Cybersecurity Checklist for Philippine Businesses: Business Security Guide | CyberCode

Direct Answer

The strongest cybersecurity checklist for a Philippine SME is not a foreign best-practice list. It is the eighteen security measures enumerated in Rule VI of the Data Privacy Act’s Implementing Rules and Regulations — six organizational, five physical and seven technical — because those are the only security controls a Philippine regulator can actually fine you for missing. Rule VI, Section 29 then scales them to your size. Layer NIST Cybersecurity Framework 2.0 on top for structure, and the National Privacy Commission’s own pre-incident expectations for readiness.

This page is the checklist itself, built from the statute and the rules rather than from someone else’s tip list. It sits above Cybercode’s narrower checklists for websites, cloud services, vendors and SaaS and incident response, and beneath the Cybersecurity in the Philippines hub.

Key Takeaways

• Philippine law does name specific security measures. Rule VI of the IRR of Republic Act No. 10173 enumerates eighteen of them across Sections 26, 27 and 28. Most SME checklists on the internet do not mention a single one.
• Being small changes the standard, not the duty. Section 29 judges adequacy partly on “the size of the organization and complexity of its operations” and on the cost of implementation. It does not exempt anyone.
• The one encryption figure a Philippine regulator actually names is AES-256. The National Privacy Commission’s own data-security page calls it “the most appropriate encryption standard.” No statute mandates it.
• Failure to implement reasonable security measures is a major infraction under NPC Circular 2022-01, priced at 0.25% to 2% of the previous year’s annual gross income.
• NIST Cybersecurity Framework 2.0 is a voluntary United States framework. It is excellent structure and it is not Philippine law. No Philippine statute or regulator issuance requires it.
• The NPC publishes what it expects you to have before an incident — a security incident management policy, a response team, assessments, vulnerability scanning and staff training. That list is a checklist in its own right.
• If you are supervised by the Bangko Sentral ng Pilipinas, your clock is two hours, not seventy-two. Everyone else can ignore that row.

Jump to a Section

• Decision snapshot
• The eighteen measures the rules actually name
• Why being an SME changes the standard, not the duty
• The minimum practical setup: essential, recommended, advanced
• The NIST CSF 2.0 backbone
• What the NPC expects you to have before an incident
• Encryption: the one number a Philippine regulator names
• If you are building or buying a system
• Do you have to register with the NPC?
• What it costs to get this wrong
• If you are a BSP-supervised institution
• The clocks that start the moment you know
• Where to report, and the contacts that are actually published
• Six worked SME scenarios
• Ten mistakes that show up in real SMEs
• Which Cybercode checklist do you actually need?
• Frequently asked questions
• Verification log
• Official sources

Decision Snapshot

The Eighteen Measures the Rules Actually Name

Nearly every SME cybersecurity checklist in circulation is somebody’s opinion about good practice. Philippine law is more specific than that. Rule VI of the Implementing Rules and Regulations of Republic Act No. 10173 enumerates eighteen security measures — six organizational in Section 26, five physical in Section 27, and seven technical in Section 28 — sitting under the umbrella duty in Section 25.

Section 25 is the umbrella duty. Personal information controllers and processors “shall implement reasonable and appropriate organizational, physical, and technical security measures for the protection of personal data.” Everything below is the enumeration of what those three words mean.

This is the checklist. Work down it. The third column is the SME translation, which is Cybercode’s reading, not the text of the rule.

Organizational measures — IRR Rule VI, Section 26 (six items)

Physical measures — IRR Rule VI, Section 27 (five items)

These are the five most commonly skipped items on the list, because SME checklists written for a purely cloud-based world tend to ignore the office entirely. The rule does not.

Technical measures — IRR Rule VI, Section 28 (seven items)

Why this matters more than a generic list: if the National Privacy Commission ever asks a Philippine SME to account for its security, these are the headings the answer will be measured against. A checklist organised any other way forces you to translate under pressure.

