For BPO, shared-services and staffing talent leaders in the Philippines

The rules a hiring assessment has to survive in the Philippines.

Pre-employment assessment is lawful in the Philippines. No statute prohibits testing candidates, and no AI law is in force. What is regulated is how you run it: candidate data is processed under the Data Privacy Act of 2012, the National Privacy Commission has said consent is the wrong default inside an employment relationship, the Anti-Wiretapping Act makes recording a conversation without every party's knowledge a criminal offence, and RA 10911 forbids requiring a candidate to declare their age. This page states each instrument, what it means for the assessment specifically, and what AssessAll does not do about it.

Start with 250 free credits +91 99000 11601

At a glance

Fair Hiring & Assessment Compliance, Philippines: the facts, with their units

Governing privacy law	Republic Act No. 10173, the Data Privacy Act of 2012, approved 15 August 2012. In force. Enforced by the National Privacy Commission.
Age is sensitive personal information	Section 3(l) of the DPA lists age among sensitive personal information, alongside race, marital status, health and religion. Most jurisdictions do not. A date-of-birth field is a heavier obligation here than elsewhere.
Consent is not the safe default	NPC Advisory Opinion No. 2024-003 (2 April 2024) states that employees cannot freely consent given the employment relationship, and points employers to contract necessity or legitimate interest with a three-part test and a Privacy Impact Assessment.
Recording is all-party consent	RA 4200, the Anti-Wiretapping Act (1965), carries 6 months to 6 years' imprisonment. Ramirez v. Court of Appeals (1995) held that even a party to a conversation who records it without the other's knowledge violates it.
Age in hiring	RA 10911, the Anti-Age Discrimination in Employment Act (21 July 2016), prohibits age-based job advertisements and prohibits requiring the declaration of age or birth date during the application process. Bona fide occupational qualifications are excepted.
AI regulation status	None in force. House Bill 7396 and Senate Bill 25 (filed 2 July 2025) are pending; 26 House bills were consolidated into a substitute bill in a technical working group in July 2026. No Philippine AI statute binds an employer today.
Privacy engineering	NPC Advisory No. 2025-02, Guidelines on Privacy Engineering in Systems Life Cycle Processes (27 August 2025), expects a Privacy Impact Assessment at planning, maximum-privacy defaults at deployment, and periodic audits and PIAs at least once a year.
What AssessAll certifies	Nothing. AssessAll holds no Philippine accreditation, certification or regulatory approval, publishes no Philippine data-residency option, and this page is not legal advice.

The consent tick-box is the most common mistake, and the regulator has already said so

Almost every vendor page in this market tells you to collect consent. The NPC's own 2024 advisory opinion says the opposite for the employment context: the relationship prevents consent from being freely given, so consent is a weak basis to build on. What carries the processing is contract necessity or legitimate interest, documented with a three-part test — and what carries the fairness is notice, not the box the candidate had no realistic option but to tick.

Recorded voice is a criminal statute here, not a privacy footnote

In most markets a recorded phone screen is a data-protection question. In the Philippines it is RA 4200, it is all-party, and the Supreme Court has held it catches a participant who records without telling the other side. In a BPO funnel the exposed step is rarely the assessment platform, which discloses capture before it starts — it is the recruiter who records the follow-up call for quality without saying so.

Age sits in two statutes at once, and a routine form field trips both

The DPA classifies age as sensitive personal information; RA 10911 prohibits requiring its declaration during the application process. A date-of-birth field copied from a global ATS template is ordinary configuration everywhere else and a two-instrument problem here. The only defensible reason to touch age at all in a hiring funnel is aggregate fairness monitoring, and that needs a band, optional, off the selection path.

"No AI law" is being read as "no rules"

There is no AI statute in force in the Philippines, and a large share of 2026 employer content implies otherwise. The opposite error is more expensive: the DPA already reaches AI-assisted scoring through proportionality, transparency and the PIA expectation, and NPC Advisory Opinion 2024-003 addressed algorithmic monitoring directly. The absence of an AI act removes nothing that already applies.

