NPC Advisory 2026-02 and the DBNMS: A Practical Breach Notification Guide

1What NPC Advisory No. 2026-02 is and why it matters now

On 11 May 2026 the National Privacy Commission (NPC) issued Advisory No. 2026-02, titled Clarification on the Submission of Personal Data Breach Notification through Data Breach Notification Management System. The advisory is listed in the Digital Policy Alert regulatory tracker with that issuance date, and the DivinaLaw Legal Watch digest records a publication date of 18 May 2026 and links to the official PDF on the NPC website. It does not create a new breach regime. It supplements NPC Circular No. 16-03 on Personal Data Breach Management and addresses procedural mistakes that controllers have been making when they file through the Data Breach Notification Management System (DBNMS).

The advisory has become more practical than academic over the past six weeks. On 30 October 2026 the NPC received a breach notification from St. Luke's Medical Center about its eHealth Hub mobile app platform, and in late October and early November the Commission said it was looking into reports involving Department of Migrant Workers (DMW)-linked database backups and alleged attacks on several government systems on 5 November (discussed in Section 6). Each of these episodes turns on the same questions the advisory deals with: when the clock starts, what has to be filed, and what happens while a request to the NPC is pending.

This guide focuses on the filing mechanics and the advisory. For the broader obligations of app developers and the 2026 policy landscape, see our earlier articles on data privacy and cybersecurity rules for mobile apps and on Philippine cybersecurity and digital governance policy in 2026.

2The four points the advisory clarifies

Based on the summaries published by Baker McKenzie (4 June 2026) and DivinaLaw, and the Digital Policy Alert entry, Advisory No. 2026-02 applies to controllers that use the DBNMS to request postponement of notice to data subjects, exemption from that notice, approval of alternative means of notification, or an extension of time for submissions under Circular 16-03. It makes four points.

1. Some requests cannot be filed together

A controller may not file, for the same breach, (a) a request for exemption from notifying data subjects together with a request to postpone that notice, or (b) a request for exemption together with a request for approval to use alternative means of notice. The reasoning is straightforward: an exemption assumes that data subjects need not be told at all, while postponement and alternative notice both assume that they must be told. The advisory warns that conflicting requests may lead to the denial of one or all of them. Filing "everything, just in case" is therefore a risk rather than a safeguard.

2. A pending request does not suspend reporting duties

Submitting any request through the DBNMS does not relieve the controller of its obligations under the Circular. Unless the NPC acts on the request, the controller must still submit its Full Breach Report within five days from discovery of the breach, and non-compliance may expose it to administrative fines.

3. Silence is not approval

The NPC's resolutions on such requests must be expressly issued in writing. According to the DivinaLaw digest, the advisory states that the Commission's inaction shall not be construed as approval, implied consent or automatic grant of any request, nor serve as justification for non-compliance.

4. Choose the relief before filing

Taken together, these points mean that a controller should decide early, on documented facts, which single path it is taking: notify data subjects normally, ask for an exemption, ask for postponement, or ask to use alternative means. The request should be supported by clear grounds and evidence, because the controller cannot rely on time passing in its favour.

“…inaction shall not be construed as approval, implied consent, or automatic grant of any request…”

— DivinaLaw Legal Watch summary of NPC Advisory No. 2026-02, July 2026

3How the advisory fits Circular 16-03 and the 72-hour rule

NPC Circular No. 16-03, dated 15 December 2016, remains the core rulebook. Its main timing rules are:

• 72 hours to notify the NPC. Section 17 requires notice to the Commission within 72 hours "upon knowledge of or the reasonable belief" that a notifiable breach has occurred.
• Limited room for delay. Notification may be delayed only to the extent necessary to determine the scope of the breach, and never to conceal it. Under the Circular, it must not be delayed where the breach involves at least 100 data subjects, or where disclosure of sensitive personal information would harm the data subject; in those cases the 72-hour notice is made on the information available.
• Five days for the full report. The full report must be submitted within five days unless the Commission grants more time.
• Presumed failure to notify. Section 20 provides that failure to notify is presumed if the Commission does not receive notification within five days from knowledge or reasonable belief of the breach.
• 72 hours for data subjects. Section 18 requires affected data subjects to be notified within 72 hours as well, again on available information where there is a real risk to their rights.