Why Being an SME Changes the Standard, Not the Duty

Philippine data privacy law has no small-business exemption from security obligations. What it has instead is a proportionality test, and that test is written into the rules in two places.

IRR Rule VI, Section 29 judges whether the level of security is appropriate on five factors: the nature of the personal data to be protected, the risks posed by the processing, the size of the organization and the complexity of its operations, current data privacy best practices, and the cost of security implementation. Measures are also “subject to regular review and updating.”

Republic Act No. 10173, Section 20(c) says the same thing at statutory level. The determination of the appropriate level of security “must take into account the nature of the personal information to be protected, the risks represented by the processing, the size of the organization and complexity of its operations, current data privacy best practices and the cost of security implementation.”

The National Privacy Commission’s own data-security page puts it a third way, describing a comprehensive information security program as one appropriate to “the size, scope and type of operations of the agency obligated to secure the personal data” and to “the amount of resources available to such person.”

Read that as a small business should read it. Three published sources agree that cost and headcount are legitimate inputs into what is adequate. None of them says a small business may skip the eighteen measures. The practical consequence is that an SME is expected to implement all eighteen at a scale its resources allow — a one-page policy rather than a policy suite, a spreadsheet rather than a governance platform, a named owner rather than a department. Doing something small and documented is defensible. Doing nothing is not.

That is also the honest answer to the question this page is built on. The best cybersecurity checklist for a Philippine SME is not the longest one. It is the one whose every line maps to a duty a Philippine regulator can actually name.

The Minimum Practical Setup: Essential, Recommended, Advanced

The eighteen measures tell you what must exist. They do not tell you what to do first on a Monday morning with no budget. This is the sequencing Cybercode recommends for a Philippine SME, and the ordering is editorial judgement rather than a legal requirement.

Essential — do these first, this week

1. Turn on multi-factor authentication on company email, the domain registrar, website hosting, cloud storage, online banking, payment processors, accounting software, social accounts and every administrator login. This is IRR Section 28(b) in one action.
2. Give every person their own account. Shared logins make 26(a) accountability and 26(d) offboarding impossible. Remove access the day someone leaves.
3. Approve a password manager and stop reuse across business systems.
4. Set up a backup you have actually restored from once. Keep at least one copy that ordinary employee devices cannot continuously write to. Untested backups fail Section 28(e).
5. Patch what you run — operating systems, browsers, office software, routers, the website, its theme and its plugins. Remove software no longer supported or used.
6. Write down who to call. One page: who can disable an account, who can take the website offline, who talks to the bank, where the backups are, who assesses notification.
7. Name your Data Protection Officer in writing. IRR Section 26(a).

Recommended — the next month

1. Build the processing inventory required by Section 26(c). One spreadsheet is enough to start.
2. Turn on device encryption where the operating system offers it, and check that transfers use HTTPS. Section 28(g).
3. Run phishing awareness for staff, focused on payment-detail changes and fake login pages. See employee phishing awareness and simulation practice.
4. Put processing agreements in place with your payroll, hosting, support and marketing providers. Section 26(f).
5. Write the security policy and the data protection policy — Sections 28(a) and 26(b). They are two documents in the rules, and they may sensibly be two sections of one document in a small firm.
6. Deal with the office. Work through the five physical measures in Section 27. Most firms find three gaps in ten minutes.
7. Turn on sign-in alerts and read them. Section 28(d).

Advanced — when resources allow

1. A documented annual test and review with written findings. Section 28(f).
2. A privacy impact assessment for any new system that touches personal data. See the PIA guide.
3. Vulnerability scanning and breach monitoring, which the NPC names among its pre-incident expectations.
4. Least-privilege review on a schedule, and segmentation between the finance machine and everything else.
5. Move toward a Zero Trust posture if the business is fully cloud-based. See Zero Trust for small businesses.

A note on honesty: none of this eliminates risk. Every item above reduces the likelihood or the impact of a compromise. A business that completes the entire list can still be breached, and the point of the response sections below is that this is a foreseeable outcome rather than a surprise.

