Marketing
An AI tool can split a customer list into a dozen segments and write a different email, SMS or ad for each one in an afternoon. Before it does, the Data Privacy Act decides whether the brand may use that list at all, what customers have to be told, and who answers if it goes wrong.
Is personalised marketing “direct marketing” under the law?
Usually, yes. The Data Privacy Act defines direct marketing as “communication by whatever means of any advertising or marketing material which is directed to particular individuals.” A personalised email, an SMS blast to a CRM list or an ad shown to a matched customer audience is directed to particular people.
The data behind it is personal information when it identifies them: the law covers information “from which the identity of an individual is apparent or can be reasonably and directly ascertained”, including when it is “put together with other information”.
What makes it lawful?
Section 12 allows processing only “when at least one of the following conditions exists”. For marketing, three matter:
| Basis | What the law says | When it fits a campaign |
| Consent | “The data subject has given his or her consent” | Opt-ins collected at sign-up, checkout or an event, for marketing |
| Contract | Processing “necessary and is related to the fulfillment of a contract with the data subject” | Service messages to existing customers, not promotions |
| Legitimate interests | Processing “necessary for the purposes of the legitimate interests pursued by the personal information controller”, unless “overridden by fundamental rights and freedoms of the data subject” | Some marketing to existing customers, weighed case by case |
Consent has to be real: “any freely given, specific, informed indication of will”, and it “shall be evidenced by written, electronic or recorded means.” A pre-ticked box at checkout is hard to defend as either.
What do customers have to be told?
Section 16 gives them the right to be told, before their data enters the system or at the next practical opportunity, the “Purposes for which they are being or are to be processed”, the “Scope and method of the personal information processing”, the recipients, “The identity and contact details of the personal information controller”, how long it will be kept and their rights. If an AI tool is part of the method, the privacy notice should say so in plain words.
How much data should go into the AI tool?
Less than you think. The law’s principles are “transparency, legitimate purpose and proportionality”, and personal information must be “Adequate and not excessive in relation to the purposes for which they are collected and processed” and “Retained only for as long as necessary”. A segmentation that needs city, last purchase and opt-in status doesn’t need birthdays, ID numbers or full purchase histories uploaded to a third-party tool.
Where the AI makes decisions rather than copy, the NPC’s advisory on AI adds a safeguard: for automated decisions that pose “a significant risk to the rights and freedoms of data subjects”, organisations “shall implement mechanisms to allow for meaningful human intervention”. Personalised pricing or eligibility rules belong in that bracket; a subject line doesn’t.
Who answers for it?
The brand. The law’s personal information controller includes “a person or organization who instructs another person or organization to collect, hold, process, use, transfer or disclose personal information on his or her behalf”. Hiring an agency or an AI vendor doesn’t move the responsibility. Processing without consent or another legal basis can mean “imprisonment ranging from one (1) year to three (3) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than Two million pesos (Php2,000,000.00)”.
What to settle before the campaign runs
→ Map the data. Which list, where it came from, and what the people on it agreed to.
→ Pick the basis for each use. Consent for promotions; contract only for service messages.
→ Update the privacy notice. Purposes, method (including AI), recipients, retention and rights, before the data goes in.
→ Send the minimum. Only the fields the segmentation needs go into the AI tool.
→ Put the vendor on paper. A data sharing or outsourcing agreement with the agency and the AI tool, with security and deletion terms.
→ Keep opt-outs working. Every message carries a way out, and an opt-out stops every channel.
The field test
For each field in the upload, ask: would the campaign fail without it? If not, leave it out of the AI tool.
General information from Republic Act No. 10173 (2012) and the NPC’s advisory on AI systems. NPC circulars and the implementing rules add detail; check with your data protection officer.
Who should run it?
An agency that asks for the data basis before the brief. PUNX is an AI marketing agency in Makati: 50-plus people, founded 2023, producing for P&G, San Miguel, Petron, GCash and Sun Life. Our guide to personal data in AI content covers the creative side of the same law.
FAQ
Is personalised email or SMS marketing covered by the Data Privacy Act?
Yes. The Act defines direct marketing as communication of advertising or marketing material directed to particular individuals, and the customer data used for it is personal information when it identifies them.
Do you need consent for AI-personalised marketing in the Philippines?
Processing needs at least one lawful basis under Section 12. For promotions, consent is the usual basis; it must be freely given, specific and informed, and evidenced by written, electronic or recorded means.
Is the brand or the agency responsible for customer data in a campaign?
The brand. Under the Act, the personal information controller includes anyone who instructs another person or organization to process personal information on its behalf.
What is the penalty for using customer data without consent?
Unauthorized processing of personal information can mean imprisonment of one to three years and a fine of P500,000 to P2,000,000.
Related
Personal data in AI content — consent, the file trail and the NPC’s AI advisory
Data privacy at activations — entry forms and consent
AI disclosure in ads — when an ad has to say it was made with AI
Planning an AI-driven campaign?
Send us the brief and the data you plan to use. We will map what the campaign needs and leave out the rest.
Start a project ↗