Advisory No. 2026-02 plugs into this structure at the point where controllers ask the NPC for flexibility. Exemption and postponement of data-subject notice, and alternative means of notice, are all already contemplated in Section 18 of the Circular. What the advisory adds is that those requests are mutually limited, that they do not pause the five-day full report, and that only a written NPC resolution changes the controller's obligations.

4Who must notify, and when notification is mandatory

Under Section 11 of Circular 16-03, mandatory notification applies when three conditions are all present:

1. the breach involves sensitive personal information or other information that may be used to enable identity fraud;
2. there is reason to believe the information may have been acquired by an unauthorized person; and
3. the controller or the Commission believes the unauthorized acquisition is likely to give rise to a real risk of serious harm to any affected data subject.

These track the statutory trigger in Section 20(f) of the Data Privacy Act. In practice, scanned government IDs, health records, financial account details, and log-in credentials frequently satisfy the first condition. Breaches that do not meet all three conditions still need to be documented: Section 22 of the Circular requires written reports of all security incidents and personal data breaches and an annual summary submitted to the Commission.

Outsourced systems

The St. Luke's incident illustrates a common pattern: according to the hospital's disclosure as reported by Newsbytes.PH, the affected platform was managed by a third-party service provider, yet it was the hospital, as controller, whose notification the NPC acknowledged receiving. Outsourcing the system does not outsource the notification duty. Controllers should make sure their data-sharing and outsourcing agreements require processors to alert them quickly and to preserve logs, since the controller's 72 hours may start when its vendor knows, depending on the facts. The precise allocation of timing between a vendor's knowledge and the controller's knowledge has not been settled by the advisory and should be addressed contractually.

One DBNMS account per controller

When the NPC launched the DBNMS on 20 April 2022, it announced that breach notifications and Annual Security Incident Reports would be accepted only through the online platform, and that email, personal filing, mail and courier submissions would no longer be valid. Each controller may hold only one account even if it has several branches, and related companies must register separately. A group whose subsidiaries share an IT team should confirm, before an incident, which entity is the controller for each system and that each has working DBNMS access.

5What to include, and how to notify data subjects

Content of the notice to the NPC

Section 17 of the Circular requires the notification to describe at least the nature of the breach, the personal data possibly involved, the measures taken to address the breach, and the contact details of the Data Protection Officer or other accountable persons. The Commission may ask for more. Notification is not deemed filed until the Commission confirms receipt, so the person filing should save the DBNMS acknowledgement.

Notice to affected individuals

Under Section 18, data subjects are notified individually through secure channels. Their notice should explain what happened, what data was involved, what the organization is doing, what they can do to protect themselves, and whom to contact. Information may be provided in phases as the investigation develops. Where individual notice is impossible or would require disproportionate effort, the controller may ask the NPC to approve alternative means such as a public announcement. Postponement may be authorized where notice could hinder a criminal investigation, and an exemption may be granted where the Commission finds notice would not serve the interests of the public or the affected data subjects.

After Advisory No. 2026-02, the sequence matters. If the controller believes it should be exempt, it should file only that request and be ready with the evidence. If it accepts that notice is required but needs time or a different channel, it should request postponement or alternative means, not an exemption. In every case, it should keep preparing the Full Breach Report for the five-day deadline.

6Recent NPC breach matters reported in 2026

The following developments were reported in the past two months. They are summarized from news reports and official statements; none of them is a finding of liability, and the entities concerned have not been found to have violated the Data Privacy Act.