The NIST CSF 2.0 Backbone

NIST Cybersecurity Framework 2.0 is a voluntary United States framework. It is not Philippine law, and no Philippine statute or regulator issuance located requires its adoption. That caveat is not a reason to ignore it. It is the clearest published structure for organising the eighteen measures into a programme, and it is free.

Published as NIST CSWP 29 on 26 February 2024, CSF 2.0 has six Functions. These are the descriptions as NIST writes them:

The mapping in the third column is Cybercode’s, not NIST’s and not the NPC’s. No Philippine issuance cross-walks the IRR to CSF 2.0. It is offered because an SME that has adopted one of the two frameworks should not have to start again to satisfy the other.

The Categories that matter once something goes wrong

CSF 2.0’s RESPOND Function has four Categories and RECOVER has two, again in NIST’s own words:

• RS.MA Incident Management — “Responses to detected cybersecurity incidents are managed.”
• RS.AN Incident Analysis — “Investigations are conducted to ensure effective response and support forensics and recovery activities.”
• RS.CO Incident Response Reporting and Communication — “Response activities are coordinated with internal and external stakeholders as required by laws, regulations, or policies.”
• RS.MI Incident Mitigation — “Activities are performed to prevent expansion of an event and mitigate its effects.”
• RC.RP Incident Recovery Plan Execution — “Restoration activities are performed to ensure operational availability of systems and services affected by cybersecurity incidents.”
• RC.CO Incident Recovery Communication — “Restoration activities are coordinated with internal and external parties.”

RS.CO is the Category that does real work in a Philippine context, because it is the one that expressly conditions coordination on what laws, regulations or policies require. For a Philippine SME, that is where NPC breach notification, a bank’s contractual notice terms and any sector rule all attach. The framework leaves the deadline blank; Philippine law fills it in. The breach reporting guide sets out the procedure.

What the NPC Expects You to Have Before an Incident

Most breach guidance starts at the moment of discovery. The National Privacy Commission also publishes what it expects an organisation to have in place beforehand, and that list is a readiness checklist in its own right. It appears on the Commission’s page on exercising breach reporting procedures, an informational page dated 12 February 2022 — not an issuance, and it should be cited as such.

The same page quotes the policy requirement for a “Procedure for the regular review of policies and procedures, including the testing, assessment, and evaluation.” That is the same obligation as IRR Section 28(f), stated by the regulator in its own words.

The two structural requirements in Circular 16-03

NPC Circular 16-03, dated 15 December 2016 and still in force, adds two things an SME can put in place in an afternoon.

• Section 4 requires a security incident management policy that includes, among other things, creation of a data breach response team, organizational, physical and technical security measures, an incident response procedure, mitigation of possible harm, and compliance with the Act, its IRR and all related issuances.
• Section 5 requires the team itself, with a specific characteristic. A controller or processor “shall constitute a data breach response team, which shall have at least one (1) member with the authority to make immediate decisions regarding critical action.” Read that carefully if you are an SME: the rule is not satisfied by a team that has to wait for the owner to land from a flight. Somebody available must be able to decide.

Section 22 adds the documentation duty. “All security incidents and personal data breaches shall be documented through written reports,” and a summary of all reports goes to the Commission annually. This includes the incidents you decide are not notifiable. A decision that an incident did not meet the notification criteria is itself something to write down, and it is the single most commonly missed obligation in a small organisation.

On the annual report: NPC Advisory No. 2026-03, dated 8 September 2026, reopened the submission period for 2025 Annual Security Incident Reports with a new deadline of 10 November 2026, and all 2025 ASIRs must be submitted exclusively through the DBNMS online platform. It does not change any breach clock. See the DBNMS guide.

Encryption: the One Number a Philippine Regulator Names

IRR Rule VI, Section 28(g) enumerates “encryption of personal data during storage and while in transit” as a technical security measure. It names no algorithm and no key length. That gap is where most SME guidance either invents a figure or stays silent.

