Cybersecurity - Philippines

There is no single horizontal cybersecurity statute. Obligations are spread across criminal law (RA 10175), data-protection law (RA 10173), and sectoral regulators, with DICT as the lead agency under RA 10844.

Approved 12 September 2012, it criminalizes illegal access (hacking), data and system interference, device misuse, cybersquatting, computer-related fraud and related offenses; enforcement is by the NBI and PNP cybercrime units and the DOJ Office of Cybercrime.

Under the Data Privacy Act and NPC rules, controllers must notify the National Privacy Commission and affected data subjects within 72 hours of knowledge or reasonable belief of a personal-data breach involving sensitive data or a real risk of serious harm.

President Marcos Jr. adopted DICT's NCSP 2023-2028 via Executive Order No. 58, a whole-of-nation roadmap directing government agencies and GOCCs to formulate cybersecurity plans; it is a strategy, not a binding statutory obligation regime.

The Bangko Sentral ng Pilipinas imposes information-security and cyber-risk requirements on supervised financial institutions, notably Circular No. 982 (Enhanced Guidelines on Information Security Management) and Circular No. 1019 (technology and cyber-risk reporting/notification requirements).

A Cybersecurity Act is pending in Congress; it would protect critical information infrastructure (CII), require ISO/IEC 27001/22301/27701 standards, and mandate CII operators to report incidents to the NCERT with an initial report within 24 hours — but it is not yet enacted.