Ten Philippine agencies report data breaches to the privacy body

Ten Philippine agencies report data breaches to the privacy body

10 November 2026: Ten Philippine government bodies, among them the tax bureau, the securities regulator and the trade and ICT departments, have filed personal data breach notifications with the National Privacy Commission after leaks involving several agencies were reported on 5 November. The NPC is assessing each one and has made no finding yet.

Not yet independently verified. We read the NPC's two statements through its news feed, because the article pages answered with a bot check. The NPC has not said what leaked, how much or how, and has made no finding. We will update this when it can be confirmed, and remove this note.

Which agencies have notified

By Tuesday 10 November, the NPC said, notifications had come from:

• the Presidential Commission on Good Government (PCGG);
• the Department of Information and Communications Technology (DICT);
• the Department of Labor and Employment, Bureau of Local Employment;
• the Bureau of Internal Revenue (BIR);
• the Philippine Amusement and Gaming Corporation (PAGCOR);
• the Department of Justice, Office for Alternative Dispute Resolution;
• the Securities and Exchange Commission (SEC);
• the Philippine Coast Guard;
• the Department of Trade and Industry (DTI);
• DOST-PHIVOLCS, the volcanology and seismology institute.

Each notification goes to the NPC's Compliance and Monitoring Division, which assesses it and reports to the Commission sitting en banc. The commission's spokesperson on the matter is Deputy Privacy Commissioner Jose S. Belarmino II.

From no notifications to ten in four days

When the NPC first commented on 6 November, it said it was aware of the alleged leaks reported the day before but had received no notifications. It said it would verify the reports and require breach reports where warranted, and it was careful to add that reports of a leak do not, on their own, establish a breach or a violation of the Data Privacy Act. Four days later ten bodies had filed.

The 72-hour rule the NPC restated

The commission used the episode to remind every personal information controller, public or private, of NPC Circular 16-03. A controller must notify the commission and the people affected within 72 hours of knowing, or reasonably believing, that a notifiable breach has happened. The clock starts from that knowledge, not from the end of an internal investigation.

For companies that file with these agencies

Businesses submit tax returns to the BIR, registration and ownership records to the SEC, and permits and trade filings to the DTI, so their staff and officers may be among the people affected. The agencies, as controllers, owe notice to affected individuals under the same 72-hour rule. Until the NPC or the agencies say what was exposed, a company that files with them can at least warn finance and HR staff to expect phishing that uses tax or registration details, and check whether any notice has reached its officers.

Sources

• National Privacy Commission: NPC monitors personal data breach notifications from government agencies, 10 November 2026
• National Privacy Commission: Statement on reported data leaks involving government agencies, 6 November 2026