A Philippine law office handles information that can affect a client’s finances, family, liberty, or reputation. Data privacy therefore starts with knowing what the firm collects, why it is needed, who can see it, and when it should be removed. NPC registration is one part of that work.
Under NPC Circular No. 2022-04, mandatory registration can arise from employing at least 250 persons, processing sensitive personal information of at least 1,000 individuals, or processing likely to risk data subjects’ rights and freedoms. Automated decision-making or profiling has specific registration treatment. A small headcount alone does not settle the question.
Map the firm’s information before deciding
Inventory intake forms, conflict registers, active files, archived matters, billing records, recruitment files, device backups, and vendor systems. Identify which party determines processing purposes and which provider processes on its behalf. Do not assume every cloud vendor has the same role.
For each system, record the data categories, purpose, people affected, storage location, recipients, access groups, and retention decision. This working inventory should be specific enough to reveal a shared folder containing old IDs or a former employee retaining client access.
Assess registration and exemption correctly
Document the applicable registration criteria and the evidence supporting the assessment. The NPC provides a sworn declaration and undertaking process for eligible exemptions from mandatory system registration. An exemption from registration does not remove substantive data-protection duties.
Use a practical law office checklist
Apply the checklist to real workflows. For example, a prospective client should not have to send a full medical history before the firm has completed its preliminary conflict review. A billing employee may need invoice details without access to every litigation document.
| Control | Practical evidence |
|---|---|
| Responsibility | Named privacy lead and an escalation route |
| Collection | Intake fields limited to the present purpose |
| Notice and lawful processing | Reviewed notice and a documented basis for relevant processing |
| Access | Role-based permissions and departure checklist |
| Sharing | Approved recipient and vendor arrangements |
| Retention | Matter closure review and documented disposal decisions |
| Incidents | Incident log, response owner, and reporting assessment |
Review vendors with concrete questions
Ask who can access uploaded files, how support access is authorized, what happens after account termination, and whether a complete export is available. Record subcontractor arrangements and cross-border processing considerations where relevant.
A registration seal is not evidence that every deployment, permission setting, or staff practice is secure. Ask the vendor to demonstrate controls in a trial environment. Then configure the firm’s own access rules and train staff to use them.
- •Use individual accounts rather than shared passwords.
- •Remove access promptly after a role change or departure.
- •Keep confidential material out of public demonstration datasets.
- •Test whether a mistaken external share can be revoked.
- •Keep a record of vendor review and unresolved questions.
Prepare for a lost device or mistaken email
Create a short response card: who receives the report, who can suspend access, where the facts are logged, and who assesses notification duties under the current rules. Staff should report quickly without waiting to prove the event is a legally notifiable breach.
Run a tabletop exercise using a fictional file sent to the wrong address. Time how long the team takes to identify the recipient, restrict further access, preserve evidence, and reach the responsible lawyer. Use the exercise to improve the process rather than to collect blame.
Frequently asked questions
Is a small law firm automatically exempt from NPC registration?
No. Headcount is only one criterion. Assess the sensitive-data and risk criteria, as well as any applicable automated-processing requirements.
Does NPC registration prove full DPA compliance?
No. The firm still needs appropriate processing practices, access controls, retention decisions, vendor governance, and incident handling.
Try DueCounsel Free
Built for Philippine law firms. Free migration, onboarding, and training.
Start Free