CPRA Section 41 for Philippine Law Firms: WhatsApp on a Social Media Account

Four Philippine instruments — CPRA, AMLA, DPA, and PD 1529

A Philippine law firm's WhatsApp Business number sits on the same handset the managing partner uses to book a ride to court. That much is the same everywhere. The Philippine regulatory answer to what may cross that channel is distinct and worth setting out carefully.

Four Philippine instruments set most of what a firm may do with WhatsApp today. They are not of one kind: the Code of Professional Responsibility and Accountability is a Supreme Court act, the Anti-Money Laundering Act and the Data Privacy Act 2012 are statutes, and Presidential Decree No. 1529 is a presidential decree.

The first is the Code of Professional Responsibility and Accountability (A.M. No. 22-09-01-SC), the CPRA, which took effect fifteen calendar days after publication in the Official Gazette or a newspaper of general circulation. Canon II devotes nine sections (36 through 44) to online and social-media conduct, and Section 41 specifically addresses the situation this piece is about: a lawyer who "uses a social media account to communicate with any other person in relation to client confidences and information, shall exert efforts to prevent the inadvertent or unauthorized disclosure or use of, or unauthorized access to, such an account." The regulator names the exact act.

The second is the Anti-Money Laundering Act, principally through the amendments in Republic Act 10365 (2013). Section 3(a) directly excludes lawyers and accountants acting as independent legal professionals from the covered-persons definition in relation to client-related information or where disclosure would compromise client confidences. Section 9(c) additionally exempts them from the reporting duty for covered and suspicious transactions when the relevant information was obtained under professional secrecy or legal professional privilege. This is a text-of-law exclusion, and it comes with an explicit condition — that the affected professionals remain subject to their code of conduct.

The third is the Data Privacy Act 2012 (RA 10173) together with its Implementing Rules and Regulations. Section 16 of the Act sets six rights of the data subject; Section 34(b) of the IRR adds an explicit right to object to processing "including processing for direct marketing, automated processing or profiling." The Act's list did not include this; the IRR did. The National Privacy Commission has been active enough on messaging apps that it issued a public statement on the WhatsApp Terms of Use (dated 21 January 2021, updated 17 January 2022).

Underneath these three instruments sits Presidential Decree No. 1529 (the Property Registration Decree), for the transactional file where a Philippine lawyer's WhatsApp use most often lands.

The practical question a firm asks itself before sending a message: does it fit the CPRA's Canon II social-media provisions and Section 17's non-solicitation-with-permissible-advertising standard; does the underlying processing have a basis under DPA Section 12 or trigger the IRR Section 34(b) objection right; and does the client-relationship information sit within the AMLA Section 9(c) exemption when transactional detail comes up on the channel.

Canon II — Section 41 as the operative rule, with Sections 37, 40, and 17 setting the boundary

CPRA Canon II devotes nine sections (36 through 44) to lawyer conduct on social media and online channels. Four of them do the operative work for the fact pattern of a firm's WhatsApp use with clients — Sections 17, 41, 37, and 40. The others set adjacent online-conduct duties, listed at the end of this section.

The operative section is Section 41 (Duty to Safeguard Client Confidences in Social Media):

"A lawyer, who uses a social media account to communicate with any other person in relation to client confidences and information, shall exert efforts to prevent the inadvertent or unauthorized disclosure or use of, or unauthorized access to, such an account."

Section 41 does three things at once. It presumes that a lawyer will use a social media account to communicate about client matters. It imposes a safeguarding duty on that use. And it makes the duty specific to the account — the obligation is to prevent inadvertent or unauthorized disclosure or use of "such an account," meaning the account being used for the client-related exchange.

Section 41's language is broad enough on its face to reach a messenger. The operative unit is the account being used to communicate about client matters, not the taxonomy of the platform: the rule attaches to "a lawyer, who uses a social media account to communicate with any other person in relation to client confidences and information." WhatsApp is a service on which the lawyer holds an account, uses to communicate with other people, and where messages sit until they are opened. Read in that structure, the section reaches WhatsApp — the account is being used for the exact activity the rule names.

The classification of WhatsApp as "social media" is not itself defined by the CPRA. In industry usage, WhatsApp is more often described as a messenger than as a social network. A firm relying on the reverse reading — that Section 41 does not attach because WhatsApp is not "social media" in the popular sense — accepts the enforcement risk that a Philippine tribunal reads the provision by its function, not by an industry label the CPRA does not use. The safer construction, and the one this piece proceeds on, is that Section 41 applies. On that construction, a firm cannot treat WhatsApp as a personal channel outside its compliance obligations: what matters is that the account is being used for client-related communication. A firm-owned business account is the arrangement that lets the "exert efforts to prevent" duty be discharged in an auditable way; a personal account on a fee-earner's phone is not.

