Philippine Cybersecurity and Digital Governance Policy: 2026 Update

1Why 2026 is a turning point for digital governance

For most of the past decade, Philippine cybersecurity policy has rested on a small set of statutes: the Cybercrime Prevention Act of 2012 (Republic Act No. 10175), the Data Privacy Act of 2012 (RA 10173) and a series of executive issuances and department circulars. That architecture is now changing. In the fourteen months leading up to the research date of 29 October 2026, Congress enacted and the executive began implementing the E-Governance Act (RA 12254), the House of Representatives passed a consolidated National Cybersecurity and Critical Information Infrastructure Protection Act on third reading, and the National Privacy Commission (NPC) moved from guidance toward visible enforcement, including a cease-and-desist order against a global biometrics project and what has been reported as its largest administrative fine to date.

This article maps those developments for business owners, compliance officers and in-house counsel. It separates what is already law from what remains a bill or a policy statement, gives the dates that matter, and closes with a practical readiness agenda for organisations that may be designated as critical information infrastructure (CII), that supply technology to government, or that simply process Filipino personal data at scale.

• RA 12254, the E-Governance Act, was signed on 5 September 2025; its implementing rules were signed by the DICT on 24 March 2026 and set a cascade of 90-day, 120-day, 180-day and one-year deadlines for government agencies and their technology vendors.
• House Bill No. 9605, which would create a National Cybersecurity Agency and impose minimum standards on CII operators, passed the House on 12 August 2026. As of the research date it is pending in the Senate and is not yet law.
• The National Cybersecurity Plan 2023–2028, adopted by Executive Order No. 58 on 4 April 2024, remains the executive roadmap; it binds national agencies and GOCCs but only encourages LGUs.
• NPC enforcement has moved from registration reminders to orders and percentage-of-revenue fines under NPC Circular No. 2022-01, with high-profile actions in October 2025 and January 2026.
• Businesses should treat CII readiness, incident-reporting discipline and vendor-contract hygiene as 2026 priorities even before the cybersecurity bill is enacted.

2The National Cybersecurity Plan 2023–2028 and Executive Order No. 58

The National Cybersecurity Plan (NCSP) 2023–2028 is the executive branch's strategic document. The Department of Information and Communications Technology (DICT) drafted it through sector consultations that began in January 2023, and President Ferdinand R. Marcos Jr. adopted it through Executive Order No. 58, signed on 4 April 2024. The order describes the plan as a "whole-of-nation roadmap" and directs national government agencies, instrumentalities and government-owned or -controlled corporations to formulate and implement cybersecurity plans aligned with it. Local government units are encouraged, not required, to do the same.

Three features of EO 58 matter for the private sector. First, it is an executive instrument: it does not create new offences, licensing regimes or private-sector obligations, and it does not define or designate CII. Second, it makes the DICT the implementing and monitoring body, reporting to the President through the National Cybersecurity Inter-Agency Committee, with a progress report every two years. Third, it is funded from existing appropriations, which means the pace of implementation depends on annual budget decisions rather than a dedicated fund.

When the DICT began the consultations in 2023, its Cybersecurity Bureau identified enactment of a Critical Information Infrastructure Protection Act, stronger national and sectoral computer emergency response teams (CERTs), and adoption of ISO/IEC 27000-series standards by CII operators as planned outcomes, as reported by Newsbytes.PH on 1 February 2023. The first of those outcomes, the CII statute, is the subject of the next section; the others have proceeded through administrative action, including the Minimum Information Security Standards that the E-Governance Act rules now make binding on government "Covered Entities".

3The cybersecurity and CII bills: where they stand

The 20th Congress inherited more than a dozen cybersecurity and CII bills from earlier Congresses. In the House, these were consolidated into House Bill No. 9605, the National Cybersecurity and Critical Information Infrastructure Protection Act of 2026. According to the Digital Policy Alert tracker, the consolidated bill was introduced on 1 June 2026 and approved by the House on 12 August 2026. Technology news site NoypiGeeks reported that the third-reading approval was endorsed under Committee Report No. 423, that the measure consolidates 28 related bills, and that the Legislative-Executive Development Advisory Council lists it as a priority.

What HB 9605 would do

• Create a National Cybersecurity Agency (NCSA) under the Office of the President as the lead body for cybersecurity policy, national cyber-defence coordination and CII protection. The NCSA would absorb the DICT's cybersecurity division, including staff, tools, records and budget.
• Cover national government offices, GOCCs and government financial institutions, state universities and colleges, local governments, public and private operators of CII, and companies that supply cybersecurity goods and services to government.
• Set minimum cybersecurity standards for CII and strengthen national incident response, as described by the bill's sponsor, Rep. Miguel Luis Villafuerte, in a Daily Tribune report of 5 August 2026.
• Include civil-liberties safeguards: the NCSA would be barred from monitoring public opinion, regulating online content or analysing speech when collecting open-source threat data.

Two companion measures authored by Rep. Brian Poe illustrate the direction of travel. As reported by the Manila Bulletin on 24 November 2025, HB 4191 (Critical Infrastructure Cybersecurity Standards Act) would mandate zero-trust architecture and multi-factor authentication for critical operators and set fines of up to ₱20 million for repeat offences, while HB 4187 (Cyber Maturity and National Resilience Act) would require annual independent maturity assessments and third-party audits against ISO 27001, NIST or similar frameworks. Whether these specifics survived consolidation into HB 9605 should be confirmed against the enrolled House text.

The Senate side

In the Senate, Senate Bill No. 662 filed by Sen. Juan Miguel Zubiri is among the CII protection measures identified at a BusinessWorld forum in August 2025 (BusinessWorld). As of the research date, no Senate committee report or plenary approval of a counterpart to HB 9605 could be confirmed from publicly available records. A bill becomes law only after both chambers pass identical text (usually through a bicameral conference committee) and the President signs or allows it to lapse into law. Businesses should therefore treat the NCSA, the CII designation process and any statutory incident-reporting deadlines as proposed, not current, obligations.

4The E-Governance Act (RA 12254) and its implementing rules

Republic Act No. 12254, the E-Governance Act, was approved on 5 September 2025. It names the DICT as the "lead implementing body and administrator" of the law (Section 6), requires the government to complete its transition to digital services within one year of effectivity (Section 32), and mandates a set of shared platforms: Citizen Frontline Delivery Service Platforms integrating agency services into one portal and mobile application, an Online Public Service Portal, an eLGU system for local governments that cannot build their own, and a Government Public Key Infrastructure for digital certificates (Section 9). Section 25 makes each parent agency the owner and protector of its data, shared with other agencies only through secure application programming interfaces. Section 23 provides that anyone who knowingly compromises government information systems incurs criminal liability under existing penal laws; the Act creates no new offences of its own.

The DICT signed the Implementing Rules and Regulations on 24 March 2026, within the 180-day window set by Section 38. At the signing, DICT Secretary Henry Aguda said the rules mark the point where "we move from intent to implementation", as quoted by the Manila Bulletin. Several IRR provisions have direct cybersecurity and procurement consequences:

• Minimum Information Security Standards (MISS). Covered Entities must comply with DICT-issued MISS and periodically test their security controls (IRR Section 25). Each agency must designate a Chief Information Security Officer and a CSIRT contact and lodge them with the National CERT; the Chief Information Officer may not simultaneously serve as CISO (Sections 21 and 30).
• Interoperability. The Philippine Government Interoperability Framework (PGIF) is binding on all Covered Entities and, significantly, on private ICT providers serving government (Section 15.10).
• Digital identity and signatures. The Philippine National PKI is confirmed as the official government PKI, with guidelines due within 90 days (Section 15.4).
• Data governance. A Master Data Governance Framework is due within 180 days; master datasets are keyed to identifiers such as the National ID number or Business Identification Number, exchanged through a platform such as eGovDX, with a two-year target for "once-only" data submission by citizens (Section 34). Shared data must be disposed of once its purpose is fulfilled (Section 33).
• Procurement. Government procurement systems must be auditable and consistent with the New Government Procurement Act; existing compliant contracts remain valid until they expire (Sections 15.11 and 27).

The IRR does not contain a detailed cloud-hosting regime. The Joint Foreign Chambers of the Philippines, in an 8 April 2026 statement, welcomed the on-schedule issuance of the rules but recommended centralised cloud standards, risk-based deployment and coordinated implementation across national agencies and LGUs. Cloud policy is discussed further in Section 6.

1. 2025-09-05
   RA 12254 approved. E-Governance Act signed; DICT designated lead implementing agency.
2. 2026-03-24
   IRR signed. Deadlines begin to run from IRR effectivity (publication date to be confirmed).
3. 2026-06
   90-day deliverables. E-Government Master Plan, PNPKI guidelines, procurement and website standards due.
4. 2026-07
   120-day deliverables. PGIF, digital payment standards and online portal guidelines due.
5. 2026-09
   180-day deliverables. Master Data Governance Framework; integration filings for existing agency systems.
6. 2027-03
   One-year milestones. EGov UPMO established; Local Government Digital Service Standard published; non-compliant LGUs migrate to eLGU.

5National Privacy Commission: circulars and enforcement, 2025–2026

The NPC's enforcement toolkit was set out in NPC Circular No. 2022-01, the Guidelines on Administrative Fines, which took effect prospectively in August 2022. Grave infractions attract fines of 0.5% to 3% of the violator's annual gross income; major infractions, 0.25% to 2%; failure to register or update registration details, ₱50,000 to ₱200,000; and non-compliance with an NPC order, up to ₱50,000 on top of the underlying fine. The NPC may demand audited financial statements to verify income, and refusal to pay can lead to a cease-and-desist order and contempt proceedings. For regulated industries, the registration and data-processing controls expected of licensed operators are a useful illustration of how these rules apply in practice.

New guidance

On 10 June 2025, NPC Circular No. 2025-01 took effect, governing personal data captured through body-worn cameras, smartphones and similar recording devices. The circular applies both to law-enforcement and security agencies, which must ensure authorisation, retention policies and complaint mechanisms, and to vloggers and content creators, for whom recording identifiable people and uploading, streaming or monetising the footage is personal-data processing requiring notice, fair processing, masking where appropriate and a response to takedown requests. For businesses, the practical point is that CCTV, dash-cam and body-cam footage is squarely within the Data Privacy Act and must be covered by the organisation's privacy notices and retention schedules.

Enforcement actions

Two actions define the current enforcement climate.

• Tools for Humanity (World App), October 2025. On the recommendation of its Complaints and Investigation Division, the NPC issued a cease-and-desist order requiring Tools for Humanity to halt all personal-data processing in the Philippines connected with the World App and its Orb iris-scanning device, as first reported by Newsbytes.PH on 7 October 2025. The NPC's stated grounds were invalid consent arising from undue influence (payments offered for iris scans), lack of transparency, excessive collection of biometric data, and risk of grave and irreparable injury. Deputy Privacy Commissioner Jose Amelito Belarmino II said that "when consent is compromised by the lure of compensation, it ceases to be a genuine expression of choice", according to GMA News Online (9 October 2025). The local operator, WCPH Corp., disputed the findings, said it does not store or sell biometric data, and announced a motion for reconsideration. The outcome of that motion could not be confirmed as of the research date.
• Metro Retail Stores Group, January 2026. MLex reported on 28 January 2026 that the NPC ordered the retailer to release complete CCTV footage to a data subject and imposed a fine of 0.75% of annual gross income, capped at ₱5 million, describing it as the regulator's first enforcement action over a denied data-access request and possibly its largest administrative penalty to date. Businesses should confirm the details against the NPC's published decision before relying on them.

Taken together, these cases show the NPC applying the percentage-based fine schedule, treating biometric and video data as high-risk categories, and enforcing data-subject rights (access, information, objection) as vigorously as security breaches. Organisations that have focused only on 72-hour breach notification should widen their attention to consent design, transparency notices and the handling of access requests.

“The integrity of a Filipino citizen's biometric data is non-negotiable, as it is a unique and permanent identifier.”

— Deputy Privacy Commissioner Jose Amelito Belarmino II, as quoted by GMA News Online, 9 October 2025

6Digital ID, SIM registration and government cloud

PhilSys and the digital National ID

The Philippine Identification System has reached operational scale. According to the Philippine Statistics Authority, as reported by BusinessWorld on 26 March 2026, 91 million Filipinos had registered and received PhilSys numbers as of end-January 2026, 90 million accounts had a digital National ID accessible through the eGov PH app, and roughly 94.7 million transactions had used the National ID for authentication (64 million government, 17.2 million financial-account and 13.4 million other private-sector transactions). The E-Governance Act IRR builds on this by making the National ID number a master-data key for inter-agency exchange. For businesses, the National ID is becoming the default identity credential for know-your-customer processes; organisations relying on it should ensure their verification flows use PSA-sanctioned authentication channels rather than storing copies of the card.

SIM registration follow-through

The SIM Registration Act (RA 11934) remains in force, but officials have acknowledged weaknesses. In remarks reported by the Philippine Daily Inquirer, then DICT Secretary Ivan John Uy conceded that accepting any form of identification during the initial registration period allowed fake IDs and multiple registrations, while Interior Secretary Jonvic Remulla argued the law would remain ineffective until the National ID is integrated with telco registration. Proposals under discussion include requiring subscribers to re-validate with the National ID and deactivating non-compliant SIMs. The National Telecommunications Commission has also been reviewing amendment proposals since early 2025. No amendatory law had been enacted as of the research date. For banks, e-wallets and telcos, the practical exposure remains shared liability for SIM-swap and account-takeover fraud, which the Anti-Financial Account Scamming Act (RA 12010) has sharpened.