The National Privacy Commission fills it on its own data-security page, which describes “Advanced Encryption Standard with a key size of 256 bits (AES-256) as the most appropriate encryption standard.”

Three qualifications, and they matter. First, that page is an informational NPC page, last modified 12 February 2022 — it cites no circular or advisory number, and Cybercode located none behind it. Second, it is therefore a regulator recommendation, not a statutory or regulatory mandate; the enumerated duty is to encrypt, not specifically to use AES-256. Third, it is nonetheless the clearest published figure a Philippine SME has, and adopting it is the cheapest way to show the choice was not arbitrary.

The same page names “Authentication, authorization, audit, and access approval” as “the common aspects of access control policy” — a useful four-part frame for writing the access section of an SME policy, and one that maps directly onto IRR Section 28(b).

What this means in practice for an SME: switch on full-disk encryption where the operating system provides it, confirm your website and any customer portal is served over HTTPS, prefer cloud services that encrypt at rest by default, and stop keeping customer lists in unprotected spreadsheets on shared drives. None of that requires a purchase.

If You Are Building or Buying a System

NPC Advisory No. 2025-02, dated 27 August 2025, on Privacy Engineering in Systems Life Cycle Processes, is the closest thing the Philippines has to a build-stage privacy and security checklist. It applies to all controllers and processors processing personal data through data processing systems, and it defines privacy engineering as “the integration of privacy concerns into engineering practices for systems and software engineering life cycle processes.”

It does not mention artificial intelligence anywhere, and should not be cited as an AI instrument. It applies to AI systems only because they are data processing systems.

Do You Have to Register with the NPC?

Not every SME does. NPC Circular 2022-04, dated 5 December 2022, sets the thresholds. Registration is required where the organisation has 250 or more employees, or processes sensitive personal information of 1,000 or more individuals, or where the processing is likely to pose a risk to the rights and freedoms of data subjects, or involves automated decision-making or profiling, or where processing is not occasional.

Two traps for small businesses. Automated decision-making or profiling triggers registration always, regardless of headcount — so a twelve-person lender running an automated scoring rule is in scope. And “not occasional” processing catches ordinary continuous operations; a shop with a customer database is not processing occasionally.

The mechanics: file within 20 days of commencing the covered processing, report minor updates within 10 days and major amendments within 30 days, registration is valid for one year, and renewal falls in the 30 days before expiry.

Registration is a separate duty from security. Falling below the thresholds does not reduce the eighteen measures by one item. See the RA 10173 compliance guide.

What It Costs to Get This Wrong

An SME can be fined for weak security without any breach occurring at all. This is the part of the picture that generic checklists omit, and it is the reason the eighteen measures are worth working through rather than skimming.

NPC Circular 2022-01, dated 8 August 2022, classifies “failure to implement reasonable security measures” as a major infraction. So is failure to ensure third parties implement security measures, and so is failure to notify regarding data breaches unless the conduct is criminally punishable.

The cap: “the total imposable fine for a single act of a PIC or PIP … shall not exceed Five Million Pesos (Php 5,000,000.00).”

Why the percentage base matters to an SME specifically. The fine is a share of annual gross income, not a flat figure, so it scales with the business — which cuts both ways. A small firm faces a smaller absolute number than a conglomerate for the same infraction. But 2% of gross income is not 2% of profit, and for a low-margin SME that can exceed a year’s earnings. The figure is not survivable simply because the business is small.

The criminal provision that reaches a person, not a company

Republic Act No. 10173, Section 30 punishes concealment of security breaches involving sensitive personal information with imprisonment of one year and six months to five years and a fine of ₱500,000 to ₱1,000,000, imposed on persons who, after having knowledge of a security breach and of the obligation to notify the Commission under Section 20(f), “intentionally or by omission conceals the fact of such security breach.”

