Running Market Research Under the Philippine Data Privacy Act: Consent, NPC Rules, and Practical Safeguards

A practical way to keep research lawful is to tie each activity to the privacy principles emphasized in NPC Circular No. 2023-04 on consent: transparency, legitimate purpose, proportionality, and fairness. Transparency means telling respondents the nature, purpose, and scope of processing, the PIC’s identity, relevant risks and safeguards, their rights, and how to exercise them. Legitimate purpose means being specific and clear in advance, and not acting contrary to law, morals, good customs, public order, or public policy. Proportionality means collecting only what is adequate, relevant, suitable, and strictly necessary. Fairness means avoiding manipulation or undue pressure. In research terms, that translates into shorter screeners, purpose-matched questionnaires, and clear separation between research and marketing contact.

Consent and NPC Rules: Where Research Often Gets Risky

Consent is not always required for every processing activity, but several sources note it is often the most appropriate basis when people directly participate. Legal commentary focused on marketing research highlights consent as especially appropriate for direct respondent participation, focus groups, recordings, sensitive data, minors, and research that may lead to marketing contact. NPC Circular No. 2023-04 focuses on processing that relies on consent and sets criteria for valid consent, anchored in the principles above. Operationally, treat consent as a managed asset: document what participants agreed to, keep consent language aligned with actual procedures, and provide an easy path to exercise data subject rights. Also plan what happens if consent is withdrawn: processing already lawfully conducted before withdrawal does not necessarily become invalid, but further processing based on that consent should stop unless another lawful basis applies.

Modern market research can raise risk even when it feels “non-personal,” especially when it uses analytics, segmentation, machine learning, lookalike modeling, sentiment analysis, behavioral scoring, or customer profiling. The more sensitive the data, the stronger the safeguards you should apply. Extra caution is advised for research involving minors, including avoiding manipulative practices, excessive profiling, unnecessary collection of sensitive data, and direct marketing disguised as research. Consider heightened safeguards such as parental notice, restricted retention, and strict vendor controls where research touches children’s preferences, behavior, media use, education, food, gaming, toys, health, or online activity. From a brand standpoint, one marketing-oriented source reports that 97.5% of respondents say they will promote brands that safeguard their apps, with 56.4% ready to leave positive app store reviews or social media endorsements—making good privacy practice relevant to trust, not just compliance.

Finally, treat “publicly available” data with care. NPC Advisory No. 2026-01 addresses data scraping and emphasizes that scraping publicly available personal data remains subject to RA 10173. It also requires PICs to conduct Privacy Impact Assessments (PIAs) for data scraping activities and to maintain documented policies and practices governing such scraping, including documentation of PIAs conducted in relation to those activities. The same advisory direction includes disclosure in privacy notices when personal data are obtained from publicly available sources, including the source and the purpose of the processing. For practical safeguards, combine documented PIAs, clear privacy notices, tight collection limits, and vendor controls so your research methods stay aligned with the DPA, its IRR, and NPC issuances.