Cybersecurity law & regulation in Philippines (2026)
Cybersecurity in Philippines: sectoral rules.
The Philippines lacks an omnibus, NIS2-style cybersecurity law; obligations instead arise from sector-specific and cross-cutting instruments. Cybercrime is criminalized under RA 10175, personal-data breach duties flow from RA 10173 and NPC rules, and financial institutions face detailed BSP information-security and cyber-incident reporting circulars. A comprehensive Cybersecurity Act is under deliberation in Congress and has been backed as priority legislation but is not yet enacted as of 2026.
Legal framework
No single comprehensive cybersecurity statute is yet in force. The regime is a patchwork: the Cybercrime Prevention Act (RA 10175), the Data Privacy Act (RA 10173) administered by the National Privacy Commission, sector-specific rules from the Bangko Sentral ng Pilipinas (BSP) for financial institutions, and the policy-level National Cybersecurity Plan 2023-2028 (adopted by Executive Order No. 58), coordinated by the Department of Information and Communications Technology (DICT). A comprehensive Cybersecurity Act bill remains pending in Congress.
Key points: cybersecurity in Philippines
No omnibus law (sectoral regime)
There is no single horizontal cybersecurity statute. Obligations are spread across criminal law (RA 10175), data-protection law (RA 10173), and sectoral regulators, with DICT as the lead agency under RA 10844.
Cybercrime Prevention Act (RA 10175)
Approved 12 September 2012, it criminalizes illegal access (hacking), data and system interference, device misuse, cybersquatting, computer-related fraud and related offenses; enforcement is by the NBI and PNP cybercrime units and the DOJ Office of Cybercrime.
Data-breach notification (RA 10173 / NPC)
Under the Data Privacy Act and NPC rules, controllers must notify the National Privacy Commission and affected data subjects within 72 hours of knowledge or reasonable belief of a personal-data breach involving sensitive data or a real risk of serious harm.
National Cybersecurity Plan 2023-2028 (policy)
President Marcos Jr. adopted DICT's NCSP 2023-2028 via Executive Order No. 58, a whole-of-nation roadmap directing government agencies and GOCCs to formulate cybersecurity plans; it is a strategy, not a binding statutory obligation regime.
Financial-sector cyber rules (BSP)
The Bangko Sentral ng Pilipinas imposes information-security and cyber-risk requirements on supervised financial institutions, notably Circular No. 982 (Enhanced Guidelines on Information Security Management) and Circular No. 1019 (technology and cyber-risk reporting/notification requirements).
Comprehensive Cybersecurity Act (proposed)
A Cybersecurity Act is pending in Congress; it would protect critical information infrastructure (CII), require ISO/IEC 27001/22301/27701 standards, and mandate CII operators to report incidents to the NCERT with an initial report within 24 hours, but it is not yet enacted.
Timeline of decisions
- Guidance · officialBSP Launches Financial Services Cyber Resilience Plan 2024-2029
The Bangko Sentral ng Pilipinas (BSP) unveiled the six-year Financial Services Cyber Resilience Plan (FSCRP), directing all BSP-supervised financial institutions to adopt standardised incident-response protocols and resilience benchmarks. This followed P5.82 billion in recorded cyber losses across the financial sector in 2024.
Bangko Sentral ng Pilipinas
- Law · officialAnti-Financial Account Scamming Act (RA 12010) Signed into Law
President Marcos signed Republic Act No. 12010 (AFASA), criminalising money muling and social engineering schemes (phishing, smishing, vishing) with penalties up to 10 years imprisonment. It imposes liability on financial institutions that fail to prevent account takeovers, significantly extending cybersecurity obligations beyond RA 10175.
Supreme Court E-Library (Republic Act No. 12010)
- Incident · officialJollibee Foods Corporation Data Breach, 11 Million Customers Exposed
Threat actor 'Sp1d3r' claimed to have exfiltrated data on up to 32 million customers across Jollibee's brands; the National Privacy Commission confirmed approximately 11 million records were affected, including dates of birth and senior citizen IDs, making it the largest confirmed data breach in Philippine history. The NPC opened a formal investigation.
Philippine News Agency (PNA)
- Law · officialExecutive Order No. 58 Adopts National Cybersecurity Plan 2023-2028
President Marcos issued EO 58, formally adopting the NCSP 2023-2028 as the country's whole-of-nation cybersecurity roadmap and directing all national government agencies to align their own cybersecurity plans with it. The plan uses a CIANA-PS framework and designates DICT/CICC as the lead implementation body.
