Text
18 May 2026
Re: Scope of Accountability and Registration of the Governance Levels in Security Incident and Personal Data Breach Reporting
Dear [Redacted],
Greetings from the National Privacy Commission!
This pertains to your request for clarification on the scope of accountability of the different governance levels of the [Redacted] in relation to registration, security incident reporting, and personal data breach notification under Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012, its Implementing Rules and Regulations, and NPC Circular No. 2022-04.
Based on your letter, [Redacted] current organizational levels consist of the Central Office (CO), Regional Offices, Schools Division Offices, and individual schools, following the reorganization under Republic Act No. 9155 and the modification introduced by [Redacted] Order No. 52, s. 2015. [Redacted] has registered its Personal Data Processing System, Notification Regarding Automated Decision-Making, Designation of Data Protection Officer, and application for the NPC Seal of Registration at the CO level under NPC Circular No. 2022-04.
You now seek clarification in view of the FAQ on the NPC website stating that a government-funded school under a [Redacted] need not register individually. Specifically, you ask:
(1) At which organizational level or levels should registration as a separate and distinct PIC be done, considering [Redacted] governance structure?
(2) What is the scope of [Redacted] registration under NPC Circular No. 2022-04? Should only the CO monitor and report security incidents for all levels, or should each level register separately?
(3) For last mile schools with minimal personnel and limited resources, is separate registration necessary, and if so, may the NPC waive registration fees?
Discussion
Personal information controller; Control over the processing of personal data
The determination of whether a [Redacted] governance level should be treated as a separate Personal Information Controller (PIC) depends not on its place in the organizational chart, but on whether it controls the processing of personal data, that is, whether it decides what information is collected, or the purpose or extent of its processing.1 A unit, office, or school that processes personal data pursuant to [Redacted] centrally determined policies, systems, and mandates does not, by that fact alone, become a separate PIC. Conversely, a governance level that independently determines the purpose, scope, or means of a specific processing activity may be a PIC with respect to that activity.
Governance levels; Registration should reflect actual control and processing operations
NPC Circular No. 2022-04 requires the registration of PICs and Personal Information Processors (PIPs) that meet the conditions for mandatory registration. Section 5 of the Circular provides that a PIC or PIP that employs two hundred fifty (250) or more persons, processes sensitive personal information of one thousand (1,000) or more individuals, or processes data that will likely pose a risk to the rights and freedoms of data subjects, shall register all Data Processing Systems.2
For an agency such as [Redacted] which has a nationwide and multi-level governance structure, registration should be understood in relation to the data processing systems and processing operations under its control. If the Central Office determines the purposes, systems, policies, and general means of processing for [Redacted] wide personal data processing activities, and the Regional Offices, Schools Division Offices, and schools process personal data pursuant to such centrally determined framework, registration at the Central Office level may be appropriate, provided that the registration accurately reflects the relevant Data Processing Systems and the organizational units involved in their implementation.
This means that a centralized registration should not be merely nominal. It should be supported by a proper inventory of [Redacted] data processing systems, including those implemented or used at the Regional Office, Schools Division Office, and school levels. It should identify the categories of data subjects, categories of personal data processed, purposes of processing, systems or repositories used, recipients or processors involved, retention periods, security measures, and the internal reporting and escalation mechanisms for security incidents and personal data breaches.
At the same time, there may be processing activities where a Regional Office, Schools Division Office, or another [Redacted] governance level exercises sufficient independent control over the purpose or extent of processing. In such cases, [Redacted] should determine whether such processing activity should be separately registered, or at least separately reflected as a distinct data processing system under the appropriate [Redacted] registrant, depending on the actual governance, control, and implementation arrangements.
Public schools; Individual school registration not automatically required
The FAQ cited in your request states that a government-funded school under the [Redacted] is not required to register separately or designate a distinct DPO, and that the entire Schools Division should register collectively as the PIC and appoint a single DPO to oversee compliance and data protection efforts.
This guidance should be read consistently with the DPA’s definition of a PIC and the actual governance arrangement for the relevant data processing system. The FAQ addresses the specific case of individual government-funded schools under a [Redacted] and clarifies that such schools need not register separately. It should not be read as precluding [Redacted] from adopting a centralized registration for [Redacted]-wide data processing systems controlled by the Central Office, or from reflecting Schools Division-level processing where the Schools Division Office exercises control over the relevant processing activity. Individual public schools are not required to register separately merely because they process personal data in the performance of public education functions. School-level processing of learner information, parent or guardian information, personnel records, enrollment records, attendance records, academic records, health-related school forms, incident reports, and related administrative documents is ordinarily carried out pursuant to [Redacted] education mandate, policies, official forms, reporting requirements, and governance framework.
