Direct answer
A Philippine company does not escape responsibility merely because the breach occurred at its SaaS provider. Under the Data Privacy Act, the personal information controller remains accountable for personal information under its control, including data it has outsourced or transferred to a processor, while the personal information processor has its own contractual and security duties. The parties should investigate together, but the controller must ensure that required NPC and data-subject notifications are made within 72 hours of knowledge or reasonable belief of a notifiable breach. RA 10173, Secs. 14 and 21; NPC Circular 16-03, Secs. 17(A) and 18(A).
Authority-to-action bridge
| Question | Cybercode answer |
|---|---|
| What the authority says | RA 10173 and its Implementing Rules allocate accountability between the controller and processor; NPC breach rules govern investigation and notification. |
| What it means | A contract can allocate tasks and indemnity, but it cannot erase statutory duties owed to data subjects and regulators. |
| What changes the answer | Responsibility depends on who decided the purpose and means, which party caused the incident, contract terms, security failures and notification thresholds. |
| What to do next | Trigger the incident clause, preserve logs, identify affected data and make a documented notification decision without waiting for perfect certainty. |
Key takeaways
- PIC and PIP labels follow actual roles, not whichever label the vendor contract uses.
- The controller should not wait passively for a vendor’s final forensic report.
- A vendor’s notice to its customer is not necessarily notice to the NPC or affected individuals.
- Subprocessors and cross-border hosting must be included in the incident map.
- Contractual indemnity and legal accountability are related but separate questions.
Controller and processor duties
The Data Privacy Act and its Implementing Rules require reasonable and appropriate organizational, physical and technical security measures. Section 14 lets a controller subcontract processing, but the controller remains responsible for ensuring proper safeguards protect the confidentiality of the data. Section 21 makes each controller responsible for personal information under its control, including information transferred to a third party for processing, in the Philippines or abroad. A controller must therefore choose and supervise processors capable of protecting personal data.
The NPC breach-management rules require notification when the breach involves sensitive personal information or information that may enable identity fraud, there is reason to believe it was acquired by an unauthorized person, and the acquisition is likely to give rise to a real risk of serious harm (Sec. 11). The NPC and affected data subjects must each be notified within 72 hours of knowledge or reasonable belief of the breach (Secs. 17(A) and 18(A)), and a full report is due within five days unless the Commission allows more time (Sec. 17(C)). The controller must ensure by contract that its processor reports a breach upon discovery or reasonable belief of it (Sec. 16). Notifications go through the NPC’s Data Breach Notification Management System; the NPC states that forms submitted outside it are not valid.
Knowingly concealing a security breach that must be reported is a separate offence under Section 30 of the Data Privacy Act, punishable by imprisonment of one year and six months to five years and a fine of ₱500,000 to ₱1,000,000. RA 10173, Sec. 30.
Contracts matter for response speed, evidence access, audit rights, subprocessors, costs and indemnity. They should require immediate incident notice, preservation, cooperation and enough technical detail for the controller to meet legal deadlines.
Evidence to preserve
A controller should be able to show what it knew, when it knew it and why it chose its notification path.
- Vendor incident notice, timeline and named incident contacts.
- Logs showing affected tenants, accounts, files, exports and administrative access.
- Data processing agreement, security schedule, subprocessors and hosting locations.
- Data inventory identifying affected subjects and sensitive categories.
- Risk assessment, notification decisions, regulator filings and remediation commitments.
What to do next
- Activate the contract’s incident and escalation provisions immediately.
- Require preservation of logs, images, access records and communications.
- Confirm whether the vendor is a processor, joint controller or independent controller for each activity.
- Determine affected data, subjects, locations, access and likely harm.
- Prepare NPC and data-subject notices when the legal threshold is met.
- Coordinate communications so vendor and customer statements do not conflict.
- Enforce remediation, audit and indemnity rights after immediate containment and notification work.
First action for the controller: log the time you first learned of the vendor incident. That moment of knowledge or reasonable belief starts the 72-hour NPC and data-subject clocks. NPC Circular 16-03, Secs. 17(A) and 18(A).
If you are the vendor or processor
- Notify each affected customer promptly with what is known, and keep updating; your contract with the controller should require this. NPC Circular 16-03, Sec. 16.
- Preserve logs and images, and give the controller the tenant-level facts it needs to decide on notification.
- Do not notify data subjects or the NPC on the controller’s behalf unless the roles and wording are agreed.
If your personal data was exposed through a company’s vendor
- Write to the company you dealt with (the controller) and its Data Protection Officer. Ask what data was affected, what it is doing and what you should do. Keep a copy.
- If the company does not take timely or appropriate action, or does not respond within 15 calendar days of receiving your letter, you may file a complaint with the National Privacy Commission. The NPC may waive this step for serious violations. 2021 NPC Rules of Procedure, as amended, Rule II, Sec. 2.
- Bring your letter and proof of receipt, the company’s breach notice or reply, screenshots of any misuse, and a timeline. If the data was used for fraud, also secure your bank and e-wallet accounts and report the fraud to the PNP Anti-Cybercrime Group or NBI.
Deadlines: the breach notification clocks above bind the company, not you. We did not verify a single fixed period for a data subject’s NPC complaint; the NPC rules refer prescription to Act No. 3326, so file promptly.
Common mistakes
- Waiting for the vendor to decide whether the Philippine customer must notify.
- Assuming a certificate or security badge proves reasonable security in the incident.
- Letting the vendor notify affected people without agreed facts and roles.
- Failing to investigate subprocessors and compromised integrations.
Frequently asked questions
Who files with the NPC?
The controller is generally accountable for ensuring notification when required, though a processor may assist or submit under authorized arrangements. Confirm the actual roles and current NPC process.
Can the contract make the vendor fully responsible?
It can allocate operational tasks, liability and indemnity between the parties, but statutory accountability to data subjects and regulators cannot simply be contracted away.
What if the vendor is overseas?
Philippine obligations can still apply to the Philippine controller. Cross-border clauses, subprocessors, evidence access and transfer safeguards should be reviewed.
Related Cybercode guides
- PIC vs PIP
- Vendor and SaaS Security Checklist
- Data Privacy for SaaS and Cloud Tools
- Cybersecurity Incident Response Plan
- Cyber Incident Response: Ransomware, Phishing and Hacked Accounts Compared
Official sources
- Republic Act No. 10173 — Data Privacy Act (Secs. 14, 20(f), 21 and 30)
- Implementing Rules and Regulations of RA 10173
- NPC Circular No. 16-03 — Personal Data Breach Management
- NPC Advisory No. 2024-01 — Contractual Clauses for Cross-Border Transfers
- NPC breach reporting and the Data Breach Notification Management System
- 2021 Rules of Procedure of the NPC, as amended
Important: This article provides general educational information about Philippine law, regulation, cybersecurity, technology, or business compliance. It is not legal advice and does not create an attorney-client relationship. Laws, agency procedures, technical standards, platform rules, and the facts of each situation may change the result. Verify current requirements through the cited official sources and seek qualified professional advice when your rights, deadlines, money, safety, or legal exposure may be affected.
Sources rechecked as of: September 28, 2026