Last materially reviewed: September 21, 2026
Direct answer
Philippine law does not create a blanket rule requiring every ransomware victim to pay—or prohibiting every payment—but paying is risky, may fund crime, may fail to restore data and can destroy leverage if handled badly. Reporting duties depend on what systems and personal data were affected. If personal data was breached and the notification threshold is met, the personal information controller must follow NPC breach rules, including the applicable 72-hour notification timeline.
Authority-to-action bridge
| Question | Cybercode answer |
|---|---|
| What the authority says | RA 10173 and NPC breach rules govern qualifying personal-data breaches; RA 10175 addresses cybercrime conduct. |
| What it means | A ransomware incident is not only an IT outage. It may trigger privacy, contract, regulatory, insurance and evidence obligations. |
| What changes the answer | Reporting depends on the affected data, likelihood of harm, sector rules, critical systems, contracts and whether data was exfiltrated. |
| What to do next | Isolate affected systems, preserve forensic evidence, activate counsel and incident response, and make a documented notification decision. |
Key takeaways
- Do not negotiate or pay from an improvised personal account.
- Restoring from backup does not resolve possible data theft.
- The 72-hour privacy timeline is not a reason to wait 72 hours before assessing.
- Preserve ransom notes, wallet addresses, headers, logs and affected images.
- Notify insurers and specialist responders before payment decisions when policies require it.
Payment is separate from reporting
The NPC personal data breach rules require security-incident evaluation and notification when the legal threshold is satisfied. The controller remains responsible even when the attack occurs through a processor or vendor.
A ransom demand does not prove that personal data was exfiltrated, but absence of proof of exfiltration is not proof that none occurred. Review endpoint, identity, cloud, email, firewall and data-access evidence before reaching a conclusion.
The Cybercrime Prevention Act supports criminal investigation and preservation processes. Reporting to law enforcement, the NPC, DICT/NCERT and sector regulators may serve different purposes; one report does not automatically satisfy every obligation.
Evidence to preserve
Preserve a defensible forensic record before rebuilding systems.
- Original ransom note, payment instructions, wallet addresses and communications.
- System images, volatile data where feasible, logs, access tokens and identity events.
- Timeline of initial access, encryption, exfiltration indicators and containment.
- Data inventory showing whose data and which categories were exposed.
- Notification analysis, insurer notices, vendor reports and board decisions.
What to do next
- Isolate compromised systems without destroying evidence.
- Activate the incident team, counsel, forensic support, insurer and critical vendors.
- Secure privileged accounts and clean communication channels.
- Determine whether data was accessed or extracted, not merely encrypted.
- Assess NPC, sector, contractual and law-enforcement reporting routes promptly.
- Evaluate payment only after legal, sanctions, operational, ethical and recovery risks are documented.
- Recover from verified clean backups and monitor for persistence or data publication.
Common mistakes
- Reconnecting restored systems before removing the attacker’s access.
- Assuming encryption alone means no personal data breach.
- Letting the attacker dictate the only communication channel.
- Paying before checking insurer conditions, wallet risk and restoration alternatives.
Frequently asked questions
Must every ransomware attack be reported to the NPC?
No. The NPC threshold must be assessed. However, every incident involving personal data should be documented and evaluated promptly.
Does payment guarantee a decryptor or deletion?
No. Attackers may supply a broken decryptor, retain copied data or demand more money. Payment is a risk decision, not a guaranteed remedy.
Where else can an incident be reported?
Depending on the facts, organizations may use the NPC DBNMS, NCERT/DICT channels, law enforcement and sector-specific regulators. Confirm current official procedures.
Related Cybercode guides
- Ransomware Attack: What to Do Immediately
- Cybersecurity Incident Response Plan
- First 72 Hours Checklist
Official sources
- NPC Circular No. 16-03 — Personal Data Breach Management
- NPC breach reporting guidance
- NPC Data Breach Notification Management System
- National Computer Emergency Response Team incident reporting
- Republic Act No. 10175 — Cybercrime Prevention Act
Important: This article provides general educational information about Philippine law, regulation, cybersecurity, technology, or business compliance. It is not legal advice and does not create an attorney-client relationship. Laws, agency procedures, technical standards, platform rules, and the facts of each situation may change the result. Verify current requirements through the cited official sources and seek qualified professional advice when your rights, deadlines, money, safety, or legal exposure may be affected.