The National Privacy Commission recently announced that the deadline for the submission of Annual Security Incident Reports for the years 2018 to 2021 is on 31 October 2022, while the deadline to submit the 2022 version of said report is on 31 March 2023.
Through its official website bulletin, the National Privacy Commission (NPC) formally announced the deadlines for submission of the Annual Security Incident Reports (ASIRs). According to the NPC, ASIRs for the years 2018 to 2021 are due on 31 October 2022, while ASIRs for 2022 must be submitted within the period of 1 January 2023 to 31 March 2023.
ASIRs must contain the following information:
- Summary of the number of security incidents1 encountered in a particular calendar year and categorized by type, i.e., theft, identity fraud, sabotage/physical damage, malicious code, hacking, misuse of resources, hardware failure, software failure, communication failure, natural disaster, design error, user error, operations error, software maintenance error, third-party service, and other analogous causes
- Summary of the number of personal data breaches2 encountered in a particular calendar year and classified based on the application of the breach notification obligations, i.e., mandatory and voluntary notification
For this purpose, ASIRs must be filed via the NPC’s Data Breach Notification Management System (DBNMS), as the NPC no longer accepts ASIR submissions via email, personal filing, or courier/postal delivery. Learn more about the DBNMS by reading our recent client alert on the matter, which is available here.
Clients are urged to prepare their respective ASIRs (covering the years 2018 to 2021) in order to ensure timely submission to the NPC by 31 October 2022. We also recommend commencing preparations for the submission of the 2022 ASIR, since the period for submission of the same runs from 1 January 2023 to 31 March 2023.
Failure to submit the ASIR is a violation of NPC issuances, which may be taken into consideration by the NPC on whether a personal information controller (PIC) or personal information processor (PIP) may be subject to a compliance check by the NPC. The NPC’s evaluation or examination of a PIC or PIP’s compliance with the requirements of the Data Privacy Act of 2012, its Implementing Rules and Regulations, and NPC issuances include privacy sweeps, documents submission, and on-site visits.
1 ‘Security incident’ is an event or occurrence that affects or tends to affect data protection, or may compromise the availability, integrity, and confidentiality of personal data. It shall include incidents that would result to a personal data breach if not for safeguards that have been put in place.
2 ‘Personal data breach’ refers to a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed. A personal data breach may be in the nature of:
(a) An availability breach resulting from loss, accidental or unlawful destruction of personal data
(b) An integrity breach resulting from alteration of personal data
(c) A confidentiality breach resulting from the unauthorized disclosure of or access to personal data
Please contact QTInfoDesk@quisumbingtorres.com for inquiries.