In brief
The National Privacy Commission (NPC) has issued Advisory No. 2026-02 (“Advisory”), prescribing guidelines on the submission of personal data breach notifications through the Data Breach Notification Management System (DBNMS). The Advisory is directed at personal information controllers (PICs) seeking postponement of notification to affected data subjects, exemption from such notification, or approval to use alternative means of notification, as well as those seeking extensions for required submissions under NPC Circular No. 16-03 on Personal Data Breach Management.
The Advisory addresses a gap in the notification practices of PICs, where some had been filing combinations of requests that are, as a matter of regulatory logic, mutually incompatible. The NPC has now clarified that exemption, which presupposes that no notification is owed, cannot be pursued alongside postponement or alternative means of notification, both of which presuppose that notification is required. Filing such incompatible requests simultaneously risks the denial of one or all of them.
Moreover, the Advisory reinforces the rule that filing requests through the DBNMS does not pause a PIC’s obligations under NPC Circular No. 16-03. As such, the full breach report is due within five days from the date of discovery regardless of any pending request, and the NPC's silence on a submitted request cannot be treated as an approval. All approvals must therefore be expressly issued in writing by the NPC.
For PICs, the practical takeaway is clear: breach response playbooks should be updated to reflect these procedural rules, requests submitted to the NPC must be carefully grounded and documented, and the five-day reporting window must be observed as an unconditional timeline.
For a detailed analysis of the Advisory, read the full alert on quisumbingtorres.com or through the link below.
* * * * *
© 2026 Quisumbing Torres. All rights reserved. Quisumbing Torres is a member firm of Baker & McKenzie International, a Swiss Verein. This may qualify as “Attorney Advertising” requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome.