Philippine outreach rules
Is cold email legal in the Philippines? There is no spam law, and that is not the good news it sounds like.
No Spam Act, no Spam Control Act, no CASL. Teams read that absence as permission and stop reading. What actually governs commercial email here is the Data Privacy Act 2012, which has no carve-out for business contact details and is the only law in this cluster that can put someone in prison.
General information, not legal advice. Checked against Republic Act 10173 and its Implementing Rules on 29 September 2026.
The absence people misread
There is no Philippine anti-spam statute
Not a weaker one. Not one with a business exemption. None. The Senate's own legislative reference for the subject lists bills, not law.
| The instrument | Status |
|---|---|
| Senate Bill No. 2460, Anti-Spam Act of 2021, 18th Congress | Filed December 2021. A bill, not an enacted Republic Act |
| Senate Bill No. 366, Anti-Spam Act of 2022, 19th Congress | Filed December 2022. A bill, not an enacted Republic Act |
So there is no label to add, no unsubscribe deadline set by a spam statute, and no regulator issuing infringement notices for unsolicited email. If you have arrived here from the Australian rules or the Singaporean ones, none of that machinery exists.
What replaces it is privacy law, and privacy law asks a harder question. A spam statute asks what your message looks like. The Data Privacy Act asks what right you had to hold this person's details at all.
What you actually need
A lawful basis, before the first email
Section 12 of the Act sets the criteria for lawfully processing personal information. Any one of them will do, and for cold outreach only two are realistic.
| The basis | What it means for outbound |
|---|---|
| Consent of the data subject | Given before collection, or as soon as practicable after. Clean when you have it, and by definition you do not have it from someone who has never heard of you |
| Legitimate interests | The usual route. Processing necessary for the legitimate interests of the controller or a third party, except where overridden by the fundamental rights and freedoms of the data subject |
The legitimate interests wording carries its own limit in the same sentence, and the limit is the part that does the work. It is a balancing test: your interest in selling against their rights, with the Constitution named as the standard. It is not a status you elect. It is an assessment you perform, and if challenged, one you have to be able to produce.
If that shape feels familiar it is because the UK asks something very similar, and UK guidance on the balancing test is a reasonable model for how carefully to do it. The UK rules are at is cold email legal in the UK.
The exclusion that is not there
A private-sector work address is ordinary personal information
This is the assumption that breaks first, because two of the markets next door do have a carve-out and people carry it over.
Section 4 of the Act excludes information about an individual who is or was an officer or employee of a government institution that relates to their position or functions. Read the qualifier. It is about government institutions. There is no equivalent exclusion for someone's role at a private company.
Compare Singapore, where business contact information sits outside most of the PDPA obligations, and the working assumption for B2B senders is that a work address is a lighter-touch category. Bring that assumption to the Philippines and you have skipped the question the Act is actually asking.
The obligation a bought list walks into
People have to be informed before their details enter your system
Not before you email them. Before the information enters the processing system, which for most teams is the moment of import.
- A description of the personal information going into the system
- The purposes it is being processed for
- The scope and method of the processing
- The recipients, or classes of recipients, it may be disclosed to
- And under the Implementing Rules, where the processing is for direct marketing or profiling, the notice says so
The Implementing Rules also define direct marketing and give the data subject a right to object to processing for it. So the pattern is: tell them at the point their details enter the system, say if it is for marketing, and stop when they object. New Zealand arrived at a comparable obligation from a different direction in May 2026, which is set out in the New Zealand page.
Why this market is different
The penalties are criminal
Every other market in this cluster ends in money. Australia has infringement notices, Canada has administrative monetary penalties, Singapore has a private suit. The Philippines has prison terms.
| What was processed | Imprisonment and fine |
|---|---|
| Personal information, without consent or another lawful basis | One to three years, and a fine of PHP500,000 to PHP2,000,000 |
| Sensitive personal information | Three to six years, and a fine of PHP500,000 to PHP4,000,000 |
| Processing affecting at least 100 data subjects | The maximum penalties apply |
The hundred-data-subject line is worth sitting with, because a hundred records is not a large campaign. It is one afternoon's list building. The threshold that turns a penalty into a maximum penalty sits below the size of an ordinary sequence.
Before you send into the Philippines
A checklist you can work through
Written for a team arriving from a market with a spam statute, because the absence of one here is the thing that misleads.
