Cybersecurity Incident Response Plan Philippines: The 72-Hour NPC Playbook

Last materially reviewed: September 6, 2026

Direct Answer

A Philippine cybersecurity incident response plan must do two things at once: restore the business, and discharge a hard regulatory duty. Under NPC Circular 16-03, Section 17(A), the National Privacy Commission must be notified within 72 hours upon knowledge of, or reasonable belief in, a personal data breach — not upon confirmation. Filing is through the DBNMS portal only. Affected data subjects must also be notified.

For related phishing, ransomware, vendor, backup and business-security guidance, see the Cybersecurity Philippines authority hub.

Key Takeaways

• The 72-hour clock starts at knowledge of or reasonable belief that a personal data breach occurred (NPC Circular 16-03, Section 17(A)). You do not get to wait for forensic certainty.
• RA 10173, Section 20(f) itself says only “promptly.” The 72-hour figure is regulatory, from Circular 16-03 — cite the circular, not the statute.
• Notification goes to both the Commission and affected data subjects (Section 15), and the duty stays with the controller even where processing is outsourced.
• Only a breach meeting all three Section 11 elements is mandatorily notifiable: sensitive or identity-fraud-enabling data, reason to believe unauthorized acquisition, and a real risk of serious harm.
• A Data Breach Response Team is mandatory (Section 5), with at least one member holding authority to make immediate critical decisions.
• Breach notification and cybercrime reporting are separate tracks: a report to PNP-ACG, the NBI or CERT-PH does not satisfy the NPC duty.
• Every security incident must be documented in writing even when not notifiable, with an annual summary filed with the NPC (Section 22).

Jump to a Section

• The 72-hour timeline table
• Governing law and authorities
• What counts as a notifiable breach
• Exceptions, delays and boundaries
• Philippine scenarios
• Evidence and documentation
• The executable procedure
• Consequences and realistic outcomes
• Common mistakes
• Tool: incident response plan outline
• FAQs
• Related Cybercode guides
• Official sources

The 72-Hour Timeline

The most common failure in Philippine breach response is treating the 72 hours as time to investigate before the clock starts. Section 17(A) runs the period from knowledge or reasonable belief. This table allocates that window.

Hour window	Action	Who is responsible	What to record
Hour 0	Log the moment of knowledge or reasonable belief — the legal start of the 72 hours.	Report recipient; escalate to incident lead	Date, time with timezone, verbatim first report
Hour 0–2	Convene the Data Breach Response Team; appoint the incident lead; confirm a member with immediate decision authority is present (Section 5).	DPO and incident lead	Attendance, time convened, authority exercised
Hour 0–4	Preserve evidence before containment destroys it: volatile memory, log exports, disk images.	IT/security lead or forensic provider	Export hashes, imaging tool and version, custodians
Hour 2–8	Contain: isolate hosts, disable accounts, revoke sessions and tokens, rotate credentials and keys.	IT/security lead	Each action, authoriser, exact time
Hour 4–24	Scope the personal data: which data subjects, which categories, whether sensitive personal information is involved, record count.	DPO with process owners	Data mapping, counts, basis for each estimate
Hour 12–36	Apply the Section 11 three-element test and decide notifiable or not, documenting the reasoning either way.	DPO with counsel	Written assessment per element, decision-maker, time
Hour 24–48	Draft the notification against the Section 17(D) content list and the data subject notice against Section 18.	DPO and counsel	Draft versions and approvals
Before hour 72	File through the DBNMS and notify affected data subjects. Where 100 or more data subjects are involved, or sensitive personal information will harm the data subject, Section 17(C) permits no delay — file on available information.	DPO	DBNMS reference and timestamp
Within 5 days	Submit the full breach report where Section 17(C) applies, unless the Commission grants more time.	DPO	Full report, any extension granted
Days 5–30	Eradicate root cause, recover from trusted backups, monitor for recurrence, run the post-incident review.	IT/security lead, management	Root cause, corrective actions with owners
By 31 March following	Include the incident in the Annual Security Incident Report, filed through the DBNMS.	DPO	ASIR submission reference

Governing Law and Authorities

Republic Act 10173 (Data Privacy Act of 2012)

Section 20 requires reasonable and appropriate organizational, physical and technical security measures. Section 20(f) creates the notification duty, but its words are that the controller “shall promptly notify the Commission and affected data subjects when sensitive personal information or other information that may, under the circumstances, be used to enable identity fraud are reasonably believed to have been acquired by an unauthorized person.” The statute does not state 72 hours. Any source claiming the Act itself imposes that deadline is wrong about where the rule lives.

NPC Circular 16-03 (Personal Data Breach Management)

Here is the operative deadline. Section 17(A): “The Commission shall be notified within seventy-two (72) hours upon knowledge of or the reasonable belief by the personal information controller or personal information processor that a personal data breach has occurred.” The circular also creates the response team duty, the notification content requirements and the documentation duty. It remains listed in force on the NPC’s circulars index as of September 6, 2026.

NPC Circular 2023-06 (Security of Personal Data)

This circular expressly repealed NPC Circular 16-01 (Section 39) and sets the current minimum security requirements: DPO registration with the NPC (Section 4.A), a Privacy Management Program (Section 4.E), periodic training (Section 4.F), a password policy (Section 11), an Access Control Policy (Section 13), multifactor authentication for online access (Section 16), access logs for paper-based systems (Section 19), and encryption of removable or portable storage media (Section 25). These are the controls the NPC will ask about after an incident.

Republic Act 10175 (Cybercrime Prevention Act of 2012)

Where the incident is also a crime, Section 4(a) covers illegal access, illegal interception, data interference, system interference and misuse of devices; Section 4(b) covers computer-related forgery, fraud and identity theft. Section 8 sets penalties of prision mayor or a fine of at least ₱200,000, rising to reclusion temporal or at least ₱500,000 where critical infrastructure is attacked. Section 13 requires service providers to preserve traffic data and subscriber information for at least six months — which is why an early preservation request matters.

What Counts as a Notifiable Breach, Element by Element

Circular 16-03 defines a security incident as an event that affects or tends to affect data protection or may compromise the availability, integrity and confidentiality of personal data. A personal data breach is narrower: a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data. Not every incident is a breach, and not every breach is notifiable. Section 11 requires all three of the following — test each separately and write down your answer.

Element 1 — The data

Sensitive personal information, or any other information usable to enable identity fraud. Sensitive personal information under RA 10173 includes race, ethnic origin, marital status, age, colour, religious or political affiliations, health, education, genetic or sexual life, offences and proceedings, government-issued identifiers and tax returns. Ordinary personal information can still qualify under the second limb: a name plus mobile number plus mother’s maiden name plus date of birth is an identity-fraud kit though no single field is sensitive.

Element 2 — The acquisition

Reason to believe the information may have been acquired by an unauthorized person. That is a lower bar than proof: exfiltration logs, a ransom note listing your filenames, data on a leak site, or an unexplained outbound transfer all clear it.

Element 3 — The harm

The acquisition is likely to give rise to a real risk of serious harm to any affected data subject. Assess harm to the data subject, not the company: identity fraud, financial loss, discrimination, reputational damage, physical safety risk, loss of health-data confidentiality. Embarrassment to your board does not count.

If all three are present, notify. If one is genuinely absent, document the analysis — Section 22 requires the incident to be recorded regardless, and the written assessment is what defends the decision later.

Exceptions, Delays and Boundaries

Section 17(B) permits delay only to determine the scope of the breach, prevent further disclosures, or restore reasonable integrity to the system. Commercial convenience or waiting for the CEO to return from travel are not grounds.

Section 17(C) removes even that flexibility where the breach involves at least 100 data subjects, or where disclosure of sensitive personal information will harm the data subject. In both cases the Commission must be notified within the 72-hour period on available information, with the full report following within five days unless more time is granted.

Postponement of, or exemption from, notification is for the Commission to grant, not a self-assessment. NPC Advisory No. 2026-02, issued 11 May 2026, clarifies that a controller cannot simultaneously request exemption and postponement for the same breach, though postponement and alternative means of notification may be combined; it also states that submitting a request through the DBNMS does not relieve the controller of its Circular 16-03 obligations.

A boundary readers routinely miss: outsourcing does not transfer the duty. Section 15 places the obligation on the controller “even if the processing of information is outsourced or subcontracted to a personal information processor.” If your payroll vendor is breached, you notify.

Philippine Scenarios

The following are illustrative hypotheticals, not reports of actual incidents.

Hypothetical 1 — Ransomware at a Makati clinic

Patient records are encrypted on a Monday morning and the ransom note lists patient filenames. Health data is sensitive personal information, the filename listing is reason to believe unauthorized acquisition, and exposure of medical records is a real risk of serious harm — all three elements met. The clock started when the receptionist saw the note, not when the IT contractor arrived on Tuesday. With more than 100 data subjects involved, Section 17(C) bars delay: file on available information before hour 72, full report within five days.

Hypothetical 2 — Misconfigured cloud bucket, Cebu e-commerce seller

A researcher reports a publicly readable bucket holding delivery addresses and mobile numbers for 3,000 customers, and access logs show downloads from unknown addresses. No sensitive personal information, but the combination plausibly enables identity fraud. Treat it as notifiable rather than talking yourself out of it because “it was only addresses.”

