Content
Most AI content starts with material about real people: staff photos for a brand film, a founder’s voice for a voiceover, customer clips for a testimonial cut, a spokesperson’s face for a digital double. In December 2024 the National Privacy Commission set out how the Data Privacy Act applies once AI is involved. Here is what it means before those files go to a studio.
Does the Data Privacy Act apply to AI-generated content?
When personal data goes in, yes. NPC Advisory No. 2024-04 “applies when the processing of personal data is involved in the development or deployment of AI systems, including its training and testing”. A photo or recording in which someone can be identified is personal information, and using it to generate content is processing it.
The advisory adds no new law. It applies the existing Data Privacy Act: the general privacy principles, the rights of the people in the material, a lawful basis and security, “insofar as AI systems involve the processing of personal data”.
Who is responsible: the brand or the studio?
Both, in different roles. The brand decides why the material is used, which makes it the personal information controller. A studio working on the brand’s behalf is a processor. Section 14 of the Act lets a controller subcontract processing, but the controller stays “responsible for ensuring that proper safeguards are in place”, and the processor “shall comply with all the requirements of this Act”. The advisory says the same for AI: when processing is outsourced, controllers “shall remain accountable for the actions of their PIPs”.
In practice, the consent and the purpose are the brand’s to settle, and the studio has to keep inside them. Our guide to data privacy at brand activations covers the same split for event data.
What does the advisory ask for?
| Principle | What the advisory says | In an AI content project |
| Transparency | Tell people the nature, purpose and extent of the processing, training and testing included | Staff and talent know their face or voice will be used to generate content, for what and for how long |
| Accountability | The controller stays accountable when processing is outsourced | The brief and the contract say what the studio may do with the files |
| Fairness | Processing that is neither manipulative nor unduly oppressive | No generated version of a real person saying or doing what they never agreed to |
| Data minimisation | Leave out, by default, personal data unlikely to improve the work | Send the shots the job needs, not the whole archive |
| Lawful basis | Settle it before processing starts; public data keeps its protection | A face found online is not free to use |
Is a photo found online fair game?
No. The advisory is direct: “Publicly available personal data do not lose the protection afforded by the DPA, its IRR, and the issuances of the Commission simply because it has been made public or is publicly accessible.” A customer’s public post, a creator’s profile photo or a face from an image search still needs a lawful basis before it goes into a model.
For a recognisable person in an ad, that basis is in practice consent, which the Act defines as “freely given, specific, informed” and says “shall be evidenced by written, electronic or recorded means”. If the person is meant to look like someone real, see AI presenters in brand video.
What if someone asks to be taken out?
The advisory expects that to be possible. Controllers need working ways to honour “the right to object, the right to rectification, and the right to erasure or blocking”, before, during and after the work. It adds: “The fact that personal data has been incorporated into data sets does not automatically make the exercise of data subject rights unreasonable.”
For a content project, that means knowing where every file of a person went: the reference folder, any model trained on their likeness, every render and cut-down. A studio that can’t trace the files can’t remove them.
What to settle before you send the files
→ Name the purpose. Which campaign, which formats, for how long. Consent has to be specific, so a line like “for marketing” is thin cover for a digital double reused across campaigns.
→ Get consent the Act recognises. Written, electronic or recorded, from each person whose face or voice is used, staff included.
→ Send less. Personal data that won’t improve the output stays out, as the advisory’s minimisation rule asks.
→ Put the studio’s limits in writing. What it may do with the files, whether a likeness model is trained, where the files are kept and when they are deleted. Our guide to production house contracts covers the rest of the agreement.
→ Plan for a withdrawal. If someone withdraws, you need to know which assets carry them and how they come down.
The file trail
Ask the studio to keep a simple record for each person: which files came in, which tools and models used them, which assets they appear in, and when the source files were deleted. It is what makes an erasure request answerable.
General information from Republic Act No. 10173 and NPC Advisory No. 2024-04 (19 December 2024). It is not legal advice; check current NPC issuances for your case.
What should an AI content studio do with your files?
Treat them as a processor’s, not as raw material. Who touches the files, which models see them, and how a person is removed are questions worth putting to any AI content studio before you sign. PUNX produces AI content in Makati: 50-plus people, founded 2023, working for P&G, San Miguel, Petron and JTI.
FAQ
Does the Data Privacy Act apply to AI-generated ads?
Yes, when personal data is used. NPC Advisory No. 2024-04 applies the Data Privacy Act whenever personal data is processed in developing or deploying AI systems, including training and testing. Photos, voices and footage of identifiable people count.
Can I use a photo of someone that is already public online?
Not without a lawful basis. The NPC’s advisory says publicly available personal data does not lose its protection because it has been made public. For a recognisable person in an ad, that basis is usually consent, evidenced in writing, electronically or by recording.
Who is accountable if the studio misuses the files?
The brand, as personal information controller, stays accountable for its processors, and must ensure proper safeguards are in place. The studio, as processor, must also comply with the Data Privacy Act.
Can a person ask to be removed from AI content?
Yes. The advisory expects controllers to have working mechanisms for the rights to object, to rectification and to erasure or blocking, and says that personal data being in a data set does not automatically make such a request unreasonable.
Related
What to look for in an AI content studio — what to ask before you choose one
Data privacy at brand activations — consent, retention and who holds the list
AI presenters in brand video — when a generated presenter works
Working with real faces or voices?
Send us what you plan to use. We will map the consents and the file trail with you before anything goes into a model.
Start a project ↗