What you get

Built for fair hiring & assessment compliance, philippines

No date of birth, and no age field anywhere on the selection path

The candidate flow collects no date of birth and no age. The only age data the platform can hold is an optional, self-declared four-way band — 18–24, 25–34, 35–44, 45+ — collected solely for aggregate adverse-impact monitoring, never displayed per candidate and never shown to a reviewer making a decision. Under RA 10911 and the DPA's classification of age as sensitive personal information, that is the difference between a field you must justify and a field you do not have.

Disclosure before capture, enforced in the player

A proctored attempt cannot start until the candidate has been shown what will be recorded — identity photo, periodic webcam capture, tab and screen-capture events, and audio where the assessment is voice-based — and has acknowledged it. Against RA 4200, disclosure before capture is the whole point: the statute turns on secrecy, and a gate in the product is stronger evidence than a clause in a policy nobody read.

Intelligibility is scored; accent is not

Spoken sections score whether a listener can follow what was said and whether the content was right. That distinction is written into the instrument design and stated on the product itself, not just in marketing copy — the AssessAll Certified product descriptions say it in the same sentence that describes the scoring. In a market whose largest export industry is English-language service work, it is the claim most worth being able to check.

Adverse-impact monitoring on aggregates, with a minimum group size

Selection rates by self-declared group with a four-fifths flag below 0.80, groups smaller than five shown but excluded from flagging, aggregates only, and a flag presented as a prompt to investigate rather than a verdict. It is an internal check on your own data. It is not, and is not offered as, an independent bias audit.

Voice assessment where the employer never receives the recording

AssessAll Certified sittings include live role-play calls with an AI counterpart. The employer-facing artefact is the level and a five-pillar band profile — never the call recordings and never the raw scores. That boundary is a property of the product, and it is also the cleanest answer to the RA 4200 replay-and-disclosure risk in a funnel where audio would otherwise be forwarded to a client.

A per-candidate report that doubles as the record

Scores by section, the integrity band and the evidence behind it, the timestamp and the instrument version, retained in the workspace that commissioned the assessment. When a candidate asks what was captured, or a complaint arrives a year later, the artefact already exists rather than having to be reconstructed.

The same instrument to everyone in a drive

An assessment set is composed once per role and delivered by one share link or QR code with no participant accounts, so every candidate for that role sits the same items for the same duration. Consistency is a property of how the wave is built, not something a recruiter has to maintain by hand across a 3,000-applicant month.

Vendor due diligence

Six questions to ask any assessment vendor operating in the Philippines

1
Ask what the platform stores from a spoken or proctored attempt, and for how long
Not whether it is "secure" — what the artefacts are. For a voice assessment: is the candidate's audio retained, or only the transcript and the score? For proctoring: how many images, at what interval, held how long. You cannot complete a Privacy Impact Assessment on an answer that is a security certification badge.
2
Ask which lawful basis the vendor assumes you are relying on
If the answer is "the candidate consents", the vendor has not read NPC Advisory Opinion 2024-003. The useful answer names contract necessity or legitimate interest and hands you what you need for the balancing test — a data inventory, a retention period, and the controls that reduce candidate detriment.
3
Ask whether accent is scored, and how you would know
In a market that sells English-language work, this is the single highest-stakes question in a voice screen. The answer must be checkable — what the rubric contains, what the model is asked to judge — not a reassurance. Intelligibility and accent are different constructs, and a vendor that cannot separate them in writing has not separated them in scoring.
4
Ask where the data is hosted, and accept the answer you get
The DPA has no data-localisation requirement, so an offshore host is lawful; what matters is that cross-border transfer is disclosed in your privacy notice and covered by your controller-processor agreement. A vendor with no in-region hosting is not disqualified — a vendor who will not tell you where the data sits is.
5
Ask what the employer-facing view shows, field by field
The fairness question is not what the platform collects but what a recruiter sees at the moment of the decision. Demographic fields, age bands and raw audio should not be on that screen. Ask for a screenshot of the reviewer view rather than a description of it.
6
Ask what happens when the vendor gets it wrong
Breach notification under the DPA runs to the NPC and to affected data subjects, and the obligation is yours as controller. Establish before the pilot how quickly the vendor tells you, what they tell you, and who drafts the notification — this is a contract term, not a support policy.

