Philippines NPC registration + Thailand PDPA fines: what SEA teams must do

Two live enforcement points: annual NPC registration in the Philippines, and real PDPC fines in Thailand.

What you need to know

• Philippines: register your DPO and data processing systems with the NPC; renew yearly, 30 days before expiry (Circular 2022-04).
• Philippines: Advisory 2024-04 says DPA duties apply to AI training and use; keep documentation.
• Thailand: in Aug 2025 the PDPC announced 8 fines in 5 cases (weak security, late breach reports, processor oversight, missing DPO).
• Thailand: a draft AI law was consulted on by ETDA in 2025 - not yet law.

First step: list your AI systems and the data they use

Every one of these laws is easier with a written inventory. Our free AI register template gives you one in minutes.

Get the free register

Free edition. Paid plans are optional. Built originally for the EU AI Act; the Southeast Asia mapping is in this guide, not yet inside the app.

Official sources

• https://privacy.gov.ph/wp-content/uploads/2023/05/Circular-2022-04.pdf
• https://privacy.gov.ph/pips-and-pics/faqs/
• https://www.nagashima.com/en/publications/publication20250822-1/
• https://www.lexology.com/library/detail.aspx?g=426d4c6b-818d-407e-af2d-2c02278c002b

Checked 13 Oct 2026. General information, not legal advice. Team Unadhi.