Hypothetical 3 — Laptop stolen in Quezon City

An HR laptop is stolen. If the disk was fully encrypted, the key was not stored with the device, and there is no sign of decryption, the controller may reasonably conclude that unauthorized acquisition of intelligible personal data has not occurred. Write that conclusion down with the encryption evidence attached — and still record the incident under Section 22.

Evidence and Documentation

Most Philippine SMEs preserve the wrong artefact. A screenshot is a picture of a screen; it is not the record. The underlying log, export or image is the record, and the difference decides whether evidence survives challenge.

• Logs. Export authentication, firewall, web server, mail and endpoint logs to write-protected storage before containment, which often rotates or wipes them.
• Hashes. Hash each export at the moment of export and store the hash separately. A log file with no hash cannot later be shown to be unaltered.
• Forensic images. Image the disk rather than working on a live host, recording tool, version, operator and image hash.
• Chain of custody. A signed record of who handled each device or file, when, and to whom they passed it. Gaps here are what opposing counsel attack.
• Screenshots. Useful as contemporaneous illustration, but capture the underlying source too and never present the screenshot as the primary record.
• Decision log. Every decision, its time, its maker and its reasoning.

Section 22 requires all security incidents and breaches to be documented in written reports, including those not requiring notification. The documentation duty is unconditional; the notification duty is not.

The Executable Procedure

1. Timestamp the moment of knowledge in writing, with the timezone. This is your legal anchor.
2. Activate the Data Breach Response Team, confirming a member with immediate decision authority is present as Section 5 requires.
3. Preserve before you contain. Export logs, capture volatile data, hash everything.
4. Contain. Isolate, disable accounts, revoke sessions and tokens, rotate credentials and keys, block indicators.
5. Scope the personal data: which data subjects, which categories, how many records, whether sensitive personal information is involved.
6. Run the Section 11 three-element test in writing and reach a documented decision on notifiability.
7. File with the NPC through the DBNMS. The NPC states it accepts Personal Data Breach Notification Forms through the system only, and that forms submitted outside it are not valid. The portal is dbnms.privacy.gov.ph. Register in advance, not at hour 70.
8. Notify affected data subjects. Section 18 requires this within 72 hours too, covering the nature of the breach, the personal data possibly involved, measures taken and to reduce harm, a named representative with contact details, and any assistance offered.
9. Submit the full report within five days where Section 17(C) applies, unless the Commission grants more time.
10. Report the crime separately if there is one. The criminal track runs to the PNP Anti-Cybercrime Group or the NBI Cybercrime Division; technical assistance is available from CERT-PH via its incident reporting page. Neither substitutes for NPC notification. See reporting cybercrime in the Philippines.
11. Check your sector overlay. BSP-supervised institutions have separate reporting duties to the Bangko Sentral. We could not retrieve a primary BSP source on September 6, 2026 to verify a circular number or deadline, so confirm that requirement directly with the BSP rather than relying on a secondary summary.
12. Eradicate, recover, review. Remove the root cause, restore from trusted backups, monitor for recurrence, and produce a post-incident report with named owners and deadlines.
13. File the Annual Security Incident Report. The NPC states ASIRs covering the previous calendar year are submitted through the DBNMS to 31 March, and that ASIRs filed outside the system are not valid.

Consequences and Realistic Outcomes

Administrative

The NPC can investigate, issue compliance and cease-and-desist orders, and impose administrative fines under its own issuances. An organisation that notified late but candidly, with a documented assessment and evidence of remediation, is in a materially different position from one that did not notify at all. The documentation is the defence.

Criminal

RA 10173 creates offences with real custodial ranges. Most relevant here is concealment of security breaches: imprisonment of one year and six months to five years and a fine of ₱500,000 to ₱1,000,000. Negligent access to sensitive personal information carries three to six years and ₱500,000 to ₱4,000,000. These target responsible persons, not an abstract entity. Prosecutions have been uncommon relative to the number of breaches, so treat the deterrent as real without telling your board a conviction is automatic.

Civil

RA 10173 preserves the right of data subjects to be indemnified for damages from inaccurate, unlawfully obtained or unauthorized use of personal data. Such claims remain relatively undeveloped in Philippine practice: the exposure is genuine but not routinely large.

Contractual

Often the fastest-moving consequence. Data processing agreements, customer contracts and cyber insurance policies commonly impose their own notification windows — frequently shorter than 72 hours — and a missed contractual notice can void coverage or trigger termination rights long before a regulator acts.

