Your 2025 Annual Security Incident Report is due on 10 November 2026: who files, and how

The National Privacy Commission has given organizations until 10 November 2026 to file their Annual Security Incident Report for 2025. Here is who must file, what goes into the report, and a seven-step way to get it done properly, even if nothing went wrong last year.

Key takeaways

• The 2025 Annual Security Incident Report (ASIR) is due on 10 November 2026, extended from 31 March 2026 by NPC Advisory No. 2026-03.

• You file even if you had no incidents. A "zero (0) incident" report is still a report.

• The only valid channel is the NPC's Data Breach Notification Management System (DBNMS). Email, courier, and personal filing do not count.

• You cannot edit a submitted report, so check your figures before you click submit.

• The report summarizes your incident log. If you have no log, building one is the real task.

  
  

What the NPC has said

On 8 September 2026, the National Privacy Commission (NPC) issued NPC Advisory No. 2026-03, "Grant of Additional Period to Submit Annual Security Incident Reports for the Year 2025." It moves the deadline for the 2025 report from 31 March 2026 to 10 November 2026.

The advisory makes four points:

1. Who is covered. All personal information controllers (PICs, the organizations that decide why and how personal data is used) and personal information processors (PIPs, the organizations that handle data on someone else's behalf) covered by NPC Circular No. 16-03.

2. How to file. Only through the DBNMS online platform at dbnms.privacy.gov.ph.

3. Nothing happened? File anyway. The report is required "regardless of whether any security incident or personal data breach occurred." If there was none, you report "zero (0) incidents."

4. What happens if you don't? Failure to submit may subject the organization to "appropriate administrative sanctions."

Where the obligation comes from

The annual report is not new. It comes from the NPC's rules on managing personal data breaches, NPC Circular No. 16-03 (15 December 2016), issued under the Data Privacy Act of 2012 (Republic Act No. 10173). Section 22 requires that all security incidents and personal data breaches be documented in written reports, and that a summary be submitted to the NPC every year. In a normal year, the filing window runs from 1 January to 31 March for the previous calendar year.

Two definitions in the circular matter here:

• A security incident is "an event or occurrence that affects or tends to affect data protection, or may compromise the availability, integrity, and confidentiality of personal data."

• A personal data breach is "a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data."

The first is much wider than the second. A lost laptop that was encrypted, a phishing email that an employee clicked but that was contained, a misdirected email caught in time, a server outage that made records unavailable: all of these can be security incidents even though none had to be notified to the NPC as a breach. They still belong in your log, and in your annual count.

What goes into the report

The ASIR is a set of numbers, not a narrative. According to the NPC's breach reporting guidance, it captures:

• the report year and the city or municipality where the organization is located;

• the number of incidents, split into mandatory breach notifications, voluntary breach notifications, and other security incidents; and

• how the incidents occurred, by cause, such as theft, hacking, malicious code, hardware failure or user error.

The NPC also notes on its website that an ASIR "can no longer be updated nor edited once submitted." If you are unsure of a figure, use the system's "Save as Draft" function. If you find an error after submitting, the NPC's instruction is to request deletion by email and then file again.

Why this matters for Philippine organizations

SMEs and growing companies. The most common reasons we hear for not filing are "we're too small" and "nothing happened." Neither is an exemption under the advisory. For a small business with a clean year, the filing is short, but it does require a DBNMS account, and setting one up on deadline day is a risk you don't need.

Enterprises and regulated sectors. Banks, hospitals, schools and insurers usually have incident data spread across IT, information security, HR and customer service. The work is in reconciling those sources into one count that the data protection officer (DPO) can stand behind, and that matches what was reported to other regulators during the year.

BPOs, IT-BPM and multinationals. The advisory names processors, not only controllers. A service provider should not assume its client's filing covers it. Global groups should also check that incidents handled by a regional or head-office security team, but involving personal data processed in the Philippines, are counted locally.

What to do now: a seven-step checklist

1. Confirm who owns the filing. Normally the DPO. Give them a date well before 10 November and authority to ask other teams for records.

2. Check your DBNMS access. Log in at dbnms.privacy.gov.ph now. The NPC asks organizations to register the account under the dedicated email address of the DPO's office, not a personal address, so access survives a change of DPO.

3. Pull together your 2025 incident log. Collect records from IT tickets, security tools, HR and facilities reports (lost devices, misdirected mail) and vendor notices. Cover 1 January to 31 December 2025.

4. Classify each incident. Was it a mandatory breach notification, a voluntary one, or another security incident? Then assign a cause.

5. Cross-check against notifications. The number of mandatory notifications in your ASIR should match what you filed with the NPC during 2025. If it doesn't, find out why before you submit.

6. Review, then submit once. Save as draft, have a second person check the figures, then submit. Keep the acknowledgment with your compliance records.

7. Start the 2026 log today. The report for 2026 will fall due in the first quarter of 2027. A log kept through the year turns next year's filing into a short exercise.

If step 3 produces nothing because no log was kept, record what you can establish, file accurately, and treat the gap as the finding. Circular 16-03 expects a security incident management policy, a data breach response team and documented incidents (Sections 4, 5 and 9). Those are worth putting in place before the next filing.

Why global clients ask about this

International clients rarely ask to see an ASIR, but they do ask the questions behind it: do you record incidents, how do you classify them, how quickly do you escalate, and who decides whether to notify? An organization that can answer from a maintained log, and show a regulator filing made on time, is easier to trust with someone else's customers. A well-kept incident record is one of the quieter ways Philippine organizations earn the trust to compete globally.

Frequently asked questions

We had no incidents in 2025. Do we still file? Yes. NPC Advisory No. 2026-03 requires a report regardless of whether an incident occurred, indicating "zero (0) incident."

Can we send the report by email or hand it in at the NPC office? No. The advisory says 2025 ASIRs must be submitted exclusively through the DBNMS.

We are a processor. Doesn't our client file for us? The advisory covers both PICs and PIPs. A processor should file its own report and agree with clients how shared incidents are counted.

We already notified the NPC about a breach in 2025. Is that enough? No. The 72-hour notification deals with one breach. The ASIR is the yearly summary of all security incidents and breaches, and that breach should appear in it.

Can we correct a report after filing? Not directly. The NPC states that a submitted ASIR cannot be edited; you would need to ask the NPC to delete it and then resubmit.

Talk to us

If you would like a second pair of eyes on your incident log, or help setting up DBNMS access and classifying last year's incidents, we at PrivaLex are glad to help. Message us or book a short scoping call at privalex.com.ph.

Sources

• NPC Advisory No. 2026-03, Grant of Additional Period to Submit Annual Security Incident Reports for the Year 2025, 8 September 2026: https://privacy.gov.ph/wp-content/uploads/2026/09/For-Publication-Advisory-Grant-of-Additional-Period-to-Submit-2025-ASIRs_08Sept.pdf

• NPC Circular No. 16-03, Personal Data Breach Management, 15 December 2016: https://privacy.gov.ph/npc-circular-16-03-personal-data-breach-management/

• National Privacy Commission, Breach Reporting (ASIR and DBNMS guidance): https://privacy.gov.ph/pips-and-pics/breach-reporting/

• National Privacy Commission, Data Breach Notification Management System: https://dbnms.privacy.gov.ph/

• National Privacy Commission, homepage notice on 2025 ASIR submission: https://privacy.gov.ph/

• Data Privacy Act of 2012 (Republic Act No. 10173): https://privacy.gov.ph/data-privacy-act/