Background
On 13 April 2026, the National Privacy Commission of the Philippines (the “NPC”) issued Advisory No. 2026-01, or the Guidelines on Data Scraping of Publicly Available Personal Data (the “Advisory”).
As businesses increasingly rely on data scraping for market research, competitive intelligence, marketing, recruitment, and AI development, the Advisory serves as an important reminder that publicly available personal data remains subject to the Data Privacy Act of 2012, or Republic Act No. 10173 and its implementing rules and regulations (the “DPA”). Personal information controllers (“PICs”) and personal information processors (“PIPs”) must comply with the DPA and the Advisory when processing such data obtained through data scraping.
Overview of the Advisory
1. Scope and definitions
The Advisory applies to PICs and PIPs that engage in data scraping, including scraping carried out by third parties on their behalf, and to PICs whose websites, applications, or other platforms host publicly available personal data. The provisions on use of scraped data extend to PICs that obtain data sourced from other PICs independently engaged in scraping.
“Data scraping” broadly covers the automated or manual extraction of publicly available personal data, including text, images, audio and video recordings, and user profiles, from websites, applications, and other online sources. “Publicly available personal data” refers to personal data accessible without restrictions or the need for authorization, whether required by law to be made public or posted by data subjects themselves, such as on social media. The Advisory also introduces “large-scale scraping,” which is evaluated by the number of data subjects affected, the volume or range of data extracted, the duration or permanence of the activity, and its geographical extent.
2. Purpose and lawful basis
PICs that scrape data must define a specific and legitimate purpose that is not contrary to law, morals, public order, or public policy, and must limit processing to that declared purpose. Processing must not extend to unrelated purposes or those that data subjects would not reasonably expect.
PICs must also determine the lawful basis for processing under Section 12 or 13 of the DPA, including for any further disclosure to third parties. Public availability of personal data does not constitute consent to processing for purposes beyond those reasonably contemplated when the data was provided, nor does it relieve PICs of its obligations under the DPA.
Consistent with the principles of proportionality, scraped data must be adequate, relevant, suitable, and necessary for the declared purpose. PICs must refrain from excessive or indiscriminate scraping and assess whether the purpose could be reasonably fulfilled by less intrusive means.
3. Sensitive personal information and vulnerable data subjects
Scraping involving sensitive personal information is prohibited unless the PIC demonstrates a valid lawful basis under Section 13 of the DPA, that collection is strictly necessary and proportional to a legitimate purpose, and that enhanced security measures are in place. Further, data scraping involving vulnerable data subjects, such as minors, the elderly, and persons with disabilities, faces heightened scrutiny, and the PIC must demonstrate that the processing does not exploit their capacity.
4. Transparency
PICs that scrape data must inform data subjects, through a privacy notice or, where processing is consent-based, a consent form, that their personal data will be processed using data scraping practices, before processing begins or at the next practical opportunity. This applies in addition to NPC Circular No. 2023-04 on the Guidelines on Consent.
When personal data is obtained through scraping from publicly available sources, PICs must disclose this fact in its privacy notice, with the source of the data, purpose of collection, and manner of processing.
5. Privacy Impact Assessment
PICs engaged in data scraping must conduct a Privacy Impact Assessment (“PIA”) covering such activities, including scraping performed on its behalf by third parties. The PIA must assess the nature, scope, and purpose of scraping activities, the risks to data subjects, including risks from aggregating scraped data with other datasets, and the mitigating measures adopted. It must be reviewed periodically and whenever the scraping activity materially changes.
6. Hosting obligations
For PICs whose websites or platforms host publicly available personal data, data subjects must be informed that their personal data are publicly available and may be subject to scraping. The Advisory recommends a hosting PIC to also disclose the categories of personal data that are accessible, whether its terms of service permit third-party scraping and the identities of those parties where known, how data subjects may object to, disallow, or seek the termination of scraping, and the security measures in place.
A hosting PIC must implement reasonable and appropriate security measures, which may include conducting a PIA, bot detection, rate limits, monitoring suspicious accounts, and breach notification procedures where unauthorized scraping is a notifiable personal data breach.
7. Use of scraped data and accountability
Scraped personal data must not be used in ways that cause harm to data subjects, such as for identity fraud or targeted cyberattacks, doxxing intended to harass or intimidate, unauthorized sale or disclosure for malicious purposes, unauthorized surveillance, large-scale scraping of social media for unauthorized profiling, and the collection of login credentials, nor for purposes beyond those originally declared unless a lawful basis exists, sufficient notice is given to affected data subjects, and a new PIA is conducted.
PICs that obtain scraped personal data from another PIC must establish policies and procedures, including contractual means, to verify that it was obtained in compliance with the DPA and NPC issuances. Where the underlying scraping was unauthorized, further processing is likewise unauthorized. Contractual arrangements do not relieve PICs of accountability for scraping carried out by PIPs on their behalf.
8. Unauthorized data scraping
Data scraping is unauthorized where it violates applicable laws, the DPA, NPC issuances, or the terms of service or use of websites or applications. This includes circumventing technical measures such as robots.txt exclusion protocols and CAPTCHAs, and the use of deceptive design patterns, misrepresentation, or similar techniques. Unauthorized scraping may give rise to criminal, civil, and administrative liability.
Conclusion
The Advisory underscores that publicly available personal data is not free for unrestricted use. Organizations need not engage directly in data scraping to be affected. Hosting publicly available personal data or acquiring scraped datasets from third parties carries its own compliance obligations. Businesses should review their privacy notices, PIAs, contractual arrangements, and data source due diligence processes to ensure compliance with the DPA and the Advisory. Any doubt in the interpretation of the Advisory is to be resolved in favor of protecting the rights and interests of data subjects.
