Data Privacy Act Compliance for Construction Firms and Real Estate Developers in the Philippines

Construction firms and property developers rarely think of themselves as data-heavy businesses. In practice they are among the most exposed organisations in the Philippines under the Data Privacy Act of 2012, because a single company simultaneously holds buyer and homeowner files, a large site workforce, and personnel records supplied by subcontractors and manpower agencies — three separate populations, each with its own lawful basis, retention period and risk profile.

This page sets out how the Act and the issuances of the National Privacy Commission apply specifically to construction and real estate development, where enforcement and commercial risk actually arise in this sector, and what a defensible compliance programme looks like. For the underlying legal requirements that apply to every industry, see our guide to Data Privacy Act and NPC compliance requirements.

What personal data a developer or contractor actually holds

The first exercise in any engagement is a data inventory, and in this sector it almost always surfaces more than management expected. A typical mid-sized developer holds the following:

Data population	What you typically hold	Where exposure usually sits
Buyers, reservation applicants and homeowners	Names, contact details, government IDs, TIN, marital and family details, proof of income, bank and Pag-IBIG/HDMF submissions, loan documents	Largely sensitive personal information; volumes cross the 1,000-record registration threshold quickly; retained long after turnover with no schedule
Site and project workers	Employment records, government identifiers, medical clearances, safety training records, biometric attendance	Sensitive personal information held across multiple sites, often in local spreadsheets outside any central control
Subcontractor and agency personnel	Worker lists, IDs, clearances supplied by manpower agencies and subcontractors	Received without a documented basis or outsourcing terms; unclear who controls and who processes
Brokers, agents and marketing	Leads, enquiry lists, purchased or shared contact databases, SMS and email campaigns	Consent validity is weak or absent; bundled consent and unsolicited marketing are direct exposure under NPC Circular 2023-04
Site security and access	CCTV footage, visitor logs, biometric access records, vehicle and delivery records	Governed by NPC Circular 2024-02; notices, retention limits and disclosure protocols are usually missing
Joint ventures and landowners	Landowner and joint-venture partner details, title and financial documentation	Shared between entities with no data sharing agreement and no defined lawful basis

Two conclusions usually follow from that inventory. First, the volume of sensitive personal information is far higher than assumed, because government identifiers, financial documents and medical clearances all fall into that category. Second, the data is distributed — head office sales, site HR, security contractors, brokers and finance each hold copies, frequently in personal drives and messaging apps.

Why registration with the Commission is usually mandatory

Under NPC Circular 2022-04, registration of data processing systems and the Data Protection Officer is required where an organisation employs 250 or more people, or processes sensitive personal information of at least 1,000 individuals, or carries out processing likely to pose risks to data subjects, or where processing is not occasional.

A developer with one active selling project routinely passes the 1,000-record threshold on buyer files alone. A contractor with several concurrent sites frequently passes the 250-employee threshold once project-based personnel are counted. Registration is valid for one year and must be renewed, and organisations that registered once during a tender requirement and never renewed are, in practice, unregistered.

It is worth stating the corollary plainly: if you fall below the thresholds, you are exempt from registration only. Every other obligation under the Act — designating a DPO, honouring data subject rights, securing personal data and reporting qualifying breaches — continues to apply.

Six exposures specific to this sector

1. Broker and agent networks

Selling through brokers, in-house agents and accredited sales teams distributes buyer data across parties you do not directly employ. If you determine why and how that data is processed, you remain the controller and remain accountable. Documented instructions, outsourcing terms and, where appropriate, data sharing agreements under NPC Circular 2020-03 are the evidence that you exercised that accountability.

2. Marketing lists and unsolicited contact

Purchased lists, shared databases and mass SMS or email campaigns are common in property marketing and are among the most visible practices to data subjects — and therefore the most likely to generate complaints. NPC Circular 2023-04 requires consent to be freely given, specific, informed and evidenced, and prohibits bundled consent; NPC Advisory 2023-01 addresses deceptive design patterns in how consent is obtained.

3. Photocopied identification documents

Collecting and retaining copies of government IDs is near-universal in reservation and turnover processes. NPC Circular 2023-03 addresses the processing of identification cards, and the questions to answer are whether copying is necessary at all, whether a lawful basis exists, how long copies are kept, and who can access them.

4. Retention after turnover

Buyer files routinely remain live in shared drives years after unit turnover, complete with financial documents and IDs. Retention must be tied to a defined purpose and to other legal obligations, documented in a schedule, and actually enforced through disposal. An unenforced retention policy is a finding, not a control.

5. Site biometrics and CCTV

Biometric attendance data is sensitive personal information and requires a valid lawful basis and a privacy impact assessment. Site CCTV falls under NPC Circular 2024-02, which addresses notices and signage, retention limits, and protocols for access and disclosure — including requests from law enforcement and insurers after site incidents.

