When a Cyberattack Becomes a Legal Problem: What Philippine Businesses Must Do

A company discovers unusual activity in its systems on a Friday afternoon. IT is already investigating, servers are being checked, logs are being pulled, and for the moment, the incident looks like a technical problem with a technical solution. What often gets missed in those first few hours is that the business may already be on a legal clock, one that started the moment someone formed a reasonable belief that something had gone wrong, whether or not the full picture is clear yet.

This is where most companies get the sequence backwards. They wait for certainty before deciding whether the law requires them to act, when Philippine law asks the opposite: act on reasonable belief, and let certainty catch up later.

A Security Incident and a Data Breach Are Not the Same Thing

Philippine data privacy regulation draws a line that surprises a lot of business owners the first time they encounter it. A security incident is any event that affects, or could affect, the protection of personal data, including one that never actually resulted in a compromise because a safeguard caught it in time.¹ A personal data breach is narrower: it happens when that security incident leads to the actual destruction, loss, alteration, or unauthorized access or disclosure of personal data.

Every personal data breach is a security incident, but the reverse isn’t true, and the distinction has real consequences. A failed intrusion attempt, logged and stopped by a firewall, still belongs on the company’s internal incident record, the same annual filing AJA Law covered earlier this month in our look at the Annual Security Incident Report. A successful intrusion that exposed customer data is a different animal entirely, one that can trigger a legal obligation running on a much shorter timeline.

The business question worth asking now, before an incident happens, is who in the organization is actually equipped to tell these two situations apart quickly. That person, or that small group, becomes the most important call in the first hour of any real incident.

The Test That Decides Whether Notification Becomes Mandatory

Not every personal data breach has to be reported immediately. Philippine law sets a three-part test, and all three conditions have to be met before the clock on mandatory notification starts running.²

The compromised information has to be sensitive personal information, or other information that could be used to commit identity fraud. This category is broader than most business owners assume: usernames, passwords, financial account numbers, biometric data, and government-issued identification numbers all qualify, alongside the more familiar categories like health and religious information.

There has to be reason to believe the information was acquired by someone without authorization to have it.

And the company, or the National Privacy Commission, has to believe the breach is likely to cause real and serious harm to the people whose data was involved.

When all three line up, the obligation to notify becomes mandatory. When they don’t, the incident still has to be documented for the annual report, but the urgent 72-hour clock never starts. Getting this call right requires a working data inventory: a company that doesn’t already know what categories of personal information it holds, and where, is trying to answer a legal question without the facts needed to answer it.

This responsibility doesn’t disappear when processing is outsourced to a vendor or cloud provider. A company remains accountable for a breach even when the incident originates with a third party handling its data, a point worth revisiting for any business that has scaled through outsourcing, where ownership and control can blur faster than contracts and oversight keep pace.

Why the 72-Hour Window Trips Up Even Experienced Companies

Once the three-part test is met, the National Privacy Commission and the affected individuals generally both have to be notified within 72 hours of the company forming a reasonable belief that a breach occurred.³ A full breach report typically follows within five days.⁴

This is the point where multinational companies with an existing privacy program often assume they already know the drill, and get it wrong. Under GDPR, notifying the regulator and notifying the affected individuals are two separate questions on two separate clocks, the regulator gets 72 hours, individuals get notified “without undue delay” only if the breach meets a distinct high-risk threshold. Philippine law runs both notifications on the same 72-hour timeline once the mandatory threshold is crossed. A privacy team used to sequencing these steps, regulator first and individuals later, can find itself out of compliance simply by following a playbook that worked perfectly well somewhere else.

In May 2026, the National Privacy Commission issued an advisory clarifying how requests are handled when breach notifications are filed through its Data Breach Notification Management System. A company that files a request to postpone notification, or to be exempted from it, is not relieved of its reporting obligations while that request is pending, and silence from the NPC is never treated as approval.⁵ Exemption and postponement should also not be requested together for the same incident, since doing so risks denial of one or both. The practical result is that a business can’t buy itself time by simply asking for it. The request has to be resolved by the NPC, in writing, before any relief applies.

What this means operationally is that someone inside the company needs standing authority to make the notification call on a weekend, outside business hours, without waiting for a committee to convene. Companies that build this authority into their incident response plan in advance are in a fundamentally different position than companies discovering, mid-crisis, that nobody is actually allowed to make the decision.

What Happens When a Business Gets This Wrong

The penalties attach at two different levels, and business owners tend to focus on only one of them.

At the organizational level, failing to notify when notification was required is treated as a major infraction, which can draw an administrative fine of 0.25% to 2% of the company’s annual gross income for the preceding year, rising to as much as 3% if the same infraction is repeated. The total fine for a single act cannot exceed five million pesos.⁶ Concealing a breach the company knew about, and knew it had a duty to report, is a separate criminal offense, carrying imprisonment of up to five years.⁷

The level that gets less attention is personal. Philippine law allows criminal liability for a data privacy offense committed by a company to reach the individual officers responsible for it, not just the corporate entity.⁸ The National Privacy Commission’s 2025 action against PhilHealth illustrates exactly this. In June 2025, the NPC reported that it had imposed a fifteen million peso administrative fine against PhilHealth for violations of the Data Privacy Act, and had recommended criminal prosecution of responsible officials, forwarding the matter to the Secretary of Justice. The NPC also stated that the administrative fine was already final and executory.⁹ That combination, a corporate fine already locked in, plus an active criminal referral against named individuals, is the fact pattern that should change how a board thinks about who gets looped in during an incident, and how early.

