PhilippinesData Privacy Act of 2012, breach notification
Republic Act No. 10173 (2012), Section 20(f)
In force since .
A breach notification rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that is a personal information controller and reasonably believes that sensitive personal information or identity-fraud-enabling information of an individual in the Philippines has been acquired by an unauthorized person must promptly notify the National Privacy Commission and the affected individuals, where the controller or the Commission believes the acquisition is likely to give rise to a real risk of serious harm to an affected individual.
These lines are LexLint's reading of the law's text. Also read by: National Privacy Commission (NPC Circular 16-03, Personal Data Breach Management, ) (guidance, recorded ).
Who enforces it
Settledness
- As of
- Guidance link
- https://web.archive.org/web/2024if_/https://privacy.gov.ph/wp-content/uploads/2022/01/sgd-npc-circular-16-03-personal-data-breach-management.pdf
- Guidance body
- National Privacy Commission (NPC Circular 16-03, Personal Data Breach Management, )
- Open questions
- When is an unauthorized acquisition of sensitive personal information "likely to give rise to a real risk of serious harm" under Section 20(f), given that the text lets either "the personal information controller or the Commission" hold that belief?
What it makes you log
Logging duty
Section 20(f) requires a controller to notify the Commission and affected data subjects promptly when sensitive personal information or identity-fraud-enabling information is reasonably believed to have been acquired by an unauthorized person and the acquisition is likely to give rise to a real risk of serious harm, and lists what the notification describes. It does not tell the controller to keep a register of breaches. The monitoring and incident-response measures in Section 20(c), which this row does not cite, are security measures and not a record duty.
- Kind
- None
- As of
What this law does
Section 20(f) requires a personal information controller to promptly notify the National Privacy Commission and affected data subjects when sensitive personal information, or other information that may enable identity fraud, is reasonably believed to have been acquired by an unauthorized person, where the controller or the Commission believes the acquisition is likely to give rise to a real risk of serious harm. The Act itself sets no fixed numeric deadline.
Section 17(A) of NPC Circular 16-03 requires the Commission to be notified within seventy-two (72) hours upon knowledge of, or reasonable belief that, a personal data breach has occurred. Section 38(a) of the Implementing Rules and Regulations sets the same 72-hour period for notifying the Commission and affected data subjects.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .