The National Privacy Commission (NPC), through its Privacy Policy Office, has issued two advisory opinions dated 25 August 2026 on how corporations may respond to stockholder requests to inspect records that contain personal data. Advisory Opinion No. 2026-005, requested on behalf of a corporation, addresses compensation records of directors and officers; Advisory Opinion No. 2026-007, requested on behalf of another corporation, addresses records on retirement and other employee benefits, related tax records, and the compensation of its top seven most highly compensated directors or officers. Both advisory opinions confirm that the Data Privacy Act (DPA) does not bar a stockholder's inspection rights under Section 73 of the Revised Corporation Code (RCC), but that disclosure must be proportionate.

Key points

  • The DPA neither bars nor grants inspection. The right to inspect comes from the RCC; the DPA governs how the personal data in the records is processed and disclosed. The DPA applies when corporate records requested to be inspected contain personal data of natural persons.
  • Nature of the data. Compensation and retirement benefit information linked to identifiable directors, officers or beneficiaries is personal information, though not, by that fact alone, sensitive personal information. By contrast, age, marital status and tax returns relating to a natural person, and taxpayer identification numbers (TINs), are sensitive personal information under Section 3(l) of the DPA.
  • Lawful basis. Depending on the nature of the data, the legal bases and requirements for its disclosure vary. Disclosure of personal information must comply with Section 12 of the DPA, which requires that processing of personal information not be prohibited by law and that at least one of the conditions under that provision be met. Where Section 73 of the RCC requires a particular disclosure, sub-paragraph (c), on compliance with a legal obligation, may support it. Sub-paragraph (f), on legitimate interests, may also apply where its requirements are satisfied. In the advisory opinions, the stockholders' stated purposes include assessing the reasonableness of compensation and, in Advisory Opinion No. 2026-007, verifying the accuracy and management of the retirement fund.
  • On the other hand, disclosure of sensitive personal information requires a separate basis under Section 13, which generally prohibits such processing unless at least one of the conditions under that provision is met; a Section 12 basis alone is not enough. Sub-paragraph (b) applies only where an existing law or regulation provides for the particular processing, guarantees the protection of the information and does not require consent. Section 73 of the RCC, which sets out stockholders' inspection rights, may serve as that law, but the corporation must still determine whether the exception applies to the particular records. Note that consent is not necessarily required where another lawful basis applies.
  • Proportionality. When the purpose can be achieved without identifying an individual, corporations should prefer aggregate, company-level information, truly anonymized information, pseudonymized information or redacted information, where these meet the purpose of the request. Pseudonymized data, however, remains personal data subject to the DPA while individuals can still be re-identified. Relevant excerpts of committee or board minutes may be disclosed, with nonresponsive portions and unnecessary personal data redacted.
  • Confidentiality undertakings are not enough by themselves. They do not constitute a lawful basis for disclosure or replace compliance with the general data privacy principles and applicable security requirements. Thus, confidentiality and non-disclosure undertakings should be combined with safeguards such as supervised inspection, limits on copying and access logs, secure handling and appropriate organizational, physical and technical measures, consistent with NPC Circular No. 2023-06.

Additional points in Advisory Opinion No. 2026-007

  • Limit what is shown. Beneficiary identities should be disclosed only where necessary. Even when an identity must be disclosed, only the minimum personal data necessary should be disclosed; unrelated details such as birthdates, addresses, full TINs and bank details should be withheld.
  • Tax records. Certifications, summaries, redacted copies or masked TINs are preferred where they serve the purpose; a full, unredacted tax return should not be released merely because it was requested or because a confidentiality undertaking was signed. Any disclosure must also comply with applicable tax confidentiality rules. Advisory Opinion No. 2026-007 does not decide whether the Tax Code or other tax laws permit or prohibit the disclosure of a particular tax document.
  • Explain limits. The corporation should communicate the basis for any limits it places on disclosure.

Who is affected

Corporations, corporate secretaries and data protection officers handling stockholder inspection requests, and stockholders seeking corporate records that contain personal data.

Practical takeaways

  • Do not refuse inspection on DPA grounds alone; instead, tailor what is disclosed.
  • Start with aggregate, anonymized or redacted data and release identifiable details only where needed for the stated purpose. Treat pseudonymized data as personal data.
  • Pair any confidentiality undertaking with supervised access, copying limits and logs, and document the decision.

Source: NPC Privacy Policy Office, Advisory Opinion Nos. 2026-005 and 2026-007, both dated 25 August 2026.

This alert was prepared by OS Law. This alert is for general information only and is not legal advice. Please consult counsel on how these rules apply to your specific circumstances.