The Philippines' National Privacy Commission (NPC) said on 6 November 2026 that it had received no personal-data breach notifications from the agencies concerned, after claims of leaks at government bodies appeared online on 5 November. The statement did not name the Bureau of Internal Revenue (BIR). In an advisory the same day, the BIR said it was aware of online reports of a leak of data linked to the agency. It added that a leak allegation alone does not establish a breach. According to Gulf News (updated 7 November), the BIR is investigating with the DICT, the National Computer Emergency Response Team, the Cybercrime Investigation and Coordinating Center and the PNP Anti-Cybercrime Group. The BIR has not said what data is involved or how many people are affected.
The case for the NPC's caution
The strongest argument for the NPC's posture is that it is correct on the law. Section 20(f) of the Data Privacy Act of 2012 requires a controller to notify the Commission and affected data subjects when sensitive personal information "are reasonably believed to have been acquired by an unauthorized person" and this is likely to cause "a real risk of serious harm." The trigger is a reasonable belief of unauthorized acquisition, not a screenshot on a forum. Regulators who treat every claim as a confirmed breach would flood agencies with notification obligations, and would hand anyone with a Telegram account the power to set a state response in motion.
A leak claim can also be wrong, recycled, or built from old data. The September website defacement the BIR reported, which Gulf News says the agency has not linked to the new allegations, is a reminder that a visible incident is not the same as exfiltration of taxpayer records.
Why silence is still a policy problem
The weakness in that logic is the information gap. The NPC's statement is accurate, but taxpayers are left with nothing to act on. The legal threshold for notification depends on the controller's own assessment, and the controller is the party under investigation. Four agencies are investigating, yet the public does not know whether the data involved is names, tax identification numbers or something more sensitive.
The Philippines has been here before. In April 2023 a report described a database of 1,279,437 records tied to law enforcement applicants and employees, with the PNP, NBI, BIR and Civil Service Commission named. As PTV News reported on 20 April 2023, the BIR and CSC said the breach did not occur in their offices, while the BIR also said it was working with authorities to "mitigate the reported breach." Privacy Commissioner John Henry Naga's line at the time, "Do not collect if you can't protect," remains the right test.
The collection problem
That test matters because the state keeps widening what it collects. Republic Act 11934, the SIM Registration Act, requires SIMs to be registered as a pre-requisite to activation, backed by valid government-issued photo ID under Section 5. Existing subscribers had 180 days from the Act's effectivity to register, extendable by the DICT by up to 120 days. Telecom providers must keep the data for ten years after an end-user deactivates a number.
The Act does include safeguards. Registration data is to be released only on a subpoena from a competent authority following a sworn complaint, and disclosure by a provider, its agents or employees is fined between ₱500,000 and ₱4,000,000. That is a meaningful deterrent against deliberate leaks. But it is a penalty on providers, and its power depends on a breach being found, reported and attributed. It does not shrink the pool of data that an attacker, or an insider, could target.
Nothing in the hook ties the BIR allegation to SIM registration data, and we do not suggest it. The point is structural. Tax records and SIM registries are both identity-linked databases held for long periods, and both are only as trustworthy as the incident-disclosure practice around them.
What proportionate reform looks like
Pro-innovation, evidence-based regulation does not mean more mandates. It means making existing duties verifiable. Three changes would help without burdening legitimate business:
- Publish a status within a fixed window. Where a government agency is investigating a credible leak claim, the NPC could publish a short interim notice saying what is known, what is not, and when the next update is due. This costs little and does not prejudge the outcome.
- Separate the verifier from the investigated. Where a public agency is the alleged victim, a technical finding from the DICT's CERT or an independent reviewer should inform the NPC's notification decision, not only the agency's self-assessment.
- Cut retention and collection, not just add penalties. A ten-year retention period for SIM data is a long exposure window. Shorter retention is a more reliable security control than higher fines after the fact.
Enforcement should also stay targeted at concealment and negligence, not at the fact that attacks occur. Agencies that are hit but notify promptly should be treated differently from those that stay quiet. A regime that punishes disclosure will get less of it.
What to watch
The NPC said it would coordinate with the agencies to establish whether personal information was compromised. The test of that process is simple: whether it ends with a published finding, whichever way it comes out. If the allegation proves false, a clear statement helps the BIR and the public. If it proves true, affected taxpayers need to hear it from the controller, as Section 20(f) intends. Either outcome is better than the current position, where a regulator has correctly stated the law and the public still knows almost nothing.