Regulation & compliance

What actually applies, instrument by instrument

Every entry states where the instrument really stands, what it requires, and what it means for a hiring assessment specifically rather than for HR in general. Statuses were checked at primary sources on the date shown. Nothing here is legal advice, and none of it is a claim that AssessAll is certified against any of it.

Statuses verified at primary sources on 2 September 2026.

SiddharthanFounder, AssessAll — Bodhih Training Solutions

Founder of AssessAll and of Bodhih Training Solutions, a corporate training company in Bangalore. Works on assessment design, scoring and reporting across hiring, L&D and certification programmes.

Last reviewed 2 September 2026

Regulatory positions on this page were verified at primary sources on 2 September 2026 and are pending review by qualified Philippine counsel. Nothing here is legal advice.

Philippines

Everything below except the AI bills is in force today. The instrument that gets the least coverage — RA 4200 — carries the only criminal penalty on this page.

Data Privacy Act of 2012 (Republic Act No. 10173)

In force · approved 15 August 2012 · enforced by the National Privacy Commission

Personal information may be processed on any of six bases in Section 12, including consent, necessity for a contract or pre-contractual steps taken at the data subject's request, a legal obligation, and the legitimate interests of the controller where these are not overridden by the data subject's fundamental rights. Sensitive personal information under Section 13 is prohibited from processing except in narrow cases, the first of which is consent specific to the purpose. Section 3(l) defines sensitive personal information to include an individual's race, ethnic origin, marital status, AGE, colour, religious, philosophical or political affiliations, health, education, genetic or sexual life, and information on criminal proceedings. Processing must be transparent, for a legitimate declared purpose, and proportionate — adequate, relevant, necessary and not excessive.

What it means for a hiring assessment

Two consequences change how you configure an assessment in this market specifically. First, age is sensitive personal information here, which most global ATS and assessment templates do not assume: a date-of-birth field that is ordinary configuration in Singapore or the UK becomes Section 13 processing in Manila, needing purpose-specific consent or an exception you can name. Delete the field unless you can say what hiring decision it informs. Second, proportionality applies to constructs, not just to fields — a personality inventory bolted onto a customer-service screen because the licence included it is data you cannot connect to a declared purpose. The honest test is whether you could write, in one sentence, why each thing you measure is required by the job.

Source: Republic Act 10173, Data Privacy Act of 2012 (NPC)

NPC Advisory Opinion No. 2024-003 — monitoring and recording in the employment relationship

In force as guidance · issued 2 April 2024 · advisory, not a regulation

Asked about randomly monitoring telecommuting employees and recording work meetings, the Commission concluded such processing can be lawful, but not on consent: it stated that written consent for each recording is unnecessary because employees are not in a position to consent freely given the employment relationship. Employers should instead establish a lawful basis in contract fulfilment or legitimate business interest, apply the three-part legitimate interest test — purpose, necessity, and a balancing against the data subject's rights — conduct a Privacy Impact Assessment, and communicate the monitoring policy transparently and proportionately.

What it means for a hiring assessment

This is the entry that should change what you do this week, because it inverts the standard vendor instruction. Do not build your assessment programme on a candidate consent checkbox. Write the three-part test down before the drive opens: the purpose (selecting for a named role against a written requirement), the necessity (why the same decision cannot be made on the application form alone), and the balance (what the candidate loses, and what you did to reduce it — no accent scoring, no demographic fields on the selection path, a stated retention period). Keep the notice, and keep it plain: a candidate must be able to tell what is captured, by what, and for how long, before the attempt begins. The consent gate stays — it is good practice and it satisfies RA 4200 disclosure — but it is not the thing carrying the processing.

Source: NPC Advisory Opinion No. 2024-003 (2 April 2024)

Anti-Wiretapping Act (Republic Act No. 4200)

In force · approved 19 June 1965 · criminal statute

It is unlawful for any person, not being authorised by all the parties to any private communication, to secretly overhear, intercept or record that communication using any device — and equally unlawful to possess, replay, disclose or furnish transcripts of a recording made in violation. Penalties run from six months to six years' imprisonment, with perpetual disqualification from public office for public officers and deportation for aliens. Section 4 makes any such recording inadmissible in any judicial, quasi-judicial, legislative or administrative proceeding. In Ramirez v. Court of Appeals (1995) the Supreme Court held that a person who is party to a communication and records it without the other party's knowledge is still a violator.

