In brief
The National Privacy Commission (NPC) has issued NPC Advisory No. 2026‑01 (“Advisory”), clarifying that the scraping of publicly available personal data remains fully subject to the Data Privacy Act of 2012 (DPA). The Advisory expressly rejects the view that public availability equates to consent and confirms that data scraping, particularly when automated, large‑scale, or commercially driven, is a regulated form of personal data processing.
This development is relevant to organizations that collect, use, purchase, or host publicly available personal data, including for analytics, artificial intelligence, marketing, profiling, and/or platform operations. The Advisory signals heightened regulatory scrutiny and expands compliance expectations not only for entities that scrape data, but also for those that make personal data publicly accessible through websites, applications, or online platforms.
Key points for businesses include:
- Publicly available personal data is not exempt from the DPA.
- Data scraping must be supported by a valid lawful basis; public availability does not constitute consent.
- Privacy Impact Assessments (PIAs) are required for data scraping activities, including those conducted by third‑party processors.
- Large‑scale scraping, profiling, and data aggregation face increased regulatory scrutiny.
- Entities hosting public‑facing personal data have enhanced transparency and security obligations.
Unauthorized or non‑compliant data scraping may expose organizations to administrative, civil, and criminal liability under the DPA and related NPC issuances.
For a detailed analysis of NPC Advisory No. 2026-01 and its implications, read the full alert on quisumbingtorres.com or through the link below.
*****
Hannah Athena Victa, Associate, has contributed to this legal update.
© 2026 Quisumbing Torres. All rights reserved. Quisumbing Torres is a member firm of Baker & McKenzie International, a Swiss Verein. This may qualify as “Attorney Advertising” requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome.