On 10 November 2026 the National Privacy Commission (NPC) said it had received personal data breach notifications from 10 government agencies, among them the Bureau of Internal Revenue (BIR), the Securities and Exchange Commission (SEC), the Department of Justice (through its Office for Alternative Dispute Resolution) and the Department of Information and Communications Technology (DICT), according to Gulf News. The NPC is assessing whether regulatory action is warranted, and it reminded agencies that their duties continue when processing is outsourced.
The timing is awkward for the government's data localisation agenda. Executive Order No. 119 is dated 13 July 2026 and creates a classification and residency regime for government data. The question is whether keeping data onshore would have prevented these incidents. On the evidence so far, it would not.
The strongest case for residency
The case for localisation is serious. Government datasets such as tax records, company filings and case files are strategic assets. Data held offshore can be exposed to foreign legal process, and a state needs to be able to inspect, audit and if necessary seize the systems that hold its most sensitive records. EO 119 states that all government data "shall remain subject to the laws and jurisdiction of the Republic of the Philippines, regardless of where such data is stored, processed, or handled" (Section 7, EO 119 text). For the most sensitive tiers, a residency rule is a reasonable precaution.
What EO 119 actually does
The order is more calibrated than the word "localisation" suggests. It sets four categories of Restricted Access Data (Top Secret, Secret, Confidential and Restricted) plus Open Access Data. The residency duties are tiered:
- Top Secret data must be stored within Philippine territory or territory under Philippine jurisdiction, such as embassies and consulates.
- Confidential data is stored domestically as a general rule. It may be stored or processed abroad only with the express prior approval of the Joint Oversight Committee for Data Classification (JOC-DC) and adequate safeguards that maintain governmental control.
- Restricted data may sit on a secured cloud platform subject to encryption and risk mitigation.
- All other data, including open data, may use secure cloud platforms "irrespective of the physical location of the platform or the ownership."
That design is defensible. It reserves hard localisation for a narrow band of data and leaves the rest open to commercial cloud, which is where most public-sector capacity and security tooling now sits. It also says agencies that use cloud providers "remain responsible for ensuring data security and compliance," and must include contractual and technical safeguards.
Residency is not the same as security
The breaches reported this week are a reminder that where a server sits does not decide whether it is breached. The NPC's reminder is the telling part: agencies stay responsible for personal information even when processing is outsourced to third-party providers, as the Daily Tribune reported. That is not new law. Section 21 of the Data Privacy Act of 2012 makes the controller accountable for data transferred to a third party for processing, "whether domestically or internationally," and requires contractual or other reasonable means to provide comparable protection (RA 10173).
The public record does not yet show the cause of each incident, and the NPC has given no consolidated count of affected individuals. The SEC, for its part, said it detected an incident on 6 November and that individual profile information may have been exposed, while company records, passwords and data integrity were unaffected. It would be wrong to attribute these events to any one architecture. The relevant lesson is narrower. Accountability for outsourced processing has been the law since 2012, and ten agencies have now filed notifications under it. A residency order added on top of that does not close the gaps that matter most: vendor oversight, access control, logging and incident response.
There is a regional parallel. Japan is dealing with a vendor-side compromise of an email distribution service that cascaded to many customers, including the city of Osaka, according to The Record. Concentrated third-party risk crosses borders. A domestic vendor can fail just as an offshore one can.
The guidelines clock is less clear than it looks
The 120-day deadline for guidelines is where policy risk concentrates. Section 12 says the implementing guidelines "shall be issued within one hundred twenty (120) days from the effectivity of this Order," and Section 19 makes the order effective upon publication in the Official Gazette or a newspaper of general circulation. The order is dated 13 July, but the lawphil copy I fetched gives no publication date, and its closing line even reads "13th day of May." So the clock may not run from signing, and I could not confirm that guidelines have been issued. Mid-November is therefore an approximation, not a verified deadline.
That ambiguity has a cost. The guidelines are supposed to define which private entities, including those in public-private partnerships, utilities and critical infrastructure, fall within the order when they hold government data. Vendors and cloud providers cannot plan procurement or architecture without that definition. Agencies have three years to reach full compliance, with Top Secret and Secret data due in year two, so there is time to get this right. There is none to waste on vague text.
What proportionate implementation looks like
First, the guidelines should keep the narrow tiering. Extending the Confidential-tier approval requirement to routine workloads would slow adoption of secure cloud services without addressing the breach pattern.
Second, the JOC-DC approval process for offshore Confidential data should have published criteria and decision timelines. Unpublished discretion invites delay and uneven treatment of providers.
Third, the order's own text says nothing in the transition "shall be construed to suspend or defer compliance" with the Data Privacy Act. The NPC should therefore use these ten cases to set out concrete expectations for processor contracts and vendor audits, and should publish what it finds. Enforcement that explains itself raises standards across the whole public sector.
Fourth, the government should publish the guidelines' status, including the publication date that starts the clock. A transparency regime for data should itself be transparent.
Residency can be a reasonable control for the most sensitive records. But the test of EO 119 will be whether agencies, and the vendors they hire, can show who touches the data and how quickly they notice when something goes wrong. Those are questions about governance, not geography.