Two supporting sections draw the boundary Section 41 assumes.

Section 37 (Online Posts): "A lawyer shall ensure that his or her online posts, whether made in a public or restricted privacy setting that still holds an audience, uphold the dignity of the legal profession and shield it from disrepute, as well as maintain respect for the law." The "restricted privacy setting that still holds an audience" language reaches a WhatsApp broadcast to a client list or a WhatsApp Status update — content that is not public but still has viewers.

Section 40 (Non-disclosure of Privileged Information): "A lawyer shall not reveal, directly or indirectly, in his or her online posts confidential information obtained from a client or in the course of, or emanating from, the representation, except when allowed by law or the CPRA." Section 40 prohibits publication of confidences in posts; Section 41 governs the use of the account for confidential communications with clients. Read together, the CPRA distinguishes between publishing a client confidence (Section 40 — prohibited) and using a social media account to hold a confidential conversation with a client (Section 41 — permitted with a safeguarding duty).

Section 17 (Non-solicitation and Impermissible Advertisement) addresses the marketing side directly:

"A lawyer shall not, directly or indirectly, solicit, or appear to solicit, legal business. A lawyer shall not, directly or indirectly, advertise legal services on any platform or media except with the use of dignified, verifiable, and factual information, including biographical data, contact details, fields of practice, services offered, and the like, so as to allow a potential client to make an informed choice. In no case shall the permissible advertisement be self-laudatory."

Two things are worth naming in Section 17. The ban on solicitation is absolute — direct or indirect. A WhatsApp broadcast to a prospect list solicits directly, and it does not become permissible by being framed as an "information" post. Advertising is permitted, but under a standard — "dignified, verifiable, and factual" — and with an open-ended enumeration ("and the like") rather than a closed list of permitted items. What that permits is any advertising content that meets the standard; what it does not permit is anything that shifts from advertising to solicitation, or that fails the dignified/verifiable/factual test.

The remaining Canon II social-media sections set duties adjacent to but not specific to client communication over a messaging channel:

• Section 36 — general duty to understand the benefits, risks, and ethical implications of social media use.
• Section 38 — prohibits knowing or malicious dissemination of false or unverified statements.
• Section 39 — prohibits hidden-identity accounts used to circumvent law or the CPRA.
• Section 42 — restricts social-media communication with officers of court, tribunal, or other government agency to influence performance; the full text is longer than the excerpt this piece was able to source.
• Section 43 — permits general legal information through traditional or electronic means, in mass or social media; the full text is longer than the excerpt this piece was able to source.
• Section 44 — duty of prudence in social-media posts that could implicate the CPRA's conflict-of-interest provisions.

AMLA's textual exclusion for lawyers, and its interlock with CPRA Section 28

Republic Act No. 9160 (the Anti-Money Laundering Act), as amended by Republic Act No. 10365 (2013), sets the Philippines' AML regime. Section 3(a) of RA 10365 defines "covered persons" and, in the same section, sets out an express exclusion:

"the term 'covered persons' shall exclude lawyers and accountants acting as independent legal professionals in relation to information concerning their clients or where disclosure of information would compromise client confidences or the attorney-client relationship: Provided, That these lawyers and accountants are authorized to practice in the Philippines and shall continue to be subject to the provisions of their respective codes of conduct."

Section 9(c) adds a reporting exemption on top:

"Lawyers and accountants acting as independent legal professionals are not required to report covered and suspicious transactions if the relevant information was obtained in circumstances where they are subject to professional secrecy or legal professional privilege."

This is a direct exclusion by the text of the statute, and it comes with an explicit condition — that the affected professionals remain subject to their code of conduct. The condition is what tightens the interlock with the CPRA.

CPRA Canon III Section 28 sets out the exceptions to a lawyer's duty of client confidentiality. Its text names five circumstances in which a lawyer may reveal client confidences: "(a) When a written informed consent is obtained from the client; (b) When required by law, such as anti-money laundering statutes, or the Rules of Court; (c) To the extent necessary, to collect the lawyer's fees; (d) In defense of the lawyer, or the lawyer's employees or associates; or (e) By judicial order, but only if material."