- Stop looking for the spam rules. There are none. The question is your lawful basis for holding the data.
- Write down the legitimate interests assessment before the campaign, not after a complaint. Your interest, their rights, why yours is not overridden.
- Do not carry over a business contact carve-out from Singapore or anywhere else. A private-sector work address here is personal information.
- Handle the right to be informed at import, because that is when the details enter the processing system, and say plainly if the purpose is direct marketing.
- Build a way to record and honour an objection to direct marketing, since the right to object is explicit.
- Keep the provenance of every record. A lawful basis you cannot evidence is a lawful basis you do not have.
- Count your list. At a hundred data subjects the maximum penalties come into range.
Where software helps, and where it does not
What Empiraa Signal does about this
Signal sends from your own inbox, stops a sequence the moment somebody replies, adds and hosts the unsubscribe, and records where each company entered your workspace, which is the beginning of the provenance record this market asks you for.
What it does not do. Signal does not perform your legitimate interests assessment, does not issue the notice the right to be informed requires, and does not decide whether your interest is overridden by somebody's rights. Those are judgements about your business and your list. Any vendor claiming their software makes you compliant with the Data Privacy Act is selling you something, and in a market with custodial penalties that is a worse trade than usual.
The rest of the cluster: Australia, the UK, Singapore, Canada, and the side-by-side comparison.
Questions people actually ask
Philippine cold email, answered
Is cold email legal in the Philippines?
Yes, and it is governed by privacy law rather than by spam law. There is no Philippine anti-spam statute. What applies is the Data Privacy Act 2012, which needs a lawful basis for processing someone’s details before you contact them. Consent is one basis. For business prospecting the workable one is usually legitimate interests, which has to be weighed rather than assumed. Republic Act 10173.
Does the Philippines have an anti-spam law?
No. The Senate’s own legislative reference lists an Anti-Spam Act of 2021 and an Anti-Spam Act of 2022, and both are filed bills rather than enacted Republic Acts. That absence is why the Data Privacy Act does the work here, and why advice written for Australia or Singapore does not transfer. Senate anti-spam listing.
Is a work email address treated as personal information?
Yes. Section 4 of the Act excludes information about an officer or employee of a government institution relating to their position or functions. It does not exclude private-sector work contact details, so an ordinary business email address is ordinary personal information. Singapore takes the opposite approach, which is why a policy written for Singapore will not survive here.
Can I rely on legitimate interests for B2B prospecting?
It is the usual basis, and it is conditional. The Act permits processing necessary for the legitimate interests of the controller or a third party, except where those interests are overridden by the fundamental rights and freedoms of the data subject. That is a balancing test you have to actually perform and be able to show, not a box to tick.
Do I have to tell people before I put them in my CRM?
The right to be informed attaches before the information enters the processing system, and the notice covers what is collected, the purposes, the scope and method of processing, and who it may be disclosed to. The Implementing Rules add that where processing is for direct marketing or profiling, the notice says so. A purchased list walks straight into this. The Implementing Rules.
What are the penalties in the Philippines?
Criminal, which sets this market apart from the rest. Unauthorized processing of personal information carries imprisonment of one to three years and a fine of PHP500,000 to PHP2,000,000. Sensitive personal information runs to three to six years and PHP4,000,000. Where the processing affects at least one hundred data subjects, the maximum penalties apply.
Question not answered here? Ask ANI and get a straight answer.
Show your working
Primary sources
Checked against these on 29 September 2026. They are the authority; this page is a plain-English reading of them, and it is general information rather than legal advice.
- Republic Act 10173, the Data Privacy Act of 2012, as published by the National Privacy Commission, for the lawful criteria at section 12, the right to be informed at section 16, the scope and exclusions at section 4, and the unauthorized processing penalties.
- The Implementing Rules and Regulations for the definition of direct marketing, the requirement that the notice covers direct marketing and profiling, and the right to object to it.
- Senate of the Philippines, legislative reference on anti-spam, for the two Anti-Spam Act bills and their status as bills rather than enacted law.
One distinction kept rather than smoothed over. The Act's own enumeration of the right to be informed does not itself name direct marketing; the Implementing Rules do. This page attributes each requirement to the instrument that carries it rather than presenting them as one, because if you are building a process against this you will be reading those two documents, and it matters which says what.