What it means for a hiring assessment

The operative word is secretly, so the entire compliance surface for a recorded or spoken assessment is disclosure before capture, not the recording itself. A voice assessment that tells the candidate on screen that their audio will be recorded, and will not start until they acknowledge it, is on the right side of this. Two adjacent steps in a normal BPO funnel are the ones worth auditing: a recruiter who records a phone screen "for quality" without saying so, and a hiring manager who forwards a candidate's assessment audio to a client — the second is a disclosure the candidate was never given, and RA 4200 reaches replay and furnishing as well as recording. Also note the evidentiary trap: a recording obtained badly is inadmissible in an administrative proceeding, which is exactly where a disputed termination or a discrimination complaint ends up.

Source: Republic Act No. 4200 — Anti-Wiretapping Act

Anti-Age Discrimination in Employment Act (Republic Act No. 10911)

In force · lapsed into law 21 July 2016

It is unlawful for an employer to print or publish, in any medium including the internet, any employment advertisement suggesting preferences, limitations, specifications or discrimination based on age; to require the declaration of age or birth date during the application process; to decline an application because of age; to discriminate in compensation, terms or privileges on account of age; to deny promotion or training because of age; or to force lay-off or early retirement on the basis of age. Section 6 excepts age limitations where age is a bona fide occupational qualification reasonably necessary to the normal operation of the business, bona fide seniority systems and retirement plans, and actions certified by the Secretary of Labor and Employment.

What it means for a hiring assessment

A structured, job-related assessment is the defence here rather than the risk — but only if the requirement was written before the instrument was chosen. Age-discrimination exposure in a screening funnel usually arrives through a proxy: a graduation-year field, a "years of experience" cut used as a shortcut for seniority, or a timed test whose speed component nobody can connect to the job. Replace the proxy with the capability it was standing in for and the exposure goes with it. The one legitimate reason to hold age data in a hiring funnel is aggregate fairness monitoring, and that means a coarse band, self-declared, genuinely optional, never displayed per candidate and never on the selection path — the opposite of a required date-of-birth field.

Source: Republic Act No. 10911 (Supreme Court E-Library)

NPC Advisory No. 2025-02 — Privacy Engineering in Systems Life Cycle Processes

In force as guidance · issued 27 August 2025 · advisory

Guidance for personal information controllers and processors on building privacy into systems across five stages. At planning, conduct a Privacy Impact Assessment to identify the risks the proposed processing system creates. At design, implement security measures for confidentiality, integrity and availability, and set retention policies defining how long personal data may be stored. At testing, verify the privacy and security controls actually work. At deployment, provide clear and concise privacy notices and ensure default settings give maximum privacy protection. In operation, monitor for incidents and conduct periodic audits and PIAs at least once a year.

What it means for a hiring assessment

Buying an assessment platform is deploying a data processing system, and the PIA is yours — no vendor can conduct it for you, and none should claim to. What a vendor owes you is the inputs: what is captured during an attempt, where it is stored, who inside your organisation can see it, what is shared with sub-processors, and the retention period. Ask for those in writing before the pilot rather than during the annual audit. The maximum-privacy-default line is the one to hold vendors to at configuration time: proctoring channels, demographic fields and score visibility should start off and be switched on deliberately, with the reason recorded, rather than arriving on.

Source: NPC Advisory No. 2025-02 (27 August 2025)

Artificial-intelligence legislation

NOT IN FORCE · House Bill 7396 and Senate Bill 25 (filed 2 July 2025) pending; 26 House bills consolidated in a technical working group substitute bill, July 2026

The Philippines has no AI statute. The pending House measure, the Artificial Intelligence Development and Regulation Act, would establish an AI Development Authority and set compliance obligations; the Senate's Artificial Intelligence Regulation Act would create a National AI Commission. In July 2026 the House Committee on Information and Communications Technology consolidated 26 House bills, three resolutions and a privilege speech into a draft substitute bill, with stakeholder amendments invited to 20 July 2026. Separate measures aimed at AI use in the workplace and workers' protection have been filed. A National AI Strategy Roadmap (2025) sets principles, not obligations.