Three features make this the provision an SME owner should read twice. It reaches natural persons, not just the company. It can be satisfied by omission — saying nothing is enough. And it requires knowledge of both the breach and the duty, which is precisely why reading a page like this one removes the easiest defence. The Data Privacy Act guide sets out the full penalty schedule.

Separately, the criminal penalties in Chapter VIII of RA 10173 include, for negligent access, 1 to 3 years and ₱500,000 to ₱2,000,000 for personal information and 3 to 6 years and ₱500,000 to ₱4,000,000 for sensitive personal information. Where the personal information of at least 100 persons is involved, the maximum penalty applies.

If You Are a BSP-Supervised Institution

This section applies only to institutions supervised by the Bangko Sentral ng Pilipinas. If you are an ordinary SME — a shop, an agency, a clinic, a software firm — it does not apply to you, and you can skip to the next section without missing an obligation.

For those it does cover, Section 148 of the Manual of Regulations for Banks sets an information technology risk management framework with four components: IT governance, risk identification and assessment, implementation of IT controls, and risk measurement and monitoring. The board is “ultimately responsible for understanding the IT risks confronted by a BSFI”; senior management is “accountable for designing and implementing the ITRMS approved by the board.”

The clock is the point. MORB Section 148 requires notification to the Bangko Sentral within two hours of discovering a reportable major cyber-related incident, with a follow-up report within twenty-four hours. Most published Philippine incident guidance treats 72 hours as the national standard. For a supervised institution that is wrong by a factor of thirty-six.

The Clocks That Start the Moment You Know

A prevention checklist is incomplete if the reader does not know what happens the moment prevention fails. These are the five clocks on file, each from its own instrument.

Both 72-hour clocks run from the same moment — knowledge of, or reasonable belief in, the breach. They are not sequential.

Two hard stops on delay. Section 17(B) permits delay only to determine the scope of the breach, prevent further disclosures or restore reasonable integrity to the system — and then states: “There shall be no delay in the notification if the breach involves at least one hundred (100) data subjects, or the disclosure of sensitive personal information.”

Notification is not automatic. Circular 16-03 Section 11 sets a three-part test, and all three limbs must be satisfied: the breach involves sensitive personal information or information that may be used to enable identity fraud; there is reason to believe the information may have been acquired by an unauthorised person; and the unauthorised acquisition is likely to give rise to a real risk of serious harm to any affected data subject. Work through it with the step-by-step breach reporting guide.

Where to Report, and the Contacts That Are Actually Published

Pick the channel by what happened. A technical incident, a reportable personal-data breach and a criminal complaint are three different things, and one report does not substitute for another.

CERT-PH contact details, as published on its own page

This is the one Philippine cyber-incident channel whose contact details Cybercode has been able to read from a government host. Read on 28 September 2026 and confirmed on a second narrow read:

• Landline: (632) 920-0101 local 1708
• Mobile: 0916-4894-613 — published as SMS only
• Address: Cybersecurity Bureau Building, #49 Don A. Roces, Brgy Paligsahan, Quezon City
• The page also publishes an email address and a downloadable “CERT-PH Incident Reporting and Technical Assistance Request Guidelines” document. The email address is obscured to automated readers, so Cybercode does not reproduce it — take it from the page itself.

What could not be verified, stated plainly. The Cybercrime Investigation and Coordinating Center’s own site returns an error to this review, so no CICC contact detail is published on this page. The PNP Anti-Cybercrime Group’s site publishes operational news but no hotline, email or address. Hotline 1326 is described in a Philippine Information Agency news release dated 31 December 2025 as the government’s 24/7 central number for reporting online scams — that is a government news report of a service, not an issuance, and not a substitute for a formal report. Before acting on any of this, confirm the current channel on the agency’s own page. The agency directory and the CICC explainer carry the detail.

Six Worked SME Scenarios

Each of these is the shape of a real small-business situation. The analysis is Cybercode’s application of the provisions cited above.