Common Mistakes

• Starting the clock at confirmation. Section 17(A) starts it at knowledge or reasonable belief. This single error causes most late filings.
• Registering for the DBNMS during the incident. Onboarding takes time you will not have.
• Notifying the NPC but not the data subjects. Section 15 requires both.
• Believing a police or CERT-PH report discharges the NPC duty. Separate tracks, separate purposes.
• Assuming a processor’s breach is the processor’s problem. Section 15 keeps the duty with the controller.
• Wiping and rebuilding immediately, destroying the evidence needed for the Section 17(D) chronology.
• Treating screenshots as the evidence record instead of preserving and hashing the underlying logs.
• Not documenting a decision not to notify. An undocumented one looks like concealment.
• Forgetting the annual report. The ASIR is a standing duty even in a year with no notifiable breach.

Tool: An Incident Response Plan Outline You Can Adopt

Copy this into a document, fill in the names and numbers, and keep a printed copy offline. A plan that lives only on the file server is unavailable during the incident it was written for.

• 1. Scope and definitions — security incident versus personal data breach, per Circular 16-03.
• 2. Response team roster — names, roles, mobile numbers, out-of-band email, and who holds immediate decision authority under Section 5, plus a named alternate.
• 3. Contact list — DPO, counsel, forensic provider, cyber insurer, key vendors, PNP-ACG, NBI, CERT-PH, and the custodian of your DBNMS credentials.
• 4. Severity levels — four tiers with written criteria and the escalation each triggers.
• 5. Evidence preservation procedure — which logs, exported where, hashed how, held by whom.
• 6. Containment authorities — who may cut access without waiting for approval.
• 7. Section 11 assessment worksheet — the three elements as a signed form.
• 8. Notification templates — one mapped to the Section 17(D) content list, one to Section 18.
• 9. Recovery priorities — systems ranked by criticality with a verified restore procedure each.
• 10. Communications plan — who speaks to staff, customers, media and regulators.
• 11. Post-incident review template — timeline, root cause, impact, cost, corrective actions with owners.
• 12. Test schedule — tabletop dates, and a rule that the plan is revised after each exercise and each incident.

Frequently Asked Questions

When exactly does the 72 hours start?

Upon knowledge of, or reasonable belief in, a personal data breach, under Section 17(A) of NPC Circular 16-03. Not upon confirmation, not on completion of forensics, and not when management is briefed.

Does RA 10173 itself impose the 72-hour deadline?

No. Section 20(f) says “promptly.” The 72-hour period comes from NPC Circular 16-03. The distinction matters when someone challenges your source.

Can we notify by email instead of the DBNMS?

The NPC states it accepts Personal Data Breach Notification Forms through the DBNMS only, and that submissions outside the system are not valid. Treat the portal as the sole filing channel and resolve access problems in advance.

Do we notify if the data was encrypted?

If strong encryption was in place, the key was not compromised, and there is no indication the data was rendered intelligible, a controller may reasonably conclude the elements are not met. Document that reasoning and still record the incident under Section 22.

Our processor was breached, not us. Who notifies?

You do. Section 15 keeps the obligation with the personal information controller even where processing is outsourced or subcontracted.

Related Cybercode Guides

• Cyber Incident Response Checklist: the first 72 hours
• Data Breach Notification to the NPC
• Company Response to a Personal Data Breach
• Business Cyberattack: What to Do
• Ransomware Attack: What to Do
• Reporting Cybercrime in the Philippines
• Data Privacy Compliance Checklist
• Cybersecurity Compliance for Philippine Companies

Official Sources

• NPC Circular 16-03 — Personal Data Breach Management (PDF)
• NPC — Breach Reporting (DBNMS filing rules and ASIR window)
• Data Breach Notification Management System (DBNMS) portal
• NPC Advisory No. 2026-02, 11 May 2026 — Submission of Breach Notification through the DBNMS (PDF)
• NPC Circular 2023-06 — Security of Personal Data in the Government and the Private Sector (PDF)
• NPC — Advisories and Circulars index
• Republic Act 10173 — Data Privacy Act of 2012 (full text)
• Republic Act 10175 — Cybercrime Prevention Act of 2012 (full text)
• CERT-PH (DICT Cybersecurity Bureau) — Report an Incident

Disclaimer

Important: This article provides general educational information about Philippine law, regulation, cybersecurity, technology, or business compliance. It is not legal advice and does not create an attorney-client relationship. Laws, agency procedures, technical standards, platform rules, and the facts of each situation may change the result. Verify current requirements through the cited official sources and seek qualified professional advice when your rights, deadlines, money, safety, or legal exposure may be affected.