MANILA – Ten government agencies have notified the National Privacy Commission (NPC) of personal data breaches, as the NPC reminded agencies that reporting an incident is only part of their responsibility.
“Equally important is how the agency responds to the incident, protects the individuals who may be affected, and addresses the vulnerabilities that may have contributed to the breach,” NPC Deputy Privacy Commissioner and spokesperson Jose Belarmino II said in a statement on Tuesday.
Belarmino identified the agencies as the Presidential Commission on Good Government, the Department of Information and Communications Technology, and the Department of Labor and Employment.
He also listed the Bureau of Internal Revenue, the Philippine Amusement and Gaming Corporation, and the Department of Justice.
The rest were the Securities and Exchange Commission, the Philippine Coast Guard (PCG), the Department of Trade and Industry, and the Department of Science and Technology-Philippine Institute of Volcanology and Seismology.
The NPC’s Compliance and Monitoring Division reviews each notification and submits a report to the Commission En Banc, which decides the appropriate action.
He said agencies remain accountable even when they outsource data processing, citing Section 21 of Republic Act 10173 (Data Privacy Act of 2012).
The notifications follow reports on Nov. 5, 2026, that a threat actor had obtained records allegedly from the Department of Transportation’s Human Resource Information System.
A group called DeathNoteHackers also claimed to hold PCG data.
Both claims, documented by cybersecurity group Deep Web Konek, remain unverified.
The privacy body reminded the public to watch out for phishing, identity theft, and other scams that may exploit the breach reports.
It added that it will continue to monitor the incidents and provide updates as appropriate. (Raymond Carl Dela Cruz/PNA)