The interaction between AMLA Section 3(a)/9(c) and CPRA Section 28(b) is worth naming carefully rather than framing as a conflict. Section 28(b) recognises AML statutes as a category of law that can require disclosure. Section 3(a) of RA 10365 tells us that Philippine AML law does not include lawyers acting as independent legal professionals in the covered-persons perimeter and does not require the disclosure Section 28(b) contemplates for that category. So for a lawyer acting independently in relation to client-related information, the two provisions do not conflict — the CPRA exception is available in principle, but no AML statute triggers it for this category. For a lawyer whose role in a specific transaction crosses out of independent legal practice into an activity the statute regulates directly, the analysis is different, and Section 28(b)'s exception may become live for that specific activity.

For a firm's WhatsApp use, the practical instruction: file-service messages about a matter under a retainer to a client sit within the AMLA exclusion and outside the reporting duty. Nothing about the WhatsApp channel changes that. What could change it is the lawyer stepping into an activity the statute names directly as covered — funds movement in the lawyer's own name on behalf of a party, for example — and at that point the CPRA + AMLA interlock has to be re-analysed for that specific activity, not for the channel.

DPA Section 12 basis, IRR Section 34(b) objection right, and the NPC's WhatsApp statement

The Data Privacy Act 2012 (Republic Act 10173) with its Implementing Rules and Regulations sets the Philippines' data-protection regime. The Act and the IRR do different things: the Act sets the base framework, and the IRR extends specific rights. The distinction matters for messaging.

Section 3 of the Act defines consent as "any freely given, specific, informed indication of will, whereby the data subject agrees to the collection and processing of personal information."

Section 12 lists the criteria for lawful processing of personal information. Processing requires at least one condition: the data subject has consented; processing relates to contract fulfillment; a legal obligation requires processing; processing is necessary to protect vital interests; processing is required for emergency response or public authority functions; or processing is necessary for "legitimate interests pursued by the personal information controller."

Section 13 addresses sensitive personal information and prohibits processing except when the data subject has given specific consent, an existing law permits processing with adequate safeguards, or one of a narrow set of other conditions applies.

Section 16 of the Act sets rights of the data subject: to be informed of the processing; to access the personal information; to correct inaccurate data; to suspend, withdraw, or block/destroy the information; to receive indemnification for damages; and to be informed of the processing generally. The Act's Section 16 does not, by its text, name a specific right to object to direct marketing.

Section 34(b) of the IRR does. It provides: "The data subject shall have the right to object to the processing of his or her personal data, including processing for direct marketing, automated processing or profiling." This right lives in the IRR rather than in the Act, but it is directly enforceable — the IRR is the operative rules for how the Act applies to a controller.

The National Privacy Commission has spoken on WhatsApp specifically. Its statement on the WhatsApp Terms of Use, dated 21 January 2021 and updated 17 January 2022, expressed concern about the "broad language" of the then-new WhatsApp terms and said "Critical privacy questions...remain unanswered." It listed specific concerns including use of personal data for advertising, tracking technologies, data-sharing with Facebook group companies, absence of service guarantees, and mandatory arbitration. It described Facebook as having "not had a stellar record in personal data protection and management." It acknowledged WhatsApp's end-to-end encryption but called it "a bare minimum requirement." The NPC recommendation at that time was that the public prepare for backup of data in case a move to a different platform proved more sensible.

That statement is now more than four years old, and it speaks to a specific edition of the WhatsApp terms of use. Its status as the NPC's current view has not been separately confirmed here. What it establishes for a Philippine law firm choosing WhatsApp as a channel for client communication is that the national data-protection regulator has publicly named the platform as an area of concern, at least at that historical moment. Firms relying on WhatsApp as their primary channel for client communication should check whether the NPC has published more recent guidance.

For a firm's WhatsApp use during ongoing business:

• File-service messages to a client under a live retainer rest on Section 12(a) consent obtained at engagement and Section 12(b) contract-fulfillment basis. The specific purpose is providing the legal service under the retainer.
• Cold WhatsApp outreach to a non-client requires Section 12(a) consent that meets the Section 3 standard, and Section 12(f) legitimate interests is unlikely to support cold marketing without careful analysis.
• The IRR Section 34(b) objection right operates independently of the lawful-processing basis: even if a firm has a Section 12 basis, the data subject may object to processing for direct marketing, and the firm has to honor that objection.

Client money — the CPRA and the Supreme Court's disciplinary regime, without a statutory accounts framework located

This piece did not locate a national statutory scheme prescribing where advocates hold client money, how it is segregated from firm money, or how an accountant's report demonstrates compliance for the Philippine legal profession — an equivalent to the UK SRA Accounts Rules. The formal control this piece was able to source runs through the CPRA and through the disciplinary regime the Supreme Court operates over the Bar. The Rules of Court and specific Supreme Court issuances may add further duties in that area not analysed here.

