NPC Issuance Wiki

Clarification on the Submission of Personal Data Breach Notification through Data Breach Notification Management System (Advisory No. 2026-02)

Issued Advisory

Issuance Text

NPC Advisory No. 2026-02

DATE: 11 May 2026

SUBJECT: CLARIFICATION ON THE SUBMISSION OF PERSONAL DATA BREACH NOTIFICATION THROUGH DATA BREACH NOTIFICATION MANAGEMENT SYSTEM

SECTION 1. Scope and Purpose. This Advisory prescribes guidelines and clarifications for all Personal Information Controllers (PICs) with respect to personal data breach notification to the National Privacy Commission (NPC).

SECTION 2. Submission of Request. PICs seeking to request postponement, exemption, or the use of alternative means to notify data subjects, including requests for extension in the submission of required documents under NPC Circular No. 16-03 or the Personal Data Breach Management1 (NPC Circular No. 16-03), shall be guided by the following clarifications:

  • A. The PIC shall not simultaneously avail of: (1) a request for exemption to notify affected data subjects and a request for postponement of such notification; or (2) a request for exemption to notify affected data subjects and a request to use alternative means of notification, in relation to the same personal data breach incident.

    A request for postponement and a request to use alternative means of notification may, however, be availed of concurrently.

    Where a PIC invokes multiple mutually exclusive requests arising from the same personal data breach incident, such requests may be a ground for the denial of one or all such requests.

    For purposes of this Advisory, a personal data breach shall be treated as a single incident where it involves the same affected data subjects, the same personal data involved, and the same nature of the breach. A change in circumstance, including but not limited to change in the number of affected data subjects or the data elements involved, must be included in the full breach report. Nothing precludes the PIC from submitting any information or requests related to the aforementioned change in circumstances of the reported breach.

  • B. The PIC shall determine and clearly state the most appropriate grounds for the justification of its requests and shall submit corresponding supporting documents. The Commission shall assess such requests in accordance with NPC Circular No. 16-03, taking into account the supporting documents, as well as the facts and circumstances surrounding the personal data breach incident. With respect to requests for alternative means of notifying affected data subjects, nothing prevents the PIC from advising the stakeholders of the fact of the data breach or any other relevant information pending the approval of such request.

  • C. The submission of any request in relation to personal data breach notification to the Commission through the Data Breach Notification Management System (DBNMS) shall not relieve the PIC of its obligation pursuant to NPC Circular No. 16-03. Unless the request is acted upon by the Commission, the PIC shall submit its full breach report within five (5) days from the date of discovery to admindbnms@privacy.gov.ph with the subject FBR_NameofPIC_NameofDPO, as well as all other required submissions.

    The PIC may coordinate with the Compliance and Monitoring Division (CMD) of the NPC through compliancesupport@privacy.gov.ph as to questions and concerns regarding compliance, except questions on request for postponement, exemption, or the use of alternative means to notify the affected data subjects, including request for extension in the submission of required documents under the NPC Circular No. 16-03.

  • D. All approvals or resolutions of requests shall be expressly issued in writing by the Commission. The Commission’s inaction shall not be construed as an approval, implied consent, or automatic grant of any request submitted by the PIC, nor shall serve as a justification for noncompliance.

  • E. Noncompliance with the Data Privacy Act of 2012, its Implementing Rules and Regulations, or any Order, Resolution, or Decision of the Commission shall be subject to administrative fine pursuant to NPC Circular No. 2022-01 or the Guidelines on Administrative Fines.2

SECTION 3. Interpretation. Any doubt in the interpretation of any provision of this Advisory shall be liberally interpreted in a manner mindful of the rights and interests of data subjects.

Approved:

SGD.
ATTY. JOHANN CARLOS S. BARCENA, CESO III
Privacy Commissioner

SGD.
ATTY. JOSE AMELITO S. BELARMINO, MSc
Deputy Privacy Commissioner

SGD.
ATTY. JUAN PAOLO F. FAJARDO
Deputy Privacy Commissioner

Footnotes

  1. See: NPC Circular No. 16-03 Personal Data Breach Management dated 15 December 2016. ↩

  2. See: NPC Circular No. 2022-01 Guidelines on Administrative Fines dated 08 August 2022. ↩

Backlinks