NPC Issues Guidance on Third-Party KYC Processing of Sensitive Data From PhilID QR Codes
On December 26, 2025, the National Privacy Commission, through NPC Advisory Opinion 2025-015, established that the Data Privacy Act (DPA) and the Philippine Identification System (PhilSys) Act do not categorically prohibit banks, as a personal information controller (PIC), from sharing PhilSys QR codes embedded in the physical or electronic PhilID cards of clients with duly contracted third-party know-your-client (KYC) providers as personal information processor (PIP).
The PhilSys QR code is a means of accessing or confirming identifiable data about the cardholder which either replicates or is directly linked to the personal information printed on the PhilSys ID. The PhilSys ID contains data recorded in the PhilSys Registry such as demographic information (registrant’s full name, sex, date and place of birth, blood type, address, and citizenship, or resident status), as well as biometric information including but not limited to photographs, fingerprints, and iris scans. These data are linked to randomly generated PhilSys Number which is then associated with each PhilID. The QR code, as part of the PhilID’s security feature, may be scanned to authenticate a PhilID.. The code also embeds the registrant’s digital signature which can be used to check that the ID has not been altered.
The government-issued identifiers and biometric data accessed or derived from the PhilSys QR code are expressly classified as sensitive personal information under Section 3(l) of the DPA, which includes “any information that is issued by government agencies peculiar to an individual” and biometric data such as photographs and fingerprints.”. Consequently, processing personal data from the PhilSys ID, including any data accessed through the QR code, must comply with requirements under Sections 12 and 13 of the DPA.
Banks, as a personal information controller (PIC), determine the purposes and means of processing its customers’ personal data for KYC, account opening, credit card issuance, and related services. Duly contracted third-party KYC providers, as the personal information processor (PIP), process personal data on behalf of and upon the instructions of the bank. Under the DPA, a PIC refers to a person or organization who controls the collection, holding, processing or use of personal information, including a person or organization who instructs another person or organization to collect, hold, process, use, transfer or disclose personal information on his or her behalf. A PIP is any natural or juridical person qualified to act as such under the DPA to whom a personal information controller may outsource the processing of personal data pertaining to a data subject.
Thus, in accordance with the DPA, a bank may allow allowing its duly contracted processor to access and process the PhilSys QR code, provided that (a) a valid lawful basis exists; (b) the processing is necessary and proportionate to the KYC purpose; (c) appropriate contractual, organizational and technical safeguards are in place; (d) data subjects are transparently informed; and (e) PhilSys identifiers are not misused as general database keys in violation of the PhilSys Act.
The NPC further explained that the third-party KYC provider, as PIP, may not need to obtain separate or independent consent from the bank’s customer’s processing pursuant to processing, so long as the processing activities are clearly covered by the bank’s identified lawful bases and privacy notices and remains limited to KYC and identity verification purposes. This is pursuant to NPC Advisory Opinion No. 2018-015 which states that where a PIC enters into an outsourcing arrangement for the processing of personal data, it is not required to obtain a separate consent from the data subjects, as the purpose of the processing and the PIC remain the same. NPC Advisory Opinion No. 2020-018 similarly provides that a PIP processes personal data only on behalf of and under the instructions of the PIC, with no independent authority to determine the purpose of processing.
Ultimately, the allocation of authentication functions related to PhilSys QR codes is a matter or business judgement, subject to compliance with the DPA and its IRR, the PhilSys Act, and other applicable laws and regulations.
The full Advisory may be accessed through this link.
Photo by Shahadat Rahman on Unsplash
Published on
Free to use under the Unsplash License
https://unsplash.com/photos/shallow-focus-photography-of-computer-codes-BfrQnKBulYQ