Website Privacy Notice in the Philippines, Starting at the Form

Every form on a Philippine website which asks for a name, an email address or a mobile number is collecting personal information under the Data Privacy Act of 2012, so each form needs a privacy notice, and I think the part which is mostly missing is the short notice at the form itself. The National Privacy Commission’s Guidelines on Consent make a short notice at the moment someone types, with a link to the full notice, the default format, and a link in the footer only covers the second half of that.

I design and build websites, so what follows is how I would set up the forms and the notice, and I would still have the final wording checked by your data protection officer or a privacy lawyer.

What a privacy notice has to say

Section 16 of the Act lists what a person should be told before their details enter your system, or at the next practical opportunity, and the list reads more simply when it’s applied to one form. For a contact form on a clinic or company website, the eight items could look like this.

The row which I would think about longest is who else receives it, because a form mostly passes through more hands than its owner remembers, such as the email service which delivers it, the host of the website, a spam check which runs on another company’s servers and any spreadsheet or CRM which the messages are copied into. Section 21 of the Act keeps you accountable for information which you pass to others for processing, in the Philippines or abroad, so each of those services belongs in the notice.

A notice and a policy are two different things

The Guidelines on Consent separate words which websites mostly use as if they meant the same thing, since a privacy policy is the internal manual which guides your own staff, a privacy notice covers one specific activity, such as your contact form, and a consent form carries everything which a notice says and asks the person to agree to it. So the page which your visitors read is really your privacy notice, which is also what the NPC calls the page on its own website, and the guidelines say that a privacy notice is needed for any processing, whatever its legal basis, so a form which never asks for consent still needs one.

The short notice belongs at the form

The guidelines make just-in-time and layered notices the default format, where a just-in-time notice explains how someone’s details will be used at the point when you are about to collect them, and a layered notice gives the key facts first and links to the rest. At the minimum those key facts name who you are, who your data protection officer is and briefly what happens to the details, so on a website the short notice is mostly two lines under the form’s button, with a link to the full notice.

I would write those two lines in the same plain words as the rest of the page, because the guidelines ask for clear and plain language, in a language or dialect which an average member of your audience understands, and they name vague wording, jargon and double negatives as the things to avoid.

When a form needs a consent box

I think a contact form can mostly do without a box to tick, since Section 12 of the Act allows processing which is needed to take steps at a person’s request before a contract, which I believe covers replying to someone who asked you for a quote or an appointment. The guidelines also say that when another lawful basis applies, a request for consent is unnecessary, and asking anyway adds to consent fatigue, which is what they call people no longer reading the questions at all.

The box belongs to anything extra, so if the same form offers your newsletter, that purpose needs its own box, left unticked, because the guidelines say that consent for something which the service doesn’t need should not be bundled with the service, and that consent can never be assumed. The NPC’s advisory on deceptive design patterns goes further and names defaults which favour the business, and a choice which is easy to make and hard to take back, so I would make leaving the newsletter as easy as joining it, which the guidelines ask for as well.

Health, school and ID details need more care

The Act treats some details as sensitive personal information, including anything about a person’s health or education and the numbers which government agencies issue to them, and Section 13 allows processing them only in a short list of cases. That matters most on a clinic’s appointment form and a school’s enquiry form, so I would ask only what the booking needs, such as a name, a mobile number, the branch and the treatment from a short list, and keep the medical history for the consultation, which is also what the Act means by personal information being adequate and not excessive for its purpose. I wrote more about that booking form in a dental clinic website in the Philippines, from the book button to the chair.

How I handled consent on goodport

goodport, the B2B ordering platform which I designed for distributors in the Philippines, needed consent where there was no form to put a box on, because every buyer is invited by their distributor instead of signing up. So consent became a screen which a buyer sees once, after they first sign in with a one-time code, and the platform records which version of the notice they agreed to and when, so a new version of the notice shows the screen again.

The notice says that the distributor is the personal information controller for its buyers’ details and goodport the processor which handles them on its behalf, and that buyer details are kept while the buyer and the distributor work together and for twelve months after. I wrote it in plain English with a short Taglish summary at the top, because the people reading it are buyers and staff here, which is what the guidelines mean by a language which the audience understands.

Where to start

I would open every form on your website, including the ones in pop-ups and on landing pages, and write down what each one collects, where the messages go and how long they stay there, since those three answers are most of the notice. Then I would add the two lines under each form, check that every box starts unticked, and join your own newsletter and leave it again, to see that leaving takes as few steps as joining. If you are planning a new website, the notice is copy like any other, so it’s worth writing with the rest of the words, as I explain in why website copy should come before the design.

Frequently asked questions

Does a small business website need a privacy notice in the Philippines?

Yes, if any form on it collects personal information, such as a name, an email address or a mobile number, because the NPC’s Guidelines on Consent say a privacy notice is needed for any processing. If the website also uses analytics or advertising cookies, I would describe those in the notice as well.

Is a privacy policy the same as a privacy notice?

The NPC uses the two words for different things, since a privacy policy is the internal manual which guides your staff, and a privacy notice tells the people who use your website what happens to their details, so the notice is the page which your visitors need.

Can I use a privacy notice template?

A template is a fair place to start, as long as every line is then rewritten to describe your own forms, tools and retention period, because the guidelines ask for information which is concrete and definite, and they treat vague or overbroad wording as a failure of transparency.

Where should the privacy notice go on a website?

The full notice mostly sits on its own page, linked from the footer of every page, and a short version sits at every form, next to the button which sends it, with a link to the full page. I would check both with the rest of the forms before launch, which is one of the items in my website redesign checklist.