1. A twelve-person marketing agency shares one administrator login for its client social accounts

Which measures are in play: IRR Section 26(a) accountability, 26(d) human resources, 28(b) safeguards against unauthorised usage. Why it fails: a shared login makes it impossible to say who did what, and impossible to remove one person’s access when they leave without disrupting everyone. The fix costs nothing: individual accounts, multi-factor authentication, and a documented offboarding step. Note the exposure: if a former contractor later misuses that access, the agency’s own control failure is on the record, and failure to implement reasonable security measures is a major infraction in its own right.

2. A dental clinic keeps patient records on one unencrypted laptop that goes home each night

Health information is sensitive personal information, which raises the stakes on every clock and every penalty tier. Which measures are in play: Section 27(d) on transfer and removal of electronic media, Section 28(g) on encryption during storage, Section 28(e) on restoring availability. If the laptop is stolen and it was encrypted, the Section 11 limb (B) question — whether there is reason to believe the information may have been acquired by an unauthorised person — is a genuinely different question than it is for an unencrypted device. Encryption is not a get-out, and the assessment still has to be made and documented under Section 22, but it changes the analysis. Switching on full-disk encryption is a single setting.

3. A twenty-person online shop discovers its website was serving a card-skimming script for three weeks

Which measures are in play: Section 28(a) security policy, 28(d) regular monitoring, and the patching discipline behind Section 29’s review-and-update requirement. Three weeks undetected is the Section 28(d) failure, and it is the one that will be asked about. The steps now: preserve evidence before cleaning, assess the three-part test in Circular 16-03 Section 11, notify the payment provider immediately, and work through the hacked-website guide. Card data and customer identifiers together make notification likely rather than optional.

4. A payroll provider tells a fifty-person company its systems were breached

The provider is the processor. The company is very probably still the controller, and the controller’s duties do not transfer with the incident. Which measures are in play: Section 26(f) contracts with processors, and Circular 2022-01’s separate major infraction for failure to ensure third parties implement security measures. Do not wait for the provider’s report to start your own assessment — your 72 hours runs from your knowledge or reasonable belief, not from the vendor’s convenience. See who is responsible when a vendor has the breach.

5. A small lender uses an automated scoring rule to approve applications

Headcount is irrelevant here. Automated decision-making or profiling triggers NPC registration under Circular 2022-04 regardless of size, so a twelve-person lender is in scope where a twelve-person bakery is not. Which measures are in play: Section 26(c) records of processing, and — because the system makes decisions about people — the governance and human-intervention expectations in NPC Advisory No. 2024-04 on AI systems processing personal data. See the Advisory 2024-04 guide and the AI law status tracker.

6. A five-person firm concludes an incident was minor and tells nobody

This is the most common SME outcome and the most quietly expensive one. The conclusion may well be correct — the three-part test in Section 11 is a real test and many incidents do not meet it. But the decision has to be written down. Section 22 requires all security incidents and personal data breaches to be documented through written reports, with a summary going to the Commission annually. An undocumented correct decision looks identical to concealment after the fact, and Section 30 of RA 10173 reaches concealment by omission, against a person rather than a company.

Ten Mistakes That Show Up in Real SMEs

1. Treating a foreign checklist as the requirement. NIST and other frameworks are structure. The eighteen enumerated measures are the thing a Philippine regulator can name.
2. Believing small means exempt. Section 29 scales the standard. It does not remove the duty in Section 25.
3. Skipping Section 27 entirely because the business feels cloud-based. Five physical measures are enumerated and the office still exists.
4. Counting an untested backup. Section 28(e) is about the ability to restore, not the existence of a file.
5. No named owner. Section 26(a) asks for a person accountable for compliance. “IT looks after it” is not a designation.
6. No processing inventory. Without Section 26(c) records, no incident can be scoped and no notification decision can be made properly.
7. Monitoring switched on and never read. Section 28(d) is a duty to monitor, not a duty to enable a feature.
8. Not documenting the incidents you decided were minor. Section 22 covers those too.
9. Assuming the vendor’s breach is the vendor’s problem. Your clock runs from your knowledge, and failure to ensure third parties implement measures is its own major infraction.
10. Waiting for a breach to write the policy. Circular 16-03 Sections 4 and 5, and the NPC’s pre-incident list, are all framed as things to have beforehand.

