawful basis for each processing activity;
Review whether collection is necessary and proportionate;
Update privacy notices;
Obtain valid consent where consent is the applicable basis;
Avoid using consent where processing is actually based on law or contract;
Limit access based on roles;
Encrypt sensitive databases and files where appropriate;
Secure paper records;
Train employees handling sensitive data;
Execute contracts with processors;
Execute data sharing agreements where needed;
Conduct privacy impact assessments for high-risk processing;
Establish retention and disposal rules;
Implement breach detection and response procedures;
Maintain records of processing activities;
Review third-party vendors;
Protect data subject rights;
Audit compliance regularly.

XXXVII. Practical Guidance for Individuals

Data subjects should also take steps to protect their sensitive personal information.

Individuals should:

Ask why sensitive data is needed;
Read privacy notices before submitting forms;
Avoid sending IDs through unsecured channels where possible;
Watermark ID copies when appropriate;
Provide only necessary information;
Be cautious with online quizzes, apps, and forms;
Use strong passwords and multi-factor authentication;
Monitor accounts for suspicious activity;
Exercise rights of access, correction, objection, or erasure where applicable;
Report suspected misuse or breach to the organization and, where appropriate, to the National Privacy Commission.

Privacy protection is not only an organizational duty; it is also a matter of individual vigilance.

XXXVIII. Conclusion

Sensitive personal information occupies a special place in Philippine data privacy law. It includes information about identity, beliefs, health, education, genetics, sexual life, criminal or court proceedings, government identifiers, tax records, and legally classified information. Because misuse of such information can cause serious harm, the Data Privacy Act imposes stricter rules on its processing.

The central rule is that processing sensitive personal information is generally prohibited unless a lawful exception applies. Even when processing is allowed, it must comply with transparency, legitimate purpose, proportionality, security, accountability, and respect for data subject rights.

For organizations, the proper handling of sensitive personal information requires more than a privacy notice or consent form. It requires governance, discipline, security, minimization, training, contracts, breach readiness, and a culture of respect for privacy.

For individuals, awareness of the sensitivity of their data is essential. In a digital society, sensitive personal information can determine access to services, employment, healthcare, education, financial opportunities, and personal security.

The Data Privacy Act recognizes that personal data is not merely an asset to be collected, stored, and analyzed. It is connected to human dignity, autonomy, equality, and freedom. Sensitive personal information deserves heightened protection because it reveals the most intimate, defining, and potentially vulnerable aspects of a person’s life.

This is a general legal article and not a substitute for advice from counsel on a specific case, transaction, breach, or compliance program.