National Privacy Commission issues guidelines for vloggers, YouTubers

The National Privacy Commission (NPC) has released a new set of guidelines concerning the use of body-worn cameras (BWCs) and alternative recording devices (ARDs) by law enforcement and other entities. The new rules, released in NPC Circular No. 2025-01 and effective from June 2025, set strict protocols for the collection, processing, and storage of personal data captured by these devices.

The Circular applies to all personal information controllers (PICs) and processors (PIPs) using BWCs or ARDs, including police, private security agencies, and even vloggers (emphasis ours), when their activities involve the processing of personal data. However, purely personal, family, or household use—such as a cyclist using a camera for self-protection—is generally exempt, provided the footage is not shared online (emphasis ours) or used commercially. (The NPC clarifies that this exemption does not override the fundamental right to privacy.)

Persons using BWCs or ARDs must ensure transparency by providing clear privacy notices—both physically (e.g., signage or device indicators) and digitally (e.g., online privacy policies).

The lawful basis for processing personal data must be established, and the use of recordings must be compatible with declared, specific purposes such as law enforcement, traffic management, or public safety. Proportionality is emphasized: data collection must not be excessive and should only serve legitimate objectives.

Vloggers who record and publish footage that captures other individuals must provide privacy notices and ensure to mask bystanders’ identities, especially children and vulnerable persons.

This mandate could heavily impact vloggers or YouTubers who mostly produce pranks, do street surveys and the likes. They will need to either get permission from the people they are shooting or blur their faces in post-production (including bystanders). We’ve seen some established vloggers are doing this already on their channel but certainly this will be required from everyone from here onwards.

Individuals whose data is captured have the right to be informed, access footage, and request erasure, subject to reasonable limitations, such as ongoing police operations or national security concerns. Agencies must mask unrelated individuals in released footage and provide explanations for any denial or delay in fulfilling access requests.

Violations of the Circular carry potential criminal, civil, and administrative penalties under the Data Privacy Act. Agencies have 60 days from effectivity to comply, and the NPC will conduct regular reviews to keep the guidelines current with evolving technology and privacy best practices.

A copy of the complete circular is published online at the NPC website here 60.