1. 2026-09-19
   LTFRB. The Land Transportation Franchising and Regulatory Board confirmed a data breach and took its LTFRB Electronic Support System offline, saying the incident affected the system's data environment and that it was coordinating with the DICT, the Cybercrime Investigation and Coordinating Center and the NPC. It had not yet determined what information or how many records were involved. An earlier online claim that 16 million records were exposed had not been independently confirmed.
2. 2026-10-29
   DMW-linked backups. After security firm Hunt.io published findings on 28 October that about 69 GB of database backups with filenames referring to POEA and OFW systems had been copied on 6 September, the NPC said it was investigating and coordinating with the DMW. The report did not establish how access was gained or whether personal data was in fact accessed.
3. 2026-10-30
   St. Luke's Medical Center. The hospital said it detected unauthorized access to the platform supporting its eHealth Hub app on 29 October. The NPC confirmed it received the breach notification on 30 October and was evaluating it. The hospital said its electronic medical records and core clinical systems were not affected and that it would notify affected individuals directly.
4. 2026-11-06
   Alleged 5 November attacks. After online groups reported that several government systems were hacked or defaced on 5 November, the NPC said it would verify the reports, noting it had not yet received breach notifications from the agencies concerned and that reports of alleged leaks do not by themselves establish that a personal data breach occurred.

Two lessons stand out. First, the NPC is acting on public reports, including dark-web and social-media claims, without waiting for a controller to come forward, so a controller that has not filed may find itself explaining why. Second, the St. Luke's timeline (detection on 29 October, NPC receipt on 30 October) shows what timely filing looks like in practice. These matters are developing as of 6 November 2026, and later NPC findings may change the picture.

7Exposure if notification goes wrong

Three layers of consequence apply. The advisory itself warns that failing to submit the Full Breach Report on time may result in administrative fines. Separately, Section 30 of the Data Privacy Act makes it a crime for persons who, knowing of a security breach and of the duty to notify under Section 20(f), intentionally or by omission conceal it; the penalty is imprisonment of one year and six months to five years and a fine of PHP 500,000 to PHP 1,000,000. Section 35 imposes the maximum penalty where at least 100 persons are affected. Finally, affected individuals may complain to the NPC, and a poorly handled breach can lead to compliance orders, audits and reputational harm.

Because criminal liability under Section 30 attaches to persons, directors, officers and DPOs who are told about a breach should make sure the escalation is documented and acted on. Where a breach also involves hacking, extortion or fraud, the incident may overlap with the Cybercrime Prevention Act, and evidence preservation should be planned with that in mind; our cybercrime practice handles both sides of these incidents.

8Incident-response checklist aligned with the advisory

Our earlier DPO checklist on breach notification covers the basics of a response plan. The checklist below adds the items that Advisory No. 2026-02 and the DBNMS make specific.

Before an incident

• Confirm each group entity that acts as a controller has its own active DBNMS account, with at least two authorized users who can file outside office hours.
• Name the breach response team required by Section 5 of Circular 16-03, including one person with authority to make immediate decisions.
• Prepare draft templates for the 72-hour notice, the five-day Full Breach Report and individual data-subject notices.
• Update outsourcing and data-sharing agreements so vendors must report incidents promptly, preserve logs and support forensic work.

Within the first 72 hours

• Record the date and time of knowledge or reasonable belief, and who made the call.
• Apply the three Section 11 conditions and document the reasoning, whichever way it goes.
• If the breach involves 100 or more data subjects, file on available information rather than waiting for scope.
• Decide on one data-subject path: notify, or request exemption, or request postponement and/or alternative means. Do not combine an exemption with the others.
• File through the DBNMS and save the acknowledgement of receipt.

Days three to five and after

• Submit the Full Breach Report within five days unless the NPC has granted an extension in writing.
• Treat any unanswered request as not granted, and continue complying.
• Notify data subjects individually and securely, in phases if needed, and keep copies.
• Conduct a post-breach review, document root cause and remediation, and include the incident in the Annual Security Incident Report.

9Key takeaways

• NPC Advisory No. 2026-02 (11 May 2026) clarifies DBNMS filings under Circular 16-03; it does not replace the Circular.
• An exemption request cannot be combined with a postponement or alternative-notice request for the same breach.
• A pending DBNMS request does not stop the five-day Full Breach Report deadline.
• Only a written NPC resolution grants relief; silence is not approval.
• Recent cases show the NPC acting on public reports of breaches, so controllers should be ready to file within 72 hours.

If your organization is reviewing its breach-response plan, needs help with a DBNMS filing or a request for exemption or postponement, or is responding to an NPC notice, our corporate law team can assist with the regulatory side and coordinate with our cybercrime lawyers where an attack is involved. You may reach us through our contact page.

10Frequently asked questions