And three things not to do at all

• Do not wipe or rebuild a compromised machine before evidence is preserved. Record times, URLs, messages, log excerpts and screenshots first. See the electronic evidence checklist.
• Do not pay a ransom on the assumption it ends the obligation. It does not touch any notification duty. See ransomware payment and reporting.
• Do not delay notification to finish the investigation where the breach involves at least 100 data subjects or the disclosure of sensitive personal information. Section 17(B) forecloses it.

Which Cybercode Checklist Do You Actually Need?

This page is the parent. The list below routes to Cybercode’s own guides only — no other publisher is listed, and none of these is ranked against the others, because no measurement exists that would justify a ranking.

Frequently Asked Questions

What is the best cybersecurity checklist for an SME in the Philippines?

The one built from IRR Rule VI, Sections 25 to 29 of the Data Privacy Act’s Implementing Rules, because those eighteen enumerated measures are the controls a Philippine regulator can actually hold a business to. Foreign frameworks such as NIST CSF 2.0 are useful structure layered on top, but they are voluntary and not Philippine law.

Is there a single Philippine cybersecurity law that tells SMEs what to do?

No general one. The enforceable baseline for most Philippine SMEs runs through data privacy law — RA 10173, its IRR and NPC issuances — and applies because the business processes personal data. Republic Act No. 10175 defines cybercrimes committed against you rather than controls you must implement. Regulated sectors add their own rules.

Does a small business really need a Data Protection Officer?

Where the Data Privacy Act applies, IRR Section 26(a) names the designation of a DPO or compliance officer “accountable for ensuring compliance” as an organizational security measure. In a small firm this is one named person with the authority to act, recorded in writing. It does not require a new hire.

What is the most important control if we can only do one thing?

There is no single answer, but multi-factor authentication on email, cloud, banking and administrator accounts prevents the largest share of common compromises for the least money. It maps to IRR Section 28(b). A tested backup, mapping to Section 28(e), is the closest runner-up.

Can we be fined if nothing has actually been breached?

Yes. NPC Circular 2022-01 treats failure to implement reasonable security measures as a major infraction in its own right, priced at 0.25% to 2% of the previous year’s annual gross income, subject to the ₱5,000,000 cap on a single act. No breach is required.

Is encryption legally required in the Philippines?

Encryption of personal data during storage and in transit is enumerated in IRR Section 28(g). The specific figure — AES-256 — comes from the National Privacy Commission’s own data-security page, which describes it as the most appropriate encryption standard. Treat the duty as regulatory and the specific standard as a strong regulator recommendation.

Do we have to register with the NPC?

Only above the NPC Circular 2022-04 thresholds: 250 or more employees, sensitive personal information of 1,000 or more individuals, risk to rights and freedoms, processing that is not occasional, or any automated decision-making or profiling. The profiling trigger applies regardless of company size.

Does a small Philippine business need a written cybersecurity policy?

Where personal data is processed, effectively yes. IRR Section 26(b) names data protection policies as an organizational measure and Section 28(a) separately names a security policy for the processing of personal data. Cybercode’s employee cybersecurity policy template turns the controls into named responsibilities.

Must an SME adopt ISO 27001?

No Philippine statute or regulator issuance located requires certification to ISO 27001 or to any other standard. Certification can be a commercial requirement imposed by a customer or a contract, which is a different thing from a legal obligation. Cybercode has not read the ISO standard and states no figure from it.

How often should an SME review its security measures?

IRR Section 29 states that measures are “subject to regular review and updating” without fixing an interval, and Section 28(f) requires a process for regularly testing, assessing and evaluating effectiveness. NPC Advisory 2025-02 names annual audits at the operation and maintenance stage. Annually, plus after any material change or incident, is a defensible reading.

