Data breach in the news? What the 72-hour rule means for your office

In early November 2026, reports surfaced of data leaks involving several government agencies following a wave of cyberattacks on November 5. The National Privacy Commission (NPC) said it would verify the reports with the agencies involved. It also noted that, at the time, it had not yet received breach notifications from them.

The NPC added an important point: a report of an alleged leak does not, by itself, prove that a personal data breach happened or that the law was broken. That's why verification comes first.

Whatever the outcome, the story is a good prompt for every organization that handles personal data, which is nearly all of them.

The 72-hour rule, in plain words

Under the Data Privacy Act of 2012 (RA 10173) and the NPC's rules on breach management (NPC Circular 16-03, as cited in current news reports):

• Who must act: the personal information controller, meaning the organization that decides how personal data is collected and used. That's your company, school, clinic, NGO or LGU, not your IT supplier.
• When: within 72 hours of learning about, or reasonably believing there was, a breach that requires notification.
• Who to tell: the NPC and the affected individuals.

Seventy-two hours is very little time if you're starting from zero. Most of that time disappears just figuring out what happened.

What usually goes wrong

• Nobody knows who's in charge. Is it IT, the Data Protection Officer, or management?
• Nobody knows what data is where. You can't say what was exposed if you never listed what you keep.
• Logs don't exist. Without records of who accessed what, it's hard to judge the scope.
• Vendors are slow to tell you. If a supplier's platform is breached, your clock may start when they tell you, so make sure your contracts require them to tell you quickly.

Prepare now, before you need it

1. Know your data

Make a simple list of the personal data you collect: what it is, where it's stored, who can access it, and how long you keep it. A spreadsheet is fine to start.

2. Name the people

Your Data Protection Officer plus a small response team: someone from management, IT, and whoever handles communications. Write down their phone numbers somewhere that isn't on the system that might be down.

3. Turn on logging and keep it

Make sure email, cloud storage and key systems keep access logs, and that someone knows how to read them.

4. Draft the notification in advance

Prepare a template with what happened, what data was involved, what you're doing, and what affected people should do. Filling in blanks under pressure is much easier than writing from scratch.

5. Reduce what you keep

Data you don't hold can't leak. Delete old records you no longer need, following your retention policy.

6. Rehearse once

A one-hour tabletop exercise ("our shared drive was encrypted, what now?") will show the gaps faster than any document.

The bottom line

Breaches happen to careful organizations too. What separates a manageable incident from a disaster is usually preparation: knowing your data, knowing your people, and being able to act within the 72-hour window.

This article is general information, not legal advice. If you'd like help with the technical side, such as data mapping, access logging, backups and security hardening, our security check-up covers exactly that.