NPC Clarifies Data Sharing Agreement Requirements Under NPC Circular No. 2020-03

To address persistent misconceptions surrounding data sharing obligations, the National Privacy Commission (NPC) issued Advisory No. 2025-01 on 26 June 2025. The advisory provides key clarifications on NPC Circular No. 2020-03, which governs data sharing agreements (DSAs) in the context of personal data processing.

 

The issuance reaffirms that while data sharing remains subject to the lawful criteria for processing under the Data Privacy Act of 2012 (DPA), the execution of a DSA is not mandatory. Rather, DSAs are encouraged as a best practice—not as a legal prerequisite—for ensuring transparency, accountability, and responsible data stewardship.

 

Clarifying the Legal Landscape

 

NPC Circular No. 2020-03 previously revised the framework established by NPC Circular 16-02, removing the blanket requirement for DSAs in all cases of data sharing. Despite this, the Commission continues to receive inquiries suggesting that many Personal Information Controllers (PICs) still treat DSAs as compulsory. Advisory No. 2025-01 aims to set the record straight.

 

According to the NPC, the term “may” used in Section 8 of the 2020 Circular was intentional—signaling that DSAs are optional. Nonetheless, PICs are strongly encouraged to execute DSAs to document roles, responsibilities, and data protection measures under data sharing arrangements. A DSA may be in the form of a contract, memorandum, or other written instrument, but it does not itself serve as legal basis for data sharing.

 

The NPC emphasized that any uncertainty in the interpretation of the advisory should be resolved in favor of protecting data subject rights.

 

Through this clarification, the Commission aims to guide PICs toward a more practical and rights-based approach to data sharing—grounded in law, not paperwork.

 

For more information, click here.