Manila, Philippines – The National Privacy Commission (NPC) has received personal data breach notifications from 10 Philippine government agencies, as it reviews reported incidents and assesses the appropriate regulatory responses.
In an announcement on 10 November 2026, the commission named the Presidential Commission on Good Government (PCGG), Department of Information and Communications Technology (DICT), Department of Labor and Employment (DOLE), Bureau of Internal Revenue (BIR), Philippine Amusement and Gaming Corporation (PAGCOR), Department of Justice (DOJ), Securities and Exchange Commission (SEC), Philippine Coast Guard (PCG), Department of Trade and Industry (DTI), and Department of Science and Technology–Philippine Institute of Volcanology and Seismology (DOST-PHIVOLCS) as the agencies that had submitted notifications.
The DOLE notification was submitted through its Bureau of Local Employment, while the DOJ notification came through its Office for Alternative Dispute Resolution.
“The submission of personal data breach notifications is a regulatory requirement under NPC Circular No. 16-03, or the Personal Data Breach Management Circular, for incidents that meet the prescribed notification criteria. Each notification received by the NPC is reviewed and assessed by our Compliance and Monitoring Division, which examines the nature and circumstances of the reported incident, its potential impact on affected individuals, and the measures undertaken by the agency concerned,” said NPC Deputy Privacy Commissioner and Spokesperson Jose S. Belarmino II.
“Following its assessment, the Division prepares a report containing its findings and recommendations for submission to the Commission En Banc, which determines the appropriate action or decision based on the circumstances of each case,” Belarmino continued.
The Commission said the notifications allow it to examine the circumstances of each reported incident, assess potential impacts on affected individuals and determine whether further regulatory action is necessary.
“Breach notification is only one part of an agency’s responsibility under the Data Privacy Act. Equally important is how the agency responds to the incident, protects the individuals who may be affected, and addresses the vulnerabilities that may have contributed to the breach.
Where the prescribed conditions for mandatory notification are met, affected data subjects must also be notified in accordance with the requirements and timelines set under the Circular. The NPC expects government agencies to demonstrate accountability not merely through compliance with notification requirements, but through concrete and effective measures to safeguard personal data and prevent similar incidents from recurring,” Belarmino stressed.
The NPC further reiterated that government agencies remain accountable for personal information under their control or custody, including data handled by external service providers.
Under Section 21 of the Data Privacy Act, personal information controllers remain responsible for information transferred to third parties for processing. Outsourcing data processing therefore does not remove an agency’s obligation to ensure that appropriate data protection and security measures are in place.
The commission also urged the public to remain alert to phishing attempts, fraudulent messages, identity theft and other social engineering tactics that could exploit concerns about reported data breaches. It advised individuals to exercise caution when opening unfamiliar links, downloading attachments, responding to unsolicited communications or sharing personal and sensitive information.
The NPC said it continues to monitor the reported incidents and carry out its regulatory and enforcement responsibilities under the Data Privacy Act and related regulations. Further updates will be provided as appropriate, taking into account the progress of its assessments and ongoing regulatory proceedings.