Presidential Communications Office
- Guidance · officialNPC Circular 2023-06: Updated Minimum Security Requirements for Personal Data
The National Privacy Commission's Circular 2023-06 took effect, prescribing mandatory technical and organisational security controls for all personal information controllers and processors, including DPO designation, privacy impact assessments, and mandatory breach-response procedures; entities were given until 30 March 2025 to achieve full compliance.
National Privacy Commission
- Incident · officialPhilHealth Hit by Medusa Ransomware, Up to 42 Million Records at Risk
The Philippine Health Insurance Corporation suffered a Medusa ransomware attack that paralysed member portals and compromised approximately 72 workstations; the attackers demanded USD 300,000 and, when unpaid, publicly leaked the database on Telegram. DICT issued a national technical advisory, and the NPC launched a self-check portal for affected members.
Philippine Health Insurance Corporation
- Law · officialSIM Registration Act (RA 11934) Signed
Republic Act No. 11934 required all mobile subscribers to register SIM cards with their real identities, aimed at eliminating the anonymity that enables phishing and SMS scams; telcos were given six months to implement, and unregistered SIMs were deactivated by mid-2023. The law is enforced by the National Telecommunications Commission.
Official Gazette of the Republic of the Philippines
- Guidance · officialBSP Circular 1140: Mandatory Fraud Management Systems for Banks
Bangko Sentral ng Pilipinas issued Circular No. 1140 mandating all BSP-supervised financial institutions to deploy robust fraud management systems to detect and prevent cyber-enabled fraud; the measure also overhauled IT Risk Management regulations and introduced the ASTERisC* suptech platform for automated cybersecurity compliance supervision.
Bangko Sentral ng Pilipinas
- IncidentCOMELEC 'Comeleak' Breach, 55 Million Voter Records Exposed
Hackers under Anonymous Philippines defaced the Commission on Elections website; separately, LulzSec Pilipinas dumped the entire 340 GB voter database online, exposing biometric data, passport numbers, and fingerprints of 55 million registered voters, still one of the largest government data breaches in world history and a catalyst for NPC enforcement build-up.
The Register
- Decision · officialSupreme Court Upholds RA 10175 (with Partial Strikes) in Disini v. Secretary of Justice
The Supreme Court (G.R. No. 203335) lifted its October 2012 TRO and upheld the core cybercrime offences under RA 10175, illegal access, data interference, cybersex, and child pornography provisions, while striking down the online libel provision for being overbroad, giving the Cybercrime Prevention Act its final constitutional shape.
Supreme Court E-Library (G.R. No. 203335)
- Law · officialCybercrime Prevention Act (RA 10175) Enacted, First Comprehensive Cybercrime Law
President Aquino signed RA 10175 into law, criminalising illegal access, data and system interference, computer-related fraud, cybersex, and child pornography; it also created the Cybercrime Investigation and Coordinating Center (CICC) as the national cybersecurity coordination body and established real-time collection powers for law enforcement.
Official Gazette of the Republic of the Philippines
- Law · officialE-Commerce Act (RA 8792) Signed, Foundational Digital-Commerce and Cybercrime Framework
President Estrada signed RA 8792, conferring legal recognition on electronic documents, signatures, and commercial transactions and criminalising hacking and other computer offences, making the Philippines one of the earliest Southeast Asian nations with dedicated e-commerce and cyber-fraud legislation. The law established the foundational legal infrastructure for internet commerce and digital evidence that all subsequent online-safety laws would build upon.
Official Gazette of the Philippines
Sources
- officialgazette.gov.ph/2012/09/12/republic-act-no-10175/
- doj.gov.ph/office-of-cybercrime.html
- privacy.gov.ph/pips-and-pics/breach-reporting/
- elibrary.judiciary.gov.ph/thebookshelf/showdocs/5/97132
- pco.gov.ph/news_releases/pbbm-adopts-dicts-national-cybersecurity-plan-2023-2028
- dict.gov.ph/cybersecurity
- dict.gov.ph/news-and-updates/25023
- pco.gov.ph/news_releases/pbbm-backs-proposed-legislation-to-beef-up-governments-
- bsp.gov.ph/Regulations/Issuances/2017/c982.pdf
- lpr.adb.org/resource/enhanced-guidelines-information-security-management-bangko-s
Next for Philippines: Starting a BusinessModerate
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 23 May 2026. Methodology & how to cite · State of Technology Regulation 2026