Thus, where a public school processes personal data under the control, instruction, supervision, or governance framework of [Redacted] the concerned Regional Office, or the Schools Division Office, the school does not become a separate PIC solely by reason of such processing. The same applies to last mile schools that have minimal personnel and limited funds and resources. The DPA does not require every individual public school to register separately solely because it handles personal data in the ordinary course of school administration.
However, the absence of separate school-level registration does not mean the absence of school-level accountability measures. [Redacted] should ensure that schools are covered by its privacy governance framework and are provided with practical, proportionate, and resource-sensitive procedures for handling personal data, securing records, providing privacy notices where appropriate, limiting access to authorized personnel, retaining and disposing of records properly, and escalating security incidents or suspected personal data breaches to the appropriate DPO, deputy DPO, compliance officer for privacy, or privacy focal person.
DPO structure; Centralized accountability and delegated privacy functions
The DPA and its IRR require PICs and PIPs to designate an individual or individuals accountable for compliance with the Act.3 NPC Circular No. 2022-04 likewise requires the designation of a DPO as part of the registration framework.4 In a large government agency such as [Redacted] the designation of a primary DPO at the Central Office may be accompanied by the designation of deputy DPOs, Compliance Officers for Privacy (COPs), or privacy focal persons at the Regional Office, Schools Division Office, or school level, as may be necessary to operationalize compliance.
The designation of deputy DPOs, COPs, or privacy focal persons does not, by itself, make the office or school to which they are assigned a separate PIC. Rather, it may serve as an accountability mechanism to ensure that privacy compliance is implemented effectively across [Redacted] governance levels. Such personnel may assist in maintaining data inventories, coordinating privacy notices, supporting security measures, receiving and escalating incident reports, and coordinating with the Central Office DPO or other authorized privacy personnel.
Considering the nature and volume of personal data processed by [Redacted], including learner information and other sensitive personal information processed in the education sector, [Redacted] is advised to document its privacy governance structure and, where it utilizes COPs or privacy focal persons especially at the school level, to inform the NPC through the Compliance and Monitoring Division (CMD). This will assist the Commission in properly noting [Redacted] internal accountability and escalation framework in the context of future compliance checks, investigations, or related regulatory engagements.
Security incident reporting; Personal data breach notification; Annual Security Incident Report
Registration and incident reporting are related but distinct compliance obligations. Registration under NPC Circular No. 2022-04 concerns the registration of the PIC or PIP, its DPO, and its Data Processing Systems when the applicable thresholds or conditions are met. Security incident and personal data breach reporting, on the other hand, concerns the identification, assessment, documentation, escalation, and, when required, notification of security incidents and personal data breaches.
Under NPC Circular No. 16-03, a personal data breach refers to a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed.5 The Circular requires notification to the NPC and affected data subjects when the breach involves sensitive personal information or any other information that may, under the circumstances, be used to enable identity fraud, when there is reason to believe that the information may have been acquired by an unauthorized person, and when the PIC or the NPC believes that the unauthorized acquisition is likely to give rise to a real risk of serious harm to the affected data subject.6 Where a breach is determined to be notifiable, [Redacted] should ensure that notification is made within the period and in the manner required under NPC Circular No. 16-03 and applicable NPC procedures.7
If [Redacted] adopts a centralized registration and accountability model, the Central Office DPO may coordinate and submit breach notifications and the Annual Security Incident Report for [Redacted], provided that Regional Offices, Schools Division Offices, and schools are subject to clear and enforceable internal reporting and escalation protocols. These protocols should require the prompt reporting of actual or suspected security incidents to the designated privacy personnel, so that the appropriate office can assess whether the incident is notifiable and whether affected data subjects must be notified.
If [Redacted] adopts a federated or hybrid model, the initial detection, documentation, and containment of incidents may occur at the school, Schools Division Office, or Regional Office level. However, [Redacted] should ensure that such model does not result in delayed escalation, inconsistent breach assessment, fragmented documentation, or duplicate and conflicting reports to the NPC. The internal structure should identify who receives incident reports, who validates the facts, who determines whether a breach is notifiable, who submits the report to the NPC, who communicates with affected data subjects, and who maintains the incident register and supporting documentation.
In all cases, breach reporting remains an obligation of the PIC responsible for the processing activity. Thus, even where initial incident detection, containment, or documentation is performed by a school, Schools Division Office, or Regional Office, [Redacted] governance framework should ensure that the incident is timely escalated to the DPO or other authorized personnel with access to, or responsibility for, the NPC Data Breach Notification Management System (DBNMS). This is particularly important where access to the DBNMS is lodged with the DPO, as delayed internal escalation may affect the PIC’s ability to comply with the period and manner of notification required under NPC Circular No. 16-03.