6. Manpower agencies, subcontractors and joint ventures

Worker data received from agencies, and landowner or partner data exchanged in joint-venture structures, move between entities with no documented basis in most firms we assess. Each relationship needs its controller and processor roles defined, in writing, before an incident forces the question.

What good looks like

A defensible programme in this sector has seven components: a maintained data inventory covering head office, sites, brokers and agencies; documented lawful bases for each processing activity; privacy impact assessments for the sales system, HR and payroll, biometric attendance and CCTV; a privacy manual with notices and consent forms that match actual practice; an enforced retention and disposal schedule; NPC registration with a renewal calendar; and a rehearsed breach response capable of meeting the 72-hour notification window under NPC Circular 16-03.

The commercial return is not only avoided penalties. Principals, financiers, joint-venture partners and government procuring entities increasingly require privacy documentation during due diligence, and firms that can produce it in days rather than weeks shorten their own sales cycle.

How Sterling delivers it

We work in three phases so you control commitment at each boundary. Design establishes your true position: gap assessment against the Act and current NPC issuances, data inventory across head office and project sites, privacy impact assessments and a prioritised roadmap. Drive implements: privacy manual and policies, buyer and employee notices, consent forms, broker and agency terms, retention schedule, security controls, NPC registration, breach playbook and training for sales, HR, site and security teams. Sustain keeps it alive through internal audits, annual renewal and the Annual Security Incident Report.

Where you have no in-house capacity, our managed DPO service provides the designated officer on retainer. Where clients or principals demand third-party assurance, the same control base supports ISO/IEC 27001 certification. Delivery is by Philippine-based consultants attending your office and sites. See also our ISO certification services for construction and contracting companies.

To be clear on one point: we are compliance consultants and implementers, not a law firm, and we work alongside your counsel.

Start with a scoping call

Tell us your headcount including site personnel, the approximate number of buyer records you hold, and whether you are currently registered with the Commission — that is usually enough to indicate scope. We will follow with a fixed-fee proposal covering deliverables, timeline and professional fees. Call +63 9778151204, email info@iso-certification.ph, or contact our Manila team.

Frequently asked questions

Does the Data Privacy Act really apply to a construction company?

Yes. The Act applies to any organisation processing personal data in the Philippines, regardless of industry. Construction and development firms are in fact among the more exposed sectors because they combine three high-risk data populations in one business: buyers and reservation applicants, site and project workers, and subcontractor or agency personnel — each with different lawful bases and retention needs.

Are we required to register with the National Privacy Commission?

Almost certainly. Under NPC Circular 2022-04 registration is mandatory where an organisation employs 250 or more people or holds sensitive personal information of at least 1,000 individuals. A developer with an active selling project and a site workforce typically crosses both. Registration is valid for one year and must be renewed.

We are a contractor, not a developer, and we do not sell to the public. Are we lower risk?

Lower on buyer data, not overall. Contractors still process extensive employee and worker records, often including government identifiers, medical clearances and biometric attendance data, plus subcontractor and manpower agency personnel. Sensitive personal information thresholds are frequently met through the workforce alone.

Our brokers and agents collect the buyer information, not us. Are they responsible?

Generally not in the way firms hope. If you determine why and how the data is processed, you remain the personal information controller and carry accountability for what your brokers and agencies do with it. Broker and agency arrangements need documented instructions and outsourcing terms — and NPC Circular 2020-03 data sharing agreements are strongly encouraged as evidence of accountability.

How long may we keep buyer documents after turnover?

There is no single statutory period under the Act. Retention must be tied to a defined purpose and to other legal obligations such as tax, HLURB/DHSUD and contractual record-keeping, then documented in a retention schedule and actually enforced. Indefinite retention of ID copies and financial documents after a transaction closes is one of the most common findings we raise in this sector.

We use biometric attendance and CCTV on site. What does that require?

Biometric data is sensitive personal information, requiring a valid lawful basis, a privacy impact assessment and proportionate safeguards. CCTV is governed by NPC Circular 2024-02, which sets expectations for notices and signage, retention limits, and access and disclosure protocols. Both are routinely deployed on Philippine sites without either step.

What triggers most enquiries like ours?

In our experience: a client, principal or joint-venture partner requiring privacy documentation during due diligence; a financing or tender condition; an internal or group audit finding; or a complaint reaching the Commission. The trigger matters, because it determines sequencing and how quickly you need defensible evidence rather than a completed programme.

How long does compliance take for a firm of our size?

A gap assessment and data inventory typically takes three to five weeks. Full implementation — policies, notices, PIAs, registration, controls, breach readiness and training — typically runs eight to fourteen weeks, extending where there are multiple project sites or a large buyer database. Ongoing obligations such as renewal, audits and annual reporting continue thereafter.

Sterling International Consulting provides compliance consulting, implementation, training and assessment-readiness services. We are not a law firm and nothing on this page constitutes legal advice. Regulatory references are current as of August 2026.