NPC Issuance Wiki

Grant of Additional Period to Submit Annual Security Incident Reports for the Year 2025

Issued Advisory

Issuance Text

NPC Advisory No. 2026 - 03

DATE : 08 September 2026

SUBJECT : GRANT OF ADDITIONAL PERIOD TO SUBMIT ANNUAL SECURITY INCIDENT REPORTS FOR THE YEAR 2025

WHEREAS, Section 3(s) of the Implementing Rules and Regulations (IRR) of Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012, defines a “security incident” as an event or occurrence that affects or tends to affect data protection, or may compromise the availability, integrity, and confidentiality of personal data, including incidents that would result to a personal data breach if not for safeguards that have been put in place;

WHEREAS, Section 22 of NPC Circular No. 16-03, otherwise known as the Personal Data Breach Management, provides that all security incidents and personal data breaches shall be documented through written reports, including those not covered by the notification requirements, and that a summary of all reports shall be submitted to the Commission annually.1 As such, all Personal Information Controllers and Personal Information Processors were required to submit their Annual Security Incident Reports (2025 ASIRs) until 31 March 2026;2

WHEREAS, the National Privacy Commission (NPC) takes cognizance of the various requests from PICs and PIPs signifying their intention to submit their 2025 ASIRs beyond the prescribed deadline, and in view of their continued intent to comply with the annual reportorial requirement, and in furtherance of the NPC’s mandate to promote compliance with the DPA and its IRR, deems it reasonable to give due consideration to such requests;

WHEREAS, in consideration of these premises, the NPC hereby issues this Advisory granting PICs and PIPs an additional period to submit their 2025 ASIRs.

SECTION 1. Scope. This Advisory applies to all Personal Information Controllers (PICs) and Personal Information Processors (PIPs) covered under Rule I, Section 1 of NPC Circular No. 16-03 in relation to Section 4 of the Data Privacy Act of 2012 (DPA).

SECTION 2. Coverage This Advisory covers the submission of 2025 ASIRs for security incidents and personal data breaches encountered from 01 January 2025 to 31 December 2025.

SECTION 3. Extended Period for Submission of 2025 ASIRs The NPC hereby grants PICs and PIPs an additional period to submit their 2025 ASIRs. The period for the submission of 2025 ASIRs shall be reopened upon the issuance of this Advisory,3 and shall remain open until 10 November 2026.

SECTION 4. Contents of ASIRs The ASIR shall contain the required general information, including the number of incidents and personal data breaches encountered, classified according to their impact on the availability, integrity, or confidentiality of personal data, as applicable.4

SECTION 5. Manner of submission. All 2025 ASIRs shall be submitted exclusively through the Data Breach Notification Management System (DBNMS) online platform (https//dbnms.privacy.gov.ph). Submissions through electronic mail, personal filing, ordinary mail, licensed courier service, or any other mode outside the DBNMS shall not be considered valid submissions for purposes of compliance with this Advisory.5

SECTION 6. Submission in the Absence of Security Incidents. All PICs and PIPs required to submit an ASIR shall do so regardless of whether any security incident or personal data breach occurred during the applicable reporting period. Where no security incident or personal data breach occurred, the PIC or PIP shall indicate zero (0) incident in the appropriate portion of the ASIR.

SECTION 7. Failure to Submit ASIR. Failure to submit the required 2025 ASIR on or before 10 November 2026 may subject the concerned PIC or PIP to appropriate administrative sanctions under the DPA, its IRR, NPC Circular No. 2022-01, otherwise known as the Guidelines on Administrative Fines,6 and other related issuances of the NPC.

The grant of the additional period under this Advisory shall not be construed as a waiver of the NPC’s authority to enforce compliance with the annual reportorial requirement or to impose appropriate sanctions for non-compliance after the expiration of the additional period.

SECTION 8. Interpretation. Any doubt in the interpretation or application of any provision of this Advisory shall be resolved in a manner consistent with the provisions and objectives of the DPA, its IRR, and applicable issuances of the NPC, with due regard to the rights and interests of data subjects and the NPC’s mandate to promote and ensure compliance with data privacy and protection requirements.

Approved:

SGD.
ATTY. JOHANN CARLOS S. BARCENA, CESO III
Privacy Commissioner

SGD.
ATTY. JOSE AMELITO S. BELARMINO, MSc
Deputy Privacy Commissioner

SGD.
ATTY. JUAN PAOLO F. FAJARDO
Deputy Privacy Commissioner

Footnotes

  1. NPC Circular No. 16-03, Personal Data Breach Management dated 15 December 2016, Section 22. See also Implementing Rules and Regulations of Republic Act No. 10173, Data Privacy Act of 2012, Section 41. ↩

  2. National Privacy Commission Announcement on Submission of 2025 Annual Security Incident Report, available at https://privacy.gov.ph/ (last accessed 17 August 2026). ↩

  3. For purposes of this Advisory, the date of issuance shall refer to the date of its publication in the official website and social media accounts of the National Privacy Commission. ↩

  4. NPC Circular No. 16-03, Personal Data Breach Management dated 15 December 2016, Section 22. ↩

  5. Announcement regarding the Submission of Personal Data Breach Notifications (PDBN) and Annual Security Incident Reports (ASIR) dated 14 October 2022, available at https://privacy.gov.ph/announcement-regarding-the-submission-of-personal-data-breach-notifications-pdbn-and-annual-security-incident-reports-asir-2/ (last accessed 17 August 2026). ↩

  6. NPC Circular No. 2022-01, Guidelines on Administrative Fines dated 08 August 2022. ↩

Backlinks