What it means for a hiring assessment

Two errors to avoid in opposite directions. Do not let a vendor or an internal deck imply that Philippine AI rules bind you today — none do, and a page that says otherwise is wrong on its first sentence. And do not conclude that AI-assisted scoring is therefore unregulated: the DPA's transparency and proportionality principles apply to it now, NPC Advisory Opinion 2024-003 dealt with algorithmic monitoring and scoring of workers directly, and a PIA covering an automated scoring system is already the expectation under Advisory 2025-02. The practical posture is to build as though explainability will be required, because the cost of doing so is low and the direction of travel across the consolidated bills is consistent.

Source: Morrison Foerster — AI regulation tracker, Philippines

DOLE Department Order No. 53-03 — Drug-Free Workplace

In force · issued 2003 · implements RA 9165

Guidelines for implementing drug-free workplace policies and programmes in the private sector, made under the Comprehensive Dangerous Drugs Act of 2002. Establishments with ten or more employees must formulate and implement a drug abuse prevention and control programme, developed jointly with labour representatives and covering advocacy, education, testing, and treatment or rehabilitation. Testing must run through DOH-accredited centres with both a screening and a confirmatory test, and results are confidential. The order addresses workplace drug testing generally, including random testing during employment; it does not itself mandate a pre-employment drug test.

What it means for a hiring assessment

Included for contrast, and because the contrast is routinely mis-stated. Drug testing is the one workplace testing regime the Philippine state actually prescribes — and even here the department order mandates the programme and the accredited, confirmed method rather than a pre-employment test as such, which is worth knowing before someone tells you a pre-hire drug test is legally required. What the regime does show is what a prescribed test looks like: accredited providers, a confirmatory second test, and confidentiality rules. A capability assessment has none of that — it is voluntary, unaccredited by anyone, and its defensibility comes entirely from your own documentation that it measures what the job needs. Do not let the existence of a mandated test create an assumption that any pre-employment test is presumptively fine, and do not let an assessment vendor's language borrow the word "certified" from a regime it has nothing to do with.

Source: DOLE Department Order No. 53-03

AssessAll holds no Philippine accreditation, certification or regulatory approval of any kind, is not registered with the National Privacy Commission as a compliance-certified provider, and does not certify that any deployment of its platform is compliant with Philippine law. This page is a factual summary of publicly available primary sources verified on 2 September 2026 — it is not legal advice, it is not a substitute for Philippine counsel, and statuses change. Where an instrument's status matters to a decision you are about to make, check the primary source linked beside it.

Common use cases

Completing a Privacy Impact Assessment for a new assessment platform before a pilot
Replacing a consent-only lawful basis with a documented legitimate-interest test
Auditing a BPO hiring funnel for undisclosed call recording
Removing date-of-birth and graduation-year fields from a screening form
Answering a candidate's request to know what a proctored sitting captured
Briefing a US or UK client on how their Philippine delivery centre screens candidates

Pricing for philippines compliance

None of this is a paid compliance module. The consent gate, the proctoring evidence, the per-candidate record and the aggregate adverse-impact view are part of the platform. Assessments are paid for per candidate in US dollars: 1 credit = US$0.50, a structured BPO hiring screen runs US$8–13 per candidate, and an AssessAll Certified sitting — the voice-first credential with live role-play calls — is US$19 for the individual taking it. New organisations get 250 free credits. No seat licences, no annual minimum, no compliance tier.

See full pricing solutions@bodhih.com

Frequently asked questions

Is pre-employment assessment legal in the Philippines?+

Yes. No Philippine statute prohibits assessing candidates before hiring, and no AI law is in force. What is regulated is how you run it. Candidate data is processed under the Data Privacy Act of 2012, which requires a lawful basis, transparency and proportionality; recorded voice is governed by the Anti-Wiretapping Act, which is all-party and criminal; and RA 10911 prohibits requiring a candidate to declare their age or birth date during the application process. A structured, job-related assessment applied consistently and disclosed before capture is lawful and, in an age-discrimination context, is closer to a defence than a risk.