For a firm using WhatsApp with clients, one implication follows directly. Statements about client money in messages — a confirmation to hold funds, a commitment to a specific movement, a receipt acknowledgement — become record evidence for any subsequent disciplinary proceeding under the CPRA. The message-thread's evidentiary weight does not depend on the presence of a statutory client-money regime; it depends on the message having been sent by a lawyer in the firm's name.

A second implication follows for money instructions to the client. The instruction telling a client where to send funds — the account details, the beneficiary name, the reference — is a message a firm may reasonably send by WhatsApp to a current client. What the message cannot do is substitute for the firm's actual banking arrangement; funds have to land through the account the firm operates rather than through an in-thread payment mechanism.

PD 1529 Section 51 — registration as the operative act for registered land

Presidential Decree No. 1529 (the Property Registration Decree) governs the registration of instruments affecting registered land in the Philippines. Section 51 sets out the operative rule that determines what a document does and does not do before it is registered:

"An owner of registered land may convey, mortgage, lease, charge or otherwise deal with the same in accordance with existing laws. He may use such forms of deeds, mortgages, leases or other voluntary instruments as are sufficient in law. But no deed, mortgage, lease, or other voluntary instrument, except a will purporting to convey or affect registered land shall take effect as a conveyance or bind the land, but shall operate only as a contract between the parties and as evidence of authority to the Register of Deeds to make registration."

The section continues with the operative clause: "The act of registration shall be the operative act to convey or affect the land insofar as third persons are concerned."

The mechanic has a specific structure worth naming. An unregistered PD 1529 instrument does take effect between the parties as a contract — the parties are bound to each other by the terms of the deed. It does not, however, bind the land or affect third persons; registration is the operative act for that. The distinction produces a specific practical instruction: unregistered instruments are enforceable inter partes as contracts and are useful for that purpose, but they cannot be relied on against a subsequent purchaser or against any third party interest in the land until registered.

For a firm running a Section 51 transaction, the client-facing WhatsApp workflow has natural touchpoints tied strictly to the operative text:

• Confirming to the client that the instrument they have signed operates between the parties as a contract under Section 51, and that registration is the act that will make it operative to convey or affect the land against third persons.
• Confirming — where the client is not the party in a subsequent deal — the significance of the phrase "insofar as third persons are concerned" for their own position if a third-party claim later surfaces before registration completes.
• Once registration has been effected, providing the client with the reference to the registration entry, because that reference is what establishes the "operative" status Section 51 attaches to registration.

Each of these is a service message on a live retainer under the CPRA. Canon II Section 41's safeguarding duty applies to the exchange, CPRA Section 17 does not treat file-service messages as solicitation, and the AMLA exclusion places the firm outside the reporting-entity duty. None substitutes for the underlying regulatory workflow — the drafting itself, the formal registration procedures, and the Section 51 exposure that persists until registration is effected — which happens through the firm's own arrangements rather than in the WhatsApp thread.

WhatsApp Business Platform costs — what Meta publishes, what it doesn't

Meta moved the WhatsApp Business Platform to per-message pricing on 1 July 2025. Under the current model, businesses are only charged when a template message is delivered; utility templates sent inside an open customer service window — the 24-hour window that opens each time the client sends the firm an inbound message — are free; marketing and authentication templates are charged whether inside or outside the window. Meta publishes actual per-market rates as downloadable rate cards (CSV and PDF, per currency including PHP for the Philippines) rather than inline on the pricing page. The most current numbers live at developers.facebook.com/documentation/business-messaging/whatsapp/pricing — the rate-cards section links out to the specific CSV for PHP, and any scheduled PHP billing changes are listed on Meta's pricing update page.

For a Philippine firm whose WhatsApp usage is dominated by file-service updates in reply to current clients' inbound messages — the utility-inside-CSW pattern — the platform bill is small. Firms considering outreach messaging outside that pattern run into both a bigger bill and the CPRA Section 17 plus DPA Section 12 analyses set out above at the same time.

Scope — national position; IBP directives and court practice directions may add overlays

This piece covers Philippine lawyers and law firms operating under the national position: the CPRA (A.M. No. 22-09-01-SC) of 2023, the Anti-Money Laundering Act as amended (principally by RA 10365 and RA 10927), the Data Privacy Act 2012 with the IRR, the National Privacy Commission's issued statements, and Presidential Decree No. 1529. The Integrated Bar of the Philippines may issue its own directives and pronouncements supplementing the CPRA; firms operating in specific practice areas should check whether relevant IBP directives address communication practices. Court practice directions on lawyer conduct in specific proceedings can also add jurisdiction-specific overlays; the analysis above is at the national baseline.