The Annual Security Incident Report should likewise be prepared based on the security incidents known to and documented by the relevant [Redacted] offices within the reporting period. Where [Redacted] uses a centralized submission, the Central Office DPO should ensure that incident data from Regional Offices, Schools Division Offices, and schools is collected in a timely and standardized manner.
Registration fees; Last mile schools; Exemption or waiver
As regards registration fees, the obligation to pay registration fees depends on whether a PIC or PIP is required to register, or voluntarily registers, under the applicable NPC issuances on registration and fees. Questions involving the assessment, payment, exemption, or possible waiver of registration fees are operational matters relating to NPCRS registration and may be raised by [Redacted] with the Compliance and Monitoring Division (CMD), which handles registration matters. For purposes of this Advisory Opinion, the relevant point is that where an individual public school is not independently required to register because its processing activities are covered under [Redacted] registration or under the appropriate [Redacted] governance level, no separate registration fee should arise from that school merely because it processes personal data in the ordinary course of school operations.
For last mile schools with minimal personnel and limited resources, the more appropriate compliance approach is generally not to require separate school-level registration, unless the school independently controls a data processing system or activity that meets the applicable registration criteria. Instead, such schools should be brought within [Redacted] documented privacy governance, registration, data inventory, and incident reporting framework, with practical and proportionate measures appropriate to their context.
If a [Redacted], governance level, or school determines that it is not covered by mandatory registration, it should evaluate whether the submission of a Sworn Declaration and Undertaking for exemption is required under the applicable NPCRS procedures and NPC issuances.
Accountability; Registration is not a substitute for governance
The Commission emphasizes that registration is not the source of accountability under the DPA. Accountability arises from control over the processing of personal data and from the obligation of the PIC or PIP to comply with the DPA, its IRR, and relevant NPC issuances. Regardless of the registration structure [Redacted] adopts, it should demonstrate that its Data Processing Systems are properly identified; that the roles of the CO, Regional Offices, Schools Division Offices, and schools are clearly defined; that security incident and breach reporting procedures are operational; and that organizational, technical, and physical security measures are implemented across all governance levels.
Accordingly, the answers to your queries are as follows:
(1) Registration is determined by which [Redacted] or governance level controls the relevant personal data processing activity. A separate governance level, field office, or school does not automatically become a separate PIC merely because it processes personal data. Where the CO controls [Redacted]-wide Data Processing Systems and the other governance levels process data pursuant to centrally determined policies and mandates, a centralized CO-level registration is appropriate. Where a Regional Office, Schools Division Office, or other governance level independently controls a particular processing activity, that activity should be separately registered or distinctly reflected in the appropriate registration.
(2) The scope of [Redacted] registration under NPC Circular No. 2022-04 extends to all Data Processing Systems under the CO’s control, including those implemented at lower governance levels. For security incident and personal data breach reporting, the CO DPO may coordinate and submit breach notifications and the Annual Security Incident Report for [Redacted] under a centralized model, or initial incident handling may occur at lower governance levels under a federated or hybrid model. Under either model, [Redacted] must maintain clear, enforceable escalation protocols that prevent delayed reporting, inconsistent breach assessment, or conflicting submissions to the NPC.
(3) Individual public schools, including last mile schools, are not required to register separately solely because they process personal data in the performance of public education functions. They must, however, be covered by [Redacted] privacy governance framework and follow proportionate school-level procedures for data handling, security, access control, incident reporting, and breach escalation. Where separate school-level registration is not required, no separate registration fee arises merely because a school is part of [Redacted] internal governance structure. Questions involving the assessment, exemption, or possible waiver of registration fees for any independently covered office or governance level may be raised by [Redacted] separately with the CMD, which handles NPCRS registration matters.
Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.
For your reference.
Very truly yours,
(Sgd.)
VIDA ZORA G. BOCAR
OIC-Director IV, Privacy Policy Office8
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, § 3(h) (2012). ↩
-
National Privacy Commission, Registration of Personal Data Processing Systems, Notification Regarding Automated Decision-Making or Profiling, Designation of Data Protection Officer, and the National Privacy Commission Seal of Registration, NPC Circular No. 2022-04, § 5 (Dec. 5, 2022). ↩
-
Data Privacy Act of 2012, § 21; IRR, rule VI, § 26. ↩
-
NPC Circular No. 2022-04, §§ 6-7. ↩
-
National Privacy Commission, Personal Data Breach Management, NPC Circular No. 16-03, § 3(A) (Dec. 15, 2016). ↩
-
Id. § 11. ↩
-
Id. §§ 17-18. ↩
-
National Privacy Commission Special Order No. 095, s. 2025. ↩