Do we need candidate consent to run an assessment in the Philippines?+

You need a lawful basis, and consent is probably not the right one. NPC Advisory Opinion No. 2024-003, issued on 2 April 2024, states that written consent is unnecessary for monitoring and recording in the employment context because the employment relationship prevents consent from being freely given, and directs employers instead to contract fulfilment or legitimate business interest with a three-part test — purpose, necessity and balancing — plus a Privacy Impact Assessment and a transparent policy. Keep a consent screen anyway: it satisfies the disclosure that the Anti-Wiretapping Act requires and it is good practice. Just do not rely on it as the basis for the processing.

Can we record a candidate's voice during an assessment in the Philippines?+

Yes, provided every party knows. RA 4200 makes it unlawful to secretly overhear, intercept or record a private communication without authorisation from all the parties, with penalties from six months to six years' imprisonment, and in Ramirez v. Court of Appeals (1995) the Supreme Court held that even a participant who records without the other party's knowledge is a violator. The operative word is secretly, so a voice assessment that tells the candidate on screen what will be recorded before it starts is on the right side of the statute. The riskier steps are usually elsewhere in the funnel: an undisclosed "quality" recording of a recruiter phone screen, or forwarding a candidate's audio to a client without telling them, since the Act reaches replay and disclosure as well as recording.

Is age sensitive personal information in the Philippines?+

Yes. Section 3(l) of the Data Privacy Act of 2012 lists age among sensitive personal information, alongside race, ethnic origin, marital status, colour, religious and political affiliations, health, education, genetic or sexual life and criminal proceedings. That is unusual — most data-protection regimes treat age as ordinary personal data. Combined with RA 10911's prohibition on requiring the declaration of age or birth date during the application process, it means a date-of-birth field imported from a global ATS template is a two-instrument problem in Manila. AssessAll's candidate flow collects no date of birth and no age; the only age data available is an optional self-declared band used for aggregate fairness monitoring.

Does any Philippine AI law apply to AI-scored hiring assessments?+

None is in force. House Bill 7396 and Senate Bill 25, filed on 2 July 2025, are pending, and in July 2026 the House Committee on Information and Communications Technology consolidated 26 House bills into a draft substitute measure. Any page implying that Philippine AI rules bind employers today is wrong. The opposite reading is also wrong: the Data Privacy Act's transparency and proportionality principles already apply to AI-assisted scoring, NPC Advisory Opinion 2024-003 addressed algorithmic monitoring and scoring of workers directly, and NPC Advisory 2025-02 expects a Privacy Impact Assessment on a data processing system of this kind. Build as though explainability will be asked for.

Does AssessAll host Philippine candidate data in the Philippines?+

No. AssessAll publishes no Philippine data-residency option, and it would be wrong to imply one. That is not a legal bar — the Data Privacy Act contains no data-localisation requirement, and offshore processing is lawful where the cross-border transfer is disclosed in your privacy notice and covered by your controller-processor agreement, with the controller remaining accountable. But if in-country hosting is a hard requirement in your procurement, whether from a client contract or an internal policy, AssessAll is not the right platform for that requirement today and you should say so early rather than discover it at security review.

Is AssessAll certified as compliant with the Philippine Data Privacy Act?+

No. AssessAll holds no Philippine accreditation, certification or regulatory approval, and does not certify that any deployment of its platform is compliant. Compliance depends on decisions that are yours: which constructs you score, who you deliver assessments to, what you retain and for how long, what your recruiters see, and what you disclose. What the platform provides is controls and records — disclosure before capture, consistent delivery, inspectable proctoring evidence, per-candidate reports you can retain, and no age or date-of-birth field on the selection path. The compliance judgement is yours and your counsel's.

What should a BPO check first before a large hiring drive?+

Four things, in this order. Write down the requirement for the role before choosing the instrument, so "job-related" is a document rather than an opinion. Replace age proxies — graduation year, a years-of-experience cut used as a stand-in for seniority — with the capability they were substituting for. Audit every point in the funnel where audio is captured and confirm each one discloses it before capture, including recruiter phone screens. And complete the Privacy Impact Assessment before the pilot rather than after it, using the vendor's written answers on retention, access and sub-processors as inputs.