FAQ

Q: Can we message a current client on WhatsApp about their live matter?
Yes. A message to a current client about the client's live matter is not solicitation under CPRA Section 17, and CPRA Section 41 governs the exchange: the firm using a social media account to communicate about client confidences must "exert efforts to prevent the inadvertent or unauthorized disclosure or use of, or unauthorized access to, such an account." Processing of the client's number for that purpose rests on Section 12(a) consent obtained at engagement and Section 12(b) contract-fulfillment basis under the DPA. The AMLA exclusion for lawyers acting as independent legal professionals means the AMLA reporting duty does not attach.

Q: Can a Philippine firm run WhatsApp outreach to a purchased list of prospects?
No. CPRA Section 17 permits advertising with "dignified, verifiable, and factual information" but continues to prohibit direct or indirect solicitation of legal business. A WhatsApp broadcast to a purchased list solicits the recipients directly, and it is not the type of published advertising Section 17 permits. Separately, DPA Section 12 does not provide a lawful basis for the processing of the recipients' contact details for marketing without their consent, and IRR Section 34(b) gives each recipient the right to object.

Q: Are Philippine lawyers reporting entities under AMLA?
No, and this is a direct exclusion by the text of the statute, not a silence or a doctrine. RA 10365 Section 3(a) provides that "the term 'covered persons' shall exclude lawyers and accountants acting as independent legal professionals in relation to information concerning their clients or where disclosure of information would compromise client confidences or the attorney-client relationship: Provided, That these lawyers and accountants are authorized to practice in the Philippines and shall continue to be subject to the provisions of their respective codes of conduct." Section 9(c) adds a reporting exemption on top for information obtained under professional secrecy or legal professional privilege. This exclusion is textual and depends on the lawyer's continuing status as an independent legal professional in relation to the client information; a lawyer whose function in a specific transaction crosses out of independent legal practice into a directly-covered activity would be re-analysed for that activity.

Q: What is the NPC's position on WhatsApp for business communications?
The National Privacy Commission issued a statement on the WhatsApp Terms of Use dated 21 January 2021, updated 17 January 2022. That statement expressed concerns about the then-new terms and named specific issues — data-sharing with Facebook group companies, use of data for advertising, tracking technologies, absence of service guarantees, mandatory arbitration. The statement is now over four years old and applied to a specific edition of the terms; its status as the NPC's current view has not been separately confirmed here. Firms should treat the historical statement as a real regulator-published concern about the platform and check whether the NPC has issued more recent guidance.

Q: We serve OFW clients based abroad — do their host jurisdictions' rules apply to our WhatsApp messages?
Possibly. UK PECR regulation 22 imposes an opt-in requirement for direct marketing electronic mail to individual subscribers in the UK; UAE PDPL Article 17 grants a right to object to direct marketing; other host jurisdictions have their own rules. Each regime has its own criteria for extraterritorial application, and this piece does not analyse them. A firm sending WhatsApp messages to an OFW client based in a specific host jurisdiction should check that jurisdiction's data-protection and lawyer-conduct rules directly, particularly for messaging that goes beyond service on a live retainer.

Q: Are staff personal WhatsApp accounts acceptable for firm communications with clients?
Not for client-file communications. CPRA Section 41's duty to prevent unauthorized disclosure of client confidences on a social media account is difficult to discharge on a personal account, which the firm cannot audit or recover when the fee earner leaves. The workable pattern is a firm WhatsApp Business number tied to firm infrastructure so that messages are captured in the client file and remain within the firm's control.

Sources and methodology

This piece relies on primary text of the Code of Professional Responsibility and Accountability (A.M. No. 22-09-01-SC) as reproduced at Chan Robles Virtual Law Library — a third-party legal library rather than the Supreme Court website, whose direct URL for the CPRA document was not reachable during preparation. Sections 42 and 43 of the CPRA are cited in summary form only; the excerpts sourced were truncated, and readers should consult the Supreme Court's own publication of the CPRA for the complete text of those sections. Republic Act No. 10365 (amendments to AMLA) is cited from lawphil.net. The Data Privacy Act 2012 (RA 10173) is cited from lawphil.net; the Implementing Rules and Regulations of the DPA are cited from the NPC-published PDF. The NPC Statement on WhatsApp Terms of Use is cited from privacy.gov.ph, dated 21 January 2021 with a 17 January 2022 update. Presidential Decree No. 1529 (Property Registration Decree) is cited from lawphil.net.