Philippine Data Privacy Act for Chatbots: Collecting Leads in Messenger the Right Way

A Messenger chatbot is one of the fastest ways for a Philippine business to collect leads. It asks for a name, a mobile number, a delivery address, sometimes a budget or a date. Every one of those answers is personal information under the Data Privacy Act of 2012, and the business that runs the chatbot is responsible for how it is collected, used, stored and deleted.

This guide is for business owners, marketers and agencies in the Philippines who run chatbots on Messenger, Instagram, a website or WhatsApp. You will get the three principles that matter most in a chat, when you need consent and when you do not, a copy-ready consent message, what never to ask in a chatbot, how to handle requests to delete data, the 72-hour breach rule, and a compliance checklist you can use before launch.

1. Why chatbot leads are covered

The Data Privacy Act of 2012 (Republic Act No. 10173) applies to the processing of personal information: any information from which a person's identity is apparent or can reasonably be determined. A name with a mobile number qualifies. So does a Messenger profile linked to a delivery address. Collecting, recording, storing, using, sharing and deleting are all processing.

So why does this matter for a chatbot in particular? Because a chatbot collects at scale and without a person in the loop. A sales agent who asks one customer an unnecessary question makes one mistake. A chatbot flow that asks every visitor for a birthday, a full address and a photo of an ID repeats that mistake thousands of times, and stores the answers in a platform you may not fully control.

The National Privacy Commission (NPC) enforces the law. Its Implementing Rules and Regulations, as amended, set the details used throughout this guide.

2. Three principles in a chat

The law rests on three general principles. Each one turns into a concrete design rule for a chatbot.

The rules define proportionality as processing that is “adequate, relevant, suitable, necessary, and not excessive” for a declared purpose. In chatbot terms: every question in your flow should have a reason you could explain to the customer in one sentence.

3. Consent or another lawful basis

Consent is not the only lawful basis for processing ordinary personal information. The rules list several, including consent, processing needed to fulfil an agreement with the customer, compliance with a legal obligation, and the legitimate interests of the business, unless the customer's fundamental rights override them.

For a chatbot, two bases cover almost everything:

When you do rely on consent, it must be “freely given, specific, informed” and evidenced by written, electronic or recorded means. A logged button tap in a chat, with the notice the person saw, is an electronic record. A pre-ticked box, or consent buried in a long welcome message, is weak evidence.

4. A consent message that works

A privacy notice in a chat has to be short, or nobody reads it. Put the essentials in the message and link the full privacy policy on your website. Separate consent for marketing from the request the person actually made.

MESSAGE 1 (before the first personal question)
Hi! Before I take your details: [Business name] uses your name, mobile
number and [address] only to [send your quote / deliver your order].
We keep it for [period] and never sell it.
Full privacy notice: [link]

[ Continue ]   [ Talk to a person ]

MESSAGE 2 (separate, after the request is handled)
Want to hear about promos and new arrivals here in Messenger?
You can stop anytime by typing STOP.

[ Yes, send me promos ]   [ No thanks ]

LOG FOR EACH CONTACT
- Notice version shown + date and time
- Button tapped (Continue / Yes / No)
- Tag: consent_marketing = yes / no

Notice the design choice in step four: saying no to promotions never blocks the quote or the order. Bundling marketing consent with the service the person asked for undermines the “freely given” part of consent.

5. What never to ask in a chatbot

The law treats some data as sensitive personal information, with stricter rules for processing. It includes information about a person's health, ethnic origin, religious or political affiliation, and government-issued identifiers such as SSS or TIN numbers, among others.

This matters most for clinics, med spas, insurance, lending and recruitment. The clinic and med spa automation guide shows how to automate bookings and reminders without collecting medical details in the chat. For AI agents, add a guardrail that stops the agent from asking for or repeating sensitive data; the method is in guardrails for business chatbots.