Where does a Philippine business report a serious cyber incident?

It depends on what happened, and the channels are not interchangeable. A reportable personal data breach goes to the NPC through the DBNMS only. A technical compromise goes to CERT-PH under the DICT Cybersecurity Bureau for coordination. A suspected crime goes to the NBI Cybercrime Division or the PNP Anti-Cybercrime Group. One report does not satisfy another.

Does a cloud provider’s security mean we have nothing to do?

No. The provider is generally the processor; your business generally remains the controller and keeps the controller’s duties. IRR Section 26(f) requires contracts with processors, and Circular 2022-01 makes failure to ensure third parties implement security measures a separate major infraction.

What should we do first if we have done none of this?

Work the seven essential items in the minimum practical setup above. They cover the highest-value parts of Sections 26(a), 26(d), 28(b), 28(d) and 28(e), can mostly be completed in a week, and cost little beyond attention. Then build the processing inventory required by Section 26(c).

Verification Log

What was checked for this review, and what was carried over from earlier verified readings rather than re-fetched.

Official Sources

• Implementing Rules and Regulations of the Data Privacy Act of 2012 — Rule VI, Sections 25 to 29
• Republic Act No. 10173, Data Privacy Act of 2012 — full text, National Privacy Commission
• National Privacy Commission — Data Security
• National Privacy Commission — Exercising Breach Reporting Procedures
• NPC Circular No. 16-03, Personal Data Breach Management
• NPC Circular No. 2022-01, Guidelines on Administrative Fines
• NPC Circular No. 2022-04, Registration of Data Processing Systems
• NPC Advisory No. 2025-02, Privacy Engineering in Systems Life Cycle Processes
• NPC advisories and circulars index
• NPC breach reporting and the DBNMS
• Data Breach Notification Management System (DBNMS)
• CERT-PH / NCERT — report an incident (DICT Cybersecurity Bureau)
• Manual of Regulations for Banks, Section 148 — Information Technology Risk Management
• NIST Cybersecurity Framework 2.0 (NIST CSWP 29) — a voluntary United States framework
• Republic Act No. 10175, Cybercrime Prevention Act of 2012 — Senate Legislative Digital Resource
• National Bureau of Investigation
• PNP Anti-Cybercrime Group
• Cybercrime Investigation and Coordinating Center — linked for reference; its pages could not be read for this review
• CISA cyber guidance for small businesses — a United States agency resource, not read for this review and not relied on

Related Cybercode Guides

Cybersecurity in the Philippines · Cyber incident response compared · Incident response plan · Incident response checklist · After a business cyberattack · Data breach reporting · DBNMS notification · Data Privacy Act · The NPC · Privacy impact assessments · Employee cybersecurity policy · Vendor and SaaS security · Ransomware response · Malware · Business email compromise · Unauthorised account access · Reporting cybercrime · RA 10175 guide · Digitising a small business · Online business compliance

About This Guide

Author: Cybercode.ph Editorial Team. Last materially reviewed: September 28, 2026.

This page has not been reviewed by a named external legal reviewer. Cybercode does not attribute review to a person who has not carried it out. In place of a reviewer’s name, the verification log above records exactly what was read for this review, what was carried over from an earlier reading, and what could not be read at all.

Corrections. Every provision cited here can be checked against the official sources listed above. If a figure, section number or date on this page does not match the government source it cites, the government source is correct and Cybercode wants to know.

Disclaimer

Important: Cybercode.ph provides general educational information about Philippine law, regulation, cybersecurity, technology and business compliance. It is not legal, cybersecurity or professional advice for a specific situation and does not create an attorney-client relationship. Laws, agency procedures, technical standards and the facts of each situation may change the result. Verify current requirements through the cited official sources and seek qualified professional advice where your rights, deadlines, money, safety or legal exposure may be affected.