With the public also reminded to remain vigilant regarding possible phishing attempts that may arise due to these incidents.
In a statement issued on Tuesday, 10 November 2026, the National Privacy Commission confirmed that it has received personal data breach notifications from ten several government agencies, which are the following:
- Presidential Commission on Good Government (PCGG)
- Department of Information and Communications Technology (DICT)
- Department of Labor and Employment (DOLE), through its Bureau of Local Employment
- Bureau of Internal Revenue (BIR)
- Philippine Amusement and Gaming Corporation (PAGCOR)
- Department of Justice (DOJ), through its Office for Alternative Dispute Resolution
- Securities and Exchange Commission (SEC)
- Philippine Coast Guard (PCG)
- Department of Trade and Industry (DTI)
- Department of Science and Technology – Philippine Institute of Volcanology and Seismology (DOST-PHIVOLCS).
NPC Deputy Privacy Commissioner and Spokesperson Atty. Jose Belarmino II sakd that that the submission of personal data breach notifications is an important component of the regulatory framework established under the Data Privacy Act of 2012.
Through which, the Commission will assess reported incidents and determine the appropriate regulatory response.
“The submission of personal data breach notifications is a regulatory requirement under NPC Circular No. 16-03, or the Personal Data Breach Management Circular, for incidents that meet the prescribed notification criteria,” he explained.
Each notification received by the NPC will then be reviewed and assessed by our Compliance and Monitoring Division, which examines the nature and circumstances of the reported incident, its potential impact on affected individuals, and the measures undertaken by the agency concerned.
“Following its assessment, the Division prepares a report containing its findings and recommendations for submission to the Commission En Banc, which determines the appropriate action or decision based on the circumstances of each case,” added Belarmino.
He then emphasized that the responsibility to protect personal data does not end with the submission of a breach notification to the NPC.
“Breach notification is only one part of an agency’s responsibility under the Data Privacy Act. Equally important is how the agency responds to the incident, protects the individuals who may be affected, and addresses the vulnerabilities that may have contributed to the breach,” the NPC Deputy Privacy Commissioner said. “Where the prescribed conditions for mandatory notification are met, affected data subjects must also be notified in accordance with the requirements and timelines set under the Circular.”
Thus, they expect government agencies to demonstrate accountability by having concrete and effective measures to safeguard personal data and prevent similar incidents from recurring.
The NPC also stressed that government agencies, as personal information controllers, remain accountable for the protection of personal data under their control or custody, even when the processing of such data is outsourced or subcontracted to third-party service providers.
“Under Section 21 of Republic Act No. 10173, or the Data Privacy Act of 2012, personal information controllers are responsible for personal information under their control or custody, including information transferred to third parties for processing,” the NPC emphasized in its statement.
Engagement of external service providers, meanwhile, also does not relieve government agencies of their obligation to ensure that appropriate data protection and security measures are implemented and maintained.
“The NPC reiterates that government agencies have a continuing obligation to implement reasonable and appropriate organizational, physical, and technical security measures to safeguard personal data. This responsibility includes maintaining effective incident response mechanisms, promptly addressing security incidents, and complying with applicable breach notification requirements,” the commission added.
In light of the situation, the public has been told to remain vigilant against possible phishing attempts, fraudulent messages, identity theft, and other forms of social engineering that may exploit concerns arising from reported data breaches.
“Individuals are advised to exercise caution when responding to unsolicited communications, accessing unfamiliar links, downloading attachments, or disclosing personal and sensitive personal information,” the NPC added.
It also assured that it continues to monitor the reported incidents and exercise its regulatory and enforcement functions, with further updates will be provided as appropriate.