A Cyberattack Can Trigger More Than One Law at Once

The scenario businesses tend to prepare for least is the one where a single incident sits across two legal regimes simultaneously. A phishing attack that compromises an employee’s credentials and leads to a fraudulent electronic transfer isn’t just a data privacy question anymore. It can also fall under the Anti-Financial Account Scamming Act, the 2024 law that creates new offenses and sets duties for banks and other financial institutions.¹⁰ This exposure sits alongside the compliance obligations already in place for e-commerce businesses and online platforms under the Internet Transactions Act, which requires merchants to maintain data privacy compliance as a condition of operating lawfully online.

Under that law, a bank may be required to restore funds to an account owner if it failed to maintain adequate fraud controls, and this obligation does not require waiting for a criminal conviction first. Whether it applies can depend on how the compromise occurred.¹¹ Importantly, this framework applies to corporate accounts, not only individual consumers, and operates on its own short timeline: under BSP Circular No. 1215, disputed funds can be held for an initial period of up to five calendar days while the originating and receiving institutions verify what occurred, extendable to a maximum of 30 days.¹²

A company facing this kind of dual-track incident is managing two clocks at once, the data privacy notification clock and the financial fund-recovery window, and the first few hours matter to both. This is also the moment where having counsel who works across data privacy and disputes, rather than treating the incident as a single-issue compliance problem, makes a measurable difference in outcome.

Foreign Investors Face a Sharper Version of This Problem

For multinational companies operating a Philippine subsidiary, the gap between a global privacy program and local compliance tends to be wider than expected, not narrower. Beyond the notification timing difference already discussed, Philippine law treats a broader set of information as sensitive, requires local registration of certain data processing systems with no clean GDPR equivalent, and imposes an annual incident-reporting obligation that exists independently of whether any single breach ever crossed the mandatory notification threshold.¹³ We’ll be covering this gap in more depth later in our Cybersecurity Awareness Month series, but the short version is that a global privacy program, however mature, is a starting point in the Philippines, not a finish line.

Building Readiness Before the Incident, Not After

The businesses that come through a cyberattack with the least legal exposure are almost never the ones with the most sophisticated technology. They’re the ones that already know, before anything happens, who makes the notification call, what data the company actually holds and where, whether the company meets the National Privacy Commission’s registration thresholds, and when legal counsel needs to be brought into the room.

None of this requires waiting for an incident to start building. A data classification review, an incident escalation protocol with clearly assigned authority, and a registration status check are all things a company can do this quarter, calmly, rather than in the middle of a crisis. This is consistent with a pattern we’ve written about before: compliance works best as a business design decision, built into how a company operates from the start, rather than something bolted on after a regulator or an incident forces the issue.

Before it Becomes A Crisis

The businesses that handle a cyberattack well rarely do it alone, and they rarely start building that relationship after the incident has already begun. AJA Law works alongside our clients on data privacy compliance and NPC registration, including data processing system registration, DPO designation, privacy impact assessments, and incident response planning, not as a one-time engagement, but as an ongoing part of how a business operates. The companies best positioned when something does go wrong are usually the ones who already knew who to call before they needed to.

Legal planning is easier when done before key decisions are fixed. If your organization wants to review its data privacy registration status or build a response plan before one is needed, AJA Law is ready to be that partner. Reach out at ajalaw.ph/contact/.

Need help understanding what this means for you?

Every situation depends on its own facts, documents, timing, and objectives. AJA Law can help you understand the legal issues involved, assess the practical implications, and identify sensible next steps.

Initial inquiries are welcome. There is no charge to contact us, and we will let you know if a formal consultation or engagement would be appropriate.

TALK TO US

Footnotes

1. NPC Circular No. 16-03, Personal Data Breach Management (15 December 2016), Section 3(J), defining “security incident.”
2. Implementing Rules and Regulations of RA 10173, and NPC Circular No. 16-03, setting out the mandatory notification threshold.
3. NPC Circular No. 16-03; NPC breach-reporting guidance, privacy.gov.ph.
4. NPC Circular No. 16-03, Section 17, full breach report timeline.
5. NPC Advisory No. 2026-02 (11 May 2026), clarifying submission procedures under the DBNMS.
6. NPC Circular No. 2022-01, Guidelines on Administrative Fines (8 August 2022).
7. Republic Act No. 10173, Data Privacy Act of 2012, Section 30.
8. Republic Act No. 10173, Section 34, on liability of responsible officers of a juridical person.
9. National Privacy Commission, Privacy Awareness Week 2025 statement, reported by Privacy Commissioner John Henry Naga. Source: privacy.gov.ph, “PAW 2025: NPC Champions Global Privacy in a Borderless Digital Era”
10. Republic Act No. 12010, Anti-Financial Account Scamming Act (2024).
11. RA 12010, Section 6, institutional restitution provisions.
12. BSP Circular No. 1215, disputed funds holding period, read together with RA 12010’s 30-day statutory ceiling.
13. NPC Circular No. 2022-04, DPO and data processing system registration requirements; NPC Circular No. 16-03, Annual Security Incident Report obligations.