6. Rights, breaches and registration

Data subject rights. The rules list the right to be informed, to object, to access, to rectification, to erasure or blocking, and to damages. In a chatbot, the most common request is some version of “Delete my details” or “Stop messaging me”. Build for it before launch:

1. Recognise the request: “stop”, “unsubscribe”, “delete my data”, “remove me”.
2. Stop marketing at once and tag the contact.
3. Route deletion or access requests to a named person, with a target response time.
4. Delete or block the data in the chatbot platform and in every connected sheet or CRM.
5. Confirm to the person what was done.

The 72-hour breach rule. The personal information controller must notify the NPC and affected data subjects within 72 hours of knowing, or reasonably believing, that a personal data breach requiring notification has occurred. A leaked lead sheet or a compromised chatbot account can trigger it. Decide in advance who investigates and who notifies.

Registration with the NPC. Under NPC Circular 2022-04, a business must register its data processing systems if it employs 250 or more persons, processes the sensitive personal information of at least 1,000 individuals, or processes data likely to pose a risk to people's rights and freedoms. Systems that involve automated decision-making or profiling must be registered in all instances. If your chatbot scores or segments leads automatically, ask your data protection officer whether it counts.

7. Your chatbot platform is a processor

When you run a chatbot on a platform, the platform processes personal data on your behalf. Under the law you remain the controller and stay responsible for that data, including what the platform, your agency and any connected tool does with it. Three practical steps:

• Know where the data goes. List every place a lead lands: the chatbot platform, the inbox, a Google Sheet, the CRM, an email tool.
• Have a written outsourcing or data processing agreement with the platform and any agency that touches the data, and read the platform's own data processing terms.
• Limit access. Remove former staff and freelancers from the page, the chatbot and every sheet. Use roles instead of shared logins.

The same discipline improves lead quality. A clean, minimal flow, like the one in how to qualify leads in Messenger automatically, asks fewer questions and gets more complete answers.

8. Pre-launch checklist

Run this before a chatbot goes live, and again whenever you add a field, a channel or a connected tool. Treat any “no” as a launch blocker.

Track one number after launch: the share of contacts with a logged consent choice. It should be close to 100% of everyone who reached the opt-in step. If it is not, the flow or the logging is broken.

An honest limitation: I am not a lawyer, and this guide is a practical starting point, not legal advice. NPC circulars and advisories change, and your industry may carry extra rules. Have your data protection officer or counsel review your notice, your agreements and your retention periods.

Frequently asked questions

Does the Data Privacy Act apply to small businesses with a Messenger chatbot?

Yes. The law applies to processing personal information, whatever the size of the business. Size affects whether you must register your systems with the NPC, not whether the law applies.

Do I need consent for every chatbot conversation?

Not always. When a customer asks for a quote or places an order, processing their details to deliver that request has its own lawful basis. Marketing messages, sharing with partners and sensitive information need consent or stricter grounds.

Is a button tap in Messenger valid consent?

Consent must be freely given, specific and informed, and evidenced by written, electronic or recorded means. A logged tap on a clear, separate opt-in button, with the notice the person saw, is an electronic record of that choice.

How fast must I report a data breach in the Philippines?

Within 72 hours of knowing, or reasonably believing, that a personal data breach requiring notification has occurred, to both the National Privacy Commission and the affected data subjects.

References

1. Implementing Rules and Regulations of the Data Privacy Act of 2012, as amended, National Privacy Commission (definitions of consent and proportionality, lawful criteria, rights, 72-hour breach notification). Accessed October 2026.
2. NPC Circular No. 2022-04: Registration of Personal Data Processing Systems and Data Protection Officers, December 5, 2022. Accessed October 2026.
3. Digest PH: Data Privacy Act of 2012 (Republic Act No. 10173) summary. Accessed October 2026.

Keep reading

• How to Stop an AI Agent From Making Things Up: Guardrails for Business Chatbots
• How to Qualify Leads in Messenger Automatically (Without Annoying Your Customers)
• Why Your Business Is Losing Customers in Facebook Messenger (and How to Fix It)
• See all posts on the blog