Search for:
Data Privacy

Philippines: Deadlines for submission of Annual Security Incident Reports set by the National Privacy Commission

By and 3 Mins Read

The National Privacy Commission recently announced that the deadline for the submission of Annual Security Incident Reports for the years 2018 to 2021 is on 31 October 2022, while the deadline to submit the 2022 version of said report is on 31 March 2023.

In brief

Through its official website bulletin, the National Privacy Commission (NPC) formally announced the deadlines for submission of the Annual Security Incident Reports (ASIRs). According to the NPC, ASIRs for the years 2018 to 2021 are due on 31 October 2022, while ASIRs for 2022 must be submitted within the period of 1 January 2023 to 31 March 2023.

ASIRs must contain the following information:

  • Summary of the number of security incidents1 encountered in a particular calendar year and categorized by type, i.e., theft, identity fraud, sabotage/physical damage, malicious code, hacking, misuse of resources, hardware failure, software failure, communication failure, natural disaster, design error, user error, operations error, software maintenance error, third-party service, and other analogous causes
  • Summary of the number of personal data breaches2 encountered in a particular calendar year and classified based on the application of the breach notification obligations, i.e., mandatory and voluntary notification

For this purpose, ASIRs must be filed via the NPC’s Data Breach Notification Management System (DBNMS), as the NPC no longer accepts ASIR submissions via email, personal filing, or courier/postal delivery. Learn more about the DBNMS by reading our recent client alert on the matter, which is available here.

Recommended actions

Clients are urged to prepare their respective ASIRs (covering the years 2018 to 2021) in order to ensure timely submission to the NPC by 31 October 2022. We also recommend commencing preparations for the submission of the 2022 ASIR, since the period for submission of the same runs from 1 January 2023 to 31 March 2023.

Failure to submit the ASIR is a violation of NPC issuances, which may be taken into consideration by the NPC on whether a personal information controller (PIC) or personal information processor (PIP) may be subject to a compliance check by the NPC. The NPC’s evaluation or examination of a PIC or PIP’s compliance with the requirements of the Data Privacy Act of 2012, its Implementing Rules and Regulations, and NPC issuances include privacy sweeps, documents submission, and on-site visits.

1 ‘Security incident’ is an event or occurrence that affects or tends to affect data protection, or may compromise the availability, integrity, and confidentiality of personal data. It shall include incidents that would result to a personal data breach if not for safeguards that have been put in place.
2 ‘Personal data breach’ refers to a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed. A personal data breach may be in the nature of:
(a) An availability breach resulting from loss, accidental or unlawful destruction of personal data
(b) An integrity breach resulting from alteration of personal data
(c) A confidentiality breach resulting from the unauthorized disclosure of or access to personal data

LOGO Philippines_QuisumbingTorres_Manila

Please contact QTInfoDesk@quisumbingtorres.com for inquiries.

VISIT QUISUMBING TORRES SITE

Categories:
Author

Bienvenido Marquez III is a partner in Quisumbing Torres' Intellectual Property, Data and Technology Practice Group. He also co-heads the Consumer Goods & Retail Industry Group and is a member of the Technology, Media & Telecommunications Group. He participates in initiatives of Baker & McKenzie International of which Quisumbing Torres is a member firm. He is a member of Baker McKenzie's Asia Pacific Intellectual Property Business Unit for Brand Enforcement. He is immediate Past President of the Philippine Chapter of the Licensing Executives Society International (2019-2021), and is currently co-chair of the LESI Asia Pacific. He is also a member of the Anti-Counterfeiting Committee of the International Trademarks Association (INTA). He has been appointed as member of the INTA Asia Global Advisory Council (GAC) for 2022 to 2023, making him the only Philippine representative on the council.

Bien has vast experience in handling IP enforcement litigation, trademark and patent prosecution and maintenance, copyright, data privacy, information security, IT, telecommunications, e-commerce, electronic transactions, cyber security and cybercrime. He has been consistently ranked as a leading individual for Intellectual Property and TMT in Legal 500 Asia Pacific, Chambers Asia Pacific, asialaw Leading Lawyers, Managing IP Stars, Asia IP, and World Trademark Review. He was also recognized as a Volunteer Service Awardee by INTA in 2018.

Author

Divina Ilas-Panganiban is a partner and the head of Quisumbing Torres’ Intellectual Property, Data and Technology Practice Group and co-heads the Technology, Media & Telecommunications (TMT) Industry Group. She participates in initiatives of Baker & McKenzie International of which Quisumbing Torres is a member firm. She is a member of Baker & McKenzie International's Asia Pacific TMT, and the Asia Pacific Intellectual Property Steering Committees.

Divina is a Certified Information Privacy Manager by the International Association of Privacy Professionals (IAPP). She currently serves as the Vice-President and Director of the Philippine Chapter of the Licensing Executives Society International, the Co-chairperson of the LESI's Education Committee, the Co-chairperson of the Committee on Intellectual Property Rights, The American Chamber of Commerce of the Philippines, and the Chairperson of the Committee on Intellectual Property Rights of the European Chamber of Commerce.

Divina was recently appointed to be a member of the Advisory Council for Intellectual Property (ACIP) of the Intellectual Property Office of the Philippines (IPOPHL). The ACIP is an advisory board composed of a select group of people from different sector to which IP is of great value.

Divina just finished her stint as the chair the Unreal Campaign of the International Trademarks Association (INTA) for East Asia and the Pacific and is now part of the Data Protection Committee of INTA.

Related Posts

Write A Comment