Cloud policy

The DICT's Cloud First Policy, first issued in 2017 and later amended to cover GOCCs, state universities and LGUs, requires agencies to prioritise cloud computing subject to data-classification and security requirements. DICT Undersecretary Jeffrey Ian Dy told the Philippine CTO Summit that "proper classification schemes are essential to mitigate risks associated with unauthorized access or exposure", as reported by BusinessWorld. Alongside this, lawmakers have refiled a proposed data-sovereignty bill that would require government agencies and critical sectors to store and process data within Philippine jurisdiction, and industry voices such as Converge ICT's chief executive have urged sovereign-cloud adoption (Newsbytes.PH, 31 October 2025). That bill is proposed legislation only. Vendors to government should expect data-classification, residency and exit clauses to appear in procurement terms regardless of whether a localisation statute is passed.

7What businesses should do now

None of the pending bills creates an obligation today, but the direction of policy is clear enough to act on, and several existing rules already bite. The following programme is aimed at three groups: likely CII operators (energy, telecoms, banking and payments, transport, water, health, large data-centre and cloud providers), technology suppliers to government, and any organisation processing personal data at scale.

CII readiness

• Map which of your systems would plausibly fall within a CII designation and which sector regulator (BSP, Insurance Commission, Energy Regulatory Commission, NTC, Department of Health) already imposes cybersecurity rules on them.
• Benchmark controls against ISO/IEC 27001 and the NIST Cybersecurity Framework, the two references repeatedly cited in the DICT consultations and in HB 4187; document gaps and a time-bound remediation plan.
• Implement multi-factor authentication for privileged and remote access and begin a zero-trust segmentation roadmap, both of which appear as baseline requirements in the House bills.
• Stand up or formalise an internal CSIRT with a named lead, and register points of contact with the National CERT and your sector CERT where one exists.
• Appoint a CISO who is independent of day-to-day IT operations, mirroring the separation the E-Governance IRR now requires of agencies.

Incident reporting discipline

Incident reporting in the Philippines is currently fragmented across the Data Privacy Act (personal-data breaches notifiable to the NPC and affected data subjects within 72 hours of knowledge or reasonable belief), BSP circulars for supervised institutions, PAGCOR and SEC rules for their licensees, and the Cybercrime Prevention Act's law-enforcement channels through the Cybercrime Investigation and Coordinating Center (CICC), PNP Anti-Cybercrime Group and NBI. A single incident-response playbook should identify every regulator with a reporting interest, the trigger for each, the deadline, the content required and who signs off. Preserve forensic evidence (logs, images, chain-of-custody records) from the first hour; this supports both regulatory reporting and any later criminal complaint under RA 10175, for which the firm's cybercrime practice can advise on evidentiary requirements.

Vendor and cloud contracts

• Data-processing terms. Every processor contract should contain the Data Privacy Act minimums: processing only on documented instructions, confidentiality, security measures, sub-processor controls, breach notification to the controller within hours rather than days, assistance with data-subject requests, and deletion or return on exit.
• Interoperability and standards. Suppliers to government should expect PGIF conformance, MISS compliance and PNPKI-compatible digital signatures to become mandatory contract conditions under the E-Governance IRR.
• Data classification and residency. Agree in writing where data is hosted, whether it may be processed abroad, how classification tiers map to controls, and what happens if a localisation law is enacted mid-term.
• Audit and assurance. Secure rights to independent audit reports (SOC 2, ISO 27001 certificates) and to notification of material changes in the vendor's security posture or ownership.
• Exit and continuity. Provide for data portability in open formats, transition assistance and continuity if the vendor is suspended by a regulator or suffers an outage.

8Outlook to 2027

Three questions will shape the next twelve months. First, whether the Senate acts on a counterpart to HB 9605 before the 20th Congress adjourns, and if so whether the final text keeps the National Cybersecurity Agency model or leaves the DICT in charge; the House version would move the DICT's entire cybersecurity division into a new agency under the Office of the President, a structural change with budget and personnel implications. Second, how far the E-Governance Act's one-year transition deadline is met in practice, and whether the DICT uses its Certificate of Non-Compliance procedure against lagging agencies. Third, whether the NPC sustains the enforcement tempo of late 2025 and early 2026 and publishes reasoned decisions that give businesses clearer precedent on consent, biometrics and access requests.

For businesses, the safest assumption is that CII obligations, standards-based audits and multi-regulator incident reporting are coming in some form, and that privacy enforcement is already here. Organisations that invest now in a documented control framework, a tested incident playbook and tight vendor terms will find compliance with whichever text is finally enacted largely a matter of mapping rather than rebuilding.

Abanto Law Firm advises businesses, technology providers and government contractors on Data Privacy Act compliance, NPC complaints and investigations, cybercrime matters and technology contracting. If your organisation may be designated as critical information infrastructure, supplies ICT to government, or is responding to an NPC inquiry, you can contact the firm or learn more about our cybercrime and data-protection practice. Related reading on the Legal Blog covers breach notification, SIM-swap liability and sector-specific privacy controls.

9Frequently asked questions