Data Privacy Act compliance, backed by 24/7 security operations.
The Data Privacy Act of 2012 expects organizations that handle personal data to protect it and to act fast when something goes wrong. Here's what the law and the National Privacy Commission (NPC) expect, and where managed SOC and MDR fit in.
General information, not legal advice. This page summarizes public rules in plain language. For advice on your specific obligations, consult your Data Protection Officer, your legal counsel, or the National Privacy Commission at privacy.gov.ph.
RA 10173 and the National Privacy Commission
Republic Act No. 10173, the Data Privacy Act of 2012 (DPA), protects personal information in both government and the private sector. Its Implementing Rules and Regulations (IRR) took effect in 2016, and the NPC administers the law and issues circulars that set out detailed requirements. The law applies to personal information controllers, the organizations that decide how personal data is used, and to personal information processors that handle data on their behalf.
The DPA provides for criminal penalties, and the NPC can also impose administrative fines and orders.
1. Reasonable security measures
Section 20 of the DPA requires organizations to implement reasonable and appropriate organizational, physical and technical measures to protect personal data. Among the technical measures the IRR describes are regular monitoring for security breaches, a process for identifying vulnerabilities and taking preventive, corrective and mitigating action against security incidents, the ability to restore access to data in a timely manner after an incident, and regular testing and evaluation of whether your security measures work. NPC Circular No. 2023-06 sets out further guidance on the security of personal data in government and the private sector.
2. Personal data breach notification
Under NPC Circular No. 16-03 on Personal Data Breach Management, the NPC must be notified within 72 hours of knowledge of, or reasonable belief in, a personal data breach that requires notification. In general, that means a breach involving sensitive personal information or information that could enable identity fraud, which is reasonably believed to have been acquired by an unauthorized person, and which is likely to give rise to a real risk of serious harm to the people affected. Affected data subjects must generally also be notified within 72 hours.
- The obligation to notify stays with the personal information controller, even when processing is outsourced.
- Notification may not be delayed if the breach involves at least 100 data subjects, or if disclosure of sensitive personal information will harm the people affected. A full report is due within five days unless the NPC grants more time.
- All security incidents and personal data breaches must be documented, including those that don't require notification, and a summary is submitted to the NPC annually.
- Organizations are expected to have a breach response team or designated people, and a written breach response procedure.
3. Data Protection Officer and registration
Every personal information controller and processor must designate a Data Protection Officer (DPO). Under NPC Circular No. 2022-04, registration of the DPO and data processing systems through the NPC's online registration system is mandatory for organizations that employ 250 or more people, process sensitive personal information of 1,000 or more individuals, or carry out processing likely to pose a risk to the rights and freedoms of data subjects. Government agencies are generally covered. Organizations outside these conditions may register voluntarily or file a sworn declaration of exemption.
Turning obligations into daily practice.
Monitor
A managed SOC provides the regular, round-the-clock monitoring for security breaches that the IRR describes, including nights, weekends and holidays.
Detect early
The 72-hour clock starts once you know of, or reasonably believe there is, a breach. Early detection limits the damage, and clear facts help you use that time well.
Assess with facts
Investigation shows what happened, when, which systems and accounts were involved, and what data may be affected: the details a notification asks for.
Contain
MDR can isolate affected devices and stop malicious activity quickly, limiting how many records and people are affected.
Document
Incident timelines and records support your own breach documentation and the annual summary of security incidents.
Test
Our free external scan and paid internal vulnerability assessment support regular testing of your security measures. Compare assessments.
A SOC supports compliance. It doesn't replace it.
No single service makes an organization compliant. Your DPO, privacy management program, privacy impact assessments, privacy notices and data sharing agreements remain your responsibility. The decision to notify the NPC and affected individuals also rests with you as the personal information controller. Our role is to give you timely detection, clear facts and reliable records so those decisions are faster and better informed.
A quick breach-readiness check
- Do you know who is on your breach response team, and how to reach them after hours?
- Would you know within hours, not weeks, if an attacker accessed personal data?
- Can you tell which systems and records were affected, and when?
- Are security incidents documented consistently, including minor ones?
- Have your internet-facing systems been checked for weaknesses recently?
If any answer is "not sure," a free security assessment is a practical place to start. You can also explore our services or read the FAQ.
Find out where you stand.
Start with a free security assessment: a discovery call plus a non-intrusive external scan of your public domains, websites and email security. You get a short findings report and plain next steps